A collaborative intrusion detection method and system based on industrial control network

Abstract

The present invention discloses a collaborative intrusion detection method and system based on an industrial control network, and relates to the technical field of network security. The collaborative intrusion detection system based on an industrial control network realizes all-round monitoring, analysis and dynamic adjustment of the network through the organic cooperation of multiple units, so that the system architecture provides a real-time, intelligent and adaptive network security solution. Compared with the traditional intrusion detection system, the system pays more attention to the real-time optimization of network performance, and reduces unnecessary interference to other servers under the condition of high bandwidth occupancy rate, thereby solving the problem of lengthy and cumbersome protocol identification, thereby enabling the system to better adapt to the complex and changeable industrial control environment, improving the overall level of network security and performance, and further strengthening the stability and security of the industrial network.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a collaborative intrusion detection method and system based on an industrial control network. Background Art

[0002] A collaborative intrusion detection system is a network security system specifically designed for monitoring and defense. The system is usually used in industrial environments, such as manufacturing plants, power stations, water treatment plants, etc. Its purpose is to ensure the normal operation of industrial control systems and protect them from cyber attacks.

[0003] Traditional collaborative intrusion detection systems parse data packets to capture the byte features of encryption protocols, and match the appropriate decoding system based on the byte features to perform security checks on encrypted data packets. In this process, the detection system will occupy additional bandwidth, thereby increasing the bandwidth burden. If the bandwidth cannot be released, the protocol recognition efficiency will be reduced, and it will also interfere with other industrial servers.

[0004] When faced with the problem of increased bandwidth usage, traditional collaborative intrusion detection systems often unilaterally reduce the bandwidth usage of non-primary servers to relieve bandwidth pressure. However, the system protocol identification still uses traditional full-byte feature recognition, which makes the protocol identification lengthy and cumbersome, causing excessive interference to other servers. Summary of the invention

[0005] 1. Technical issues to be resolved

[0006] In view of the deficiencies in the prior art, the present invention provides a collaborative intrusion detection method and system based on an industrial control network, which solves the problem mentioned in the background technology that unilaterally reducing the bandwidth occupancy of non-primary servers causes lengthy and cumbersome protocol identification.

[0007] (II) Technical solution

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions: a collaborative intrusion detection system based on an industrial control network, comprising a data acquisition unit, a data preprocessing unit, a data parsing unit, a data analysis unit, a decision unit and an alarm unit:

[0009] The data acquisition unit is used to collect data on network bandwidth and security protocol respectively, thereby obtaining bandwidth data group and protocol data group, and input the obtained bandwidth data group and protocol data group into the data preprocessing unit;

[0010] The data preprocessing unit performs data cleaning and data sorting on the bandwidth data group and the protocol data group to generate a first data group and a second data group, and inputs the processed first data group and the second data group into the data parsing unit;

[0011] The data parsing unit is used to integrate and calculate the first data group and the second data group to generate a bandwidth reference value Dckz and a protocol reference value Xckz, and integrate and calculate the bandwidth reference value Dckz and the protocol reference value Xckz to generate an adjustment reference value Tckz, and input the calculated adjustment reference value Tckz into the data analysis unit;

[0012] The data analysis unit is used to compare the calculated adjustment reference value Tckz with the preset first threshold value Y to generate a first pair of results, and judge whether the protocol recognition mode needs to be adjusted according to the first comparison result. When the comparison result shows that no adjustment is required, the full field matching of the protocol is maintained. If the comparison result shows that adjustment is required, the adjustment reference value Tckz and the first threshold value Y are integrated and calculated to generate a correction difference value Tcz, and the correction difference value Tcz is compared with the preset second threshold value R to generate a second comparison result, thereby dividing the correction magnitude, and the second comparison result is input into the decision unit;

[0013] The decision unit adapts and executes the second comparison result and the preset correction scheme, and generates a work log and sends it to the alarm unit;

[0014] The alarm unit reclassifies the work log according to the magnitude of the correction scheme specifically executed by the work log and sends an alarm message.

[0015] Preferably, the data acquisition unit comprises a first acquisition module and a second acquisition module, wherein the first acquisition module is used to acquire bandwidth data to generate bandwidth data groups, and the second acquisition module is used to acquire protocol data to obtain protocol data groups.

[0016] Preferably, the first acquisition module obtains the total bandwidth value Zdkz through the network manager, and the network traffic detection tool detects the used bandwidth, and records them separately according to the timestamps through the system clock. The timestamps are respectively recorded as S1, S2, S3,..., Sn, and the real-time bandwidth values ​​are respectively recorded as S1Sdkz, S2Sdkz, S3Sdkz,..., SnSdkz.

[0017] Preferably, the second acquisition module includes a protocol identification module and a protocol parsing module, wherein the protocol identification module is used to obtain the protocol version field Xbzd and the protocol length field Xcdz in the data packet, and the protocol parsing module is used to obtain the protocol start field Xqsz and the protocol end field Xjsz.

[0018] Preferably, the data preprocessing unit includes a data cleaning module and a data sorting module, the data cleaning module is used to clean the total bandwidth value Zdkz, the real-time bandwidth value SnSdkz, the protocol version field Xbzd, the protocol length field Xcdz, the protocol start field Xqsz and the protocol end field Xjsz, and the data sorting module is used to reorganize it into a first data group and a second data group, wherein the first data group includes the total bandwidth value Zdkz and the real-time bandwidth value SnSdkz, and the second data group includes the protocol version field Xbzd, the protocol length field Xcdz, the protocol start field Xqsz and the protocol end field Xjsz.

[0019] Preferably, the data parsing unit integrates and calculates the first data group and the second data group by the following formula to obtain the bandwidth reference value Dckz and the protocol reference value Xckz:

[0020]

[0021] Xckz=(a1×Xbzd)+(a2×Xcdz)×(a3×Xqsz)+(a4×Xjsz);

[0022] Where: SnSdkz is the real-time bandwidth value, Zdkz is the total bandwidth value, Xbzd is the protocol version field, Xcdz is the protocol length field, Xqsz is the protocol start field, Xjsz is the protocol end field, a1, a2, a3 and a4 are all weight values, and a1≠a2≠a3≠a4≠0, and the values ​​of a1, a2, a3 and a4 are adjusted and set by the user;

[0023] The data parsing unit also integrates and calculates the bandwidth reference value Dckz and the protocol reference value Xckz through the following formula to obtain the adjustment reference value Tckz;

[0024] Tckz=log(b1×Dckz+1)×(b2×Xckz 2 +1);

[0025] Wherein: Dckz is the bandwidth reference value Dckz, Xckz is the protocol reference value Xckz, log is the logarithmic function, b1 and b2 are both weight values, and b1≠b2≠0, and the values ​​of b1 and b2 are adjusted and set by the user.

[0026] Preferably, the data analysis unit includes a first comparison module and a second comparison module, wherein the first comparison module is used to generate a first comparison result, and the second comparison module is used to generate a second comparison result;

[0027] The first comparison result is as follows: when Tckz ≤ Y, it means that the current system does not need to be adjusted and the protocol full-automatic matching continues to be maintained; when Tckz > Y, it means that the current system needs to be adjusted;

[0028] where Tckz is the adjustment reference value and Y is the first threshold;

[0029] The second comparison result is as follows: when Tcz ≤ R, it means that the current system is at the first adjustment level;

[0030] when R < Tcz ≤ R × 105%, it means that the current system is at the second adjustment level;

[0031] when Tcz > R × 105%, it means that the current system is at the third adjustment level;

[0032] where Tcz is the correction difference and R is the second threshold;

[0033] The correction difference Tcz is calculated and obtained through the following formula;

[0034]

[0035] In the formula: Tckz is the adjustment reference value and Y is the first threshold.

[0036] Preferably, the decision-making unit includes a storage unit, a matching module, and an execution module. The storage unit is used to store preset correction schemes. The matching module is used to adapt the preset correction schemes to the second comparison result. The execution module is used to execute the correction schemes;

[0037] The correction schemes stored in the storage unit:

[0038] When the second comparison result is at the first adjustment level, the full-protocol matching is modified to the matching recognition for the version field Xbzd, the protocol start field Xqsz, and the protocol end field Xjsz, and 2% - 5% of the existing bandwidth is released for the protocol recognizer;

[0039] When the second comparison result is at the second adjustment level, the full-protocol matching is modified to the matching recognition for the protocol start field Xqsz and the protocol end field Xjsz, and 5% - 8% of the existing bandwidth is released for the protocol recognizer;

[0040] When the second comparison result is at the third adjustment level, the full-protocol matching is modified to the matching recognition for the protocol start field Xqsz and the protocol end field Xjsz, and 8% - 10% of the existing bandwidth is released for the protocol recognizer, and 8% - 10% of the local servers are deactivated to reduce the bandwidth pressure.

[0041] Preferably, the alarm unit includes a classification module and an information sending module, the classification module is used to classify the logs generated by the decision unit according to specific magnitudes, and the information sending module sends alarm information to the maintenance personnel according to the classification results;

[0042] The classification module is classified as follows: when the log is displayed as the first adjustment level, the log level is set to green, and the log code begins with G, and is recorded as G1, G2, G3, ..., Gn;

[0043] When the log is displayed at the second adjustment level, the log level is set to yellow, and the log code begins with H, and is recorded as H1, H2, H3, ..., Hn;

[0044] When the log is displayed as the third adjustment level, the log level is set to red, and the log code begins with M, and is recorded as M1, M2, M3, ..., Mn;

[0045] The information sending module sends alarm information in the following manner: when the log shows the first adjustment level, an alarm message is sent to the management personnel, with the alarm message beginning with a green G;

[0046] When the log shows the second adjustment level, three alarm messages are sent to the management personnel in succession. The interval between alarm messages is one minute, and the alarm message starts with yellow H.

[0047] When the log shows the third adjustment level, five alarm messages are sent to the administrator in succession. The interval between the alarm messages is 30 seconds and the alarm message begins with a red S.

[0048] The present invention also provides a collaborative intrusion detection method based on an industrial control network, the specific steps of which are as follows:

[0049] S1. Data acquisition: the data acquisition unit is responsible for collecting data on the bandwidth and security protocol of the industrial control network, thereby generating bandwidth data groups and protocol data groups;

[0050] S2, data preprocessing, the data preprocessing unit receives the bandwidth data group and the protocol data group to perform data cleaning and sorting, and generates a first data group and a second data group to ensure data accuracy and consistency;

[0051] S3, data analysis and calculation, the data analysis unit integrates and calculates the first data group and the second data group to generate a bandwidth reference value Dckz and a protocol reference value Xckz, and generates an adjustment reference value Tckz by integrated calculation;

[0052] S4, data analysis, the data analysis unit compares the adjustment reference value Tckz with the preset first threshold value Y, generates a first comparison result, and determines whether the protocol recognition mode needs to be adjusted according to the result;

[0053] S5, level division, if adjustment is required, calculate the correction difference Tcz, and compare it with the preset second threshold R, generate a second comparison result, and divide the correction level according to the result;

[0054] S6. Alarm and decision. The decision unit adapts and executes the second comparison result with the preset correction plan, generates a work log, and sends it to the alarm unit. The alarm unit reclassifies the work log according to the magnitude of the executed correction plan and sends corresponding alarm information.

[0055] (III) Beneficial effects

[0056] The present invention provides a collaborative intrusion detection method and system based on an industrial control network, which has the following beneficial effects:

[0057] (1) The collaborative intrusion detection method and system based on industrial control network realizes all-round monitoring, analysis and dynamic adjustment of the network through the organic collaboration of multiple units, so that the system architecture provides a real-time, intelligent and adaptive network security solution. Compared with the traditional intrusion detection system, the system pays more attention to the real-time optimization of network performance. When the bandwidth occupancy rate is high, it reduces unnecessary interference to other servers, thereby solving the problem of lengthy and cumbersome protocol identification, and thus enables the system to better adapt to the complex and changeable industrial control environment, improve the overall level of network security and performance, and further enhance the stability and security of the industrial network.

[0058] (2) The collaborative intrusion detection method and system based on the industrial control network stores preset correction schemes through a storage unit, and can automatically adapt different adjustment levels according to the second comparison result through a matching module, thereby improving the system's flexible responsiveness to changes in network status. In the preset correction scheme, the protocol matching strategy is adjusted according to different adjustment levels to free up the corresponding existing bandwidth occupancy, thereby optimizing the utilization of bandwidth resources and improving network performance. In addition, by deactivating the local server and adjusting the two-way adjustment of the protocol byte feature capture method, the pressure on bandwidth transmission is effectively reduced. In the case of high bandwidth occupancy, unnecessary interference to other servers is reduced, thereby solving the problem of lengthy and cumbersome protocol identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a system flow chart of the present invention.

[0060] Figure 2It is a diagram of the method steps of the present invention.

[0061] In the figure: 1. data acquisition unit; 2. data preprocessing unit; 3. data parsing unit; 4. data analysis unit; 5. decision unit; 6. alarm unit; 101. first acquisition module; 102. second acquisition module; 201. data cleaning module; 202. data sorting module; 401. first comparison module; 402. second comparison module; 501. storage unit; 502. matching module; 503. execution module; 601. classification module; 602. information sending module. DETAILED DESCRIPTION

[0062] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0063] Example 1

[0064] See also Figure 1 , a collaborative intrusion detection system based on an industrial control network, comprising a data acquisition unit 1, a data preprocessing unit 2, a data parsing unit 3, a data analysis unit 4, a decision unit 5 and an alarm unit 6:

[0065] The data collection unit 1 is used to collect data on the network bandwidth and the security protocol respectively, thereby obtaining a bandwidth data group and a protocol data group, and inputting the obtained bandwidth data group and protocol data group into the data preprocessing unit 2;

[0066] The data preprocessing unit 2 performs data cleaning and data sorting on the bandwidth data group and the protocol data group, thereby generating a first data group and a second data group, and inputs the processed first data group and the second data group into the data parsing unit 3;

[0067] The data parsing unit 3 is used to integrate and calculate the first data group and the second data group to generate a bandwidth reference value Dckz and a protocol reference value Xckz, and integrate and calculate the bandwidth reference value Dckz and the protocol reference value Xckz to generate an adjustment reference value Tckz, and input the calculated adjustment reference value Tckz into the data analysis unit 4;

[0068] The data analysis unit 4 is used to compare the calculated adjustment reference value Tckz with the preset first threshold value Y to generate a first pair of results, and judge whether the protocol recognition mode needs to be adjusted according to the first comparison result. When the comparison result shows that no adjustment is required, the full field matching of the protocol is maintained. If the comparison result shows that adjustment is required, the adjustment reference value Tckz and the first threshold value Y are integrated and calculated to generate a correction difference value Tcz, and the correction difference value Tcz is compared with the preset second threshold value R to generate a second comparison result, thereby dividing the correction level, and the second comparison result is input into the decision unit 5;

[0069] The decision unit 5 adapts and executes the second comparison result with the preset correction scheme, and generates a work log and sends it to the alarm unit 6;

[0070] The alarm unit 6 reclassifies the work log according to the magnitude of the correction scheme specifically executed therein, and sends an alarm message.

[0071] In this embodiment: the data acquisition unit 1 is responsible for acquiring key network bandwidth and security protocol data from the industrial control network, including real-time acquisition of bandwidth and protocol. Through this data acquisition unit 1, the system can construct bandwidth data groups and protocol data groups, wherein the bandwidth data group reflects the network load situation, and the protocol data group contains information about the network protocol, thereby providing a real-time and accurate data source for subsequent system data analysis.

[0072] The data preprocessing unit 2 cleans and organizes the bandwidth and protocol data groups to generate a first data group and a second data group. The cleaning and organizing operations help to eliminate noise and standardize the data format, making subsequent data analysis more accurate. Through the data preprocessing unit 2, the system can ensure the quality and consistency of the data and improve the efficiency and accuracy of subsequent processing.

[0073] The data analysis unit 3 integrates and calculates the first data group and the second data group to generate a bandwidth reference value Dckz and a protocol reference value Xckz, and then integrates and calculates the two to obtain an adjustment reference value Tckz. By integrating the information of the first data group and the second data group, a comprehensive evaluation of the network status is formed, and the generated adjustment reference value Tckz value can provide data support for subsequent system adjustment decisions, thereby realizing intelligent management of network performance.

[0074] The data analysis unit 4 determines whether the protocol identification mode needs to be adjusted by comparing the calculated adjustment reference value Tckz with the preset first threshold value Y. The data analysis unit 4 also generates a correction difference value Tcz and compares it with the second threshold value R to divide the correction level, thereby realizing real-time monitoring and dynamic analysis of the network status, and providing data support for the subsequent system to adjust its operation according to the current bandwidth occupancy status.

[0075] The decision unit 5 adapts and executes the second comparison result with the preset correction plan, generates a work log and sends it to the alarm unit. The decision unit 5 realizes real-time response to the system status and dynamically adjusts the network configuration through the preset correction plan, so that the system can adjust its operation according to the current bandwidth occupancy status, avoiding the problem that the protocol identification time is still lengthy and cumbersome when the bandwidth occupancy rate is too high.

[0076] The alarm unit 6 receives the work log, reclassifies the log according to the magnitude of the correction plan, and generates an alarm message. Through the alarm unit 6, the system can promptly notify relevant personnel when making adjustments.

[0077] Through the organic collaboration of multiple units, the system realizes all-round monitoring, analysis and dynamic adjustment of the network, so that the system architecture provides a real-time, intelligent and adaptive network security solution. Compared with traditional intrusion detection systems, the system pays more attention to the real-time optimization of network performance. When the bandwidth occupancy rate is high, it reduces unnecessary interference to other servers, thereby solving the problem of lengthy and cumbersome protocol identification, and thus enables the system to better adapt to the complex and changeable industrial control environment, improve the overall level of network security and performance, and further enhance the stability and security of the industrial network.

[0078] Example 2

[0079] Please refer to Figure 1 The data acquisition unit 1 includes a first acquisition module 101 and a second acquisition module 102, wherein the first acquisition module 101 is used to acquire bandwidth data to generate a bandwidth data group, and the second acquisition module 102 is used to acquire protocol data to obtain a protocol data group.

[0080] The first acquisition module 101 obtains the total bandwidth value Zdkz through the network manager, and uses the network traffic detection tool to detect the used bandwidth, and records them separately according to the timestamps through the system clock. The timestamps are recorded as S1, S2, S3, ..., Sn, and the real-time bandwidth values ​​are recorded as S1Sdkz, S2Sdkz, S3Sdkz, ..., SnSdkz.

[0081] The second acquisition module 102 includes a protocol identification module and a protocol parsing module, wherein the protocol identification module is used to obtain the protocol version field Xbzd and the protocol length field Xcdz in the data packet, and the protocol parsing module is used to obtain the protocol start field Xqsz and the protocol end field Xjsz.

[0082] In this embodiment: in order to collect data more effectively, the data collection unit 1 is subdivided into a first collection module 101 and a second collection module 102. The first collection module 101 is used to collect bandwidth data and generate a bandwidth data group, and the second collection module 102 is used to collect protocol data and obtain a protocol data group. By setting the first collection module 101 and the second collection module 102, the system is more flexible and scalable, and can better cope with different types of data collection requirements.

[0083] The first acquisition module 101 obtains the total bandwidth value Zdkz through the network manager, and detects the actual bandwidth in use in combination with the network traffic detection tool. By recording the system clock and timestamp, it can accurately obtain the real-time bandwidth values ​​S1Sdkz, S2Sdkz, S3Sdkz...SnSdkz, providing more accurate input for subsequent data processing.

[0084] The second acquisition module 102 includes a protocol identification module and a protocol parsing module. The protocol identification module is responsible for obtaining the protocol version field Xbzd and the protocol length field Xcdz in the data packet, while the protocol parsing module is used to obtain the protocol start field Xqsz and the protocol end field Xjsz, so that the system can more accurately analyze and identify the details of network communications, thereby improving the accuracy and comprehensiveness of the parsing of protocol data.

[0085] By subdividing the data acquisition unit 1 into the first acquisition module 101 and the second acquisition module 102, the adaptability and customizability of the system are improved. The real-time bandwidth acquisition of the first acquisition module 101 improves the accuracy of the real-time bandwidth value by means of the network manager and the flow detection tool, as well as the recording of the timestamp. The second acquisition module 102 obtains the various elements of the protocol data more comprehensively through the protocol identification module and the protocol analysis module. This improves the system's in-depth understanding of the network communication protocol and strengthens the system's ability to analyze the protocol level. The system can obtain key bandwidth and protocol data more comprehensively and accurately, thereby improving the system's performance and efficiency, making it better adapted to the special environment and needs of the industrial control network.

[0086] Example 3

[0087] Please refer to Figure 1The data preprocessing unit 2 includes a data cleaning module 201 and a data sorting module 202. The data cleaning module 201 is used to clean the total bandwidth value Zdkz, the real-time bandwidth value SnSdkz, the protocol version field Xbzd, the protocol length field Xcdz, the protocol start field Xqsz and the protocol end field Xjsz. The data sorting module 202 is used to reorganize it into a first data group and a second data group, wherein the first data group includes the total bandwidth value Zdkz and the real-time bandwidth value SnSdkz, and the second data group includes the protocol version field Xbzd, the protocol length field Xcdz, the protocol start field Xqsz and the protocol end field Xjsz.

[0088] In this embodiment: the data cleaning module 201 cleans each data, removes outliers and noise, ensures that the data quality is more reliable, thereby improving the accuracy of subsequent analysis and decision-making of the system and reducing the risk of misjudgment and false alarm caused by bad data.

[0089] The data sorting module 202 is responsible for reorganizing the cleaned data into a first data group and a second data group, so as to make the data structure more standardized and facilitate the subsequent data parsing and analysis processing of the system.

[0090] By cleaning and arranging the data through the data preprocessing unit 2, the system can better cope with possible abnormal situations and improve the stability of the system. The introduction of the data cleaning module 201 and the data arranging module 202 helps to reduce the burden of data processing by subsequent modules. The standardized data structure makes the data easier to process, improves the operating efficiency of the entire system, and enables the collaborative intrusion detection system to operate more reliably and efficiently in the industrial control network.

[0091] Example 4

[0092] Please refer to Figure 1 The data parsing unit 3 integrates and calculates the first data group and the second data group by the following formula to obtain the bandwidth reference value Dckz and the protocol reference value Xckz:

[0093]

[0094] Xckz=(a1×Xbzd)+(a2×Xcdz)×(a3×Xqsz)+(a4×Xjsz)

[0095] Where: SnSdkz is the real-time bandwidth value, Zdkz is the total bandwidth value, Xbzd is the protocol version field, Xcdz is the protocol length field, Xqsz is the protocol start field, Xjsz is the protocol end field, a1, a2, a3 and a4 are all weight values, and a1≠a2≠a3≠a4≠0, and the values ​​of a1, a2, a3 and a4 are adjusted and set by the user;

[0096] The data parsing unit 3 also integrates and calculates the bandwidth reference value Dckz and the protocol reference value Xckz through the following formula to obtain the adjustment reference value Tckz;

[0097] Tckz = log(b1 × Dckz + 1) × (b2 × Xckz 2 + 1);

[0098] In the formula: Dckz is the bandwidth reference value Dckz, Xckz is the protocol reference value Xckz, log is the logarithmic function, and both b1 and b2 are weight values, and b1 ≠ b2 ≠ 0. The values of b1 and b2 are adjusted and set by the user.

[0099] In this embodiment: By introducing user-adjustable weight values in the calculation, the system becomes more customizable. Users can flexibly adjust the weight values according to the requirements of specific scenarios to better adapt to the characteristics of different networks and protocols, improve the adaptability of the system. Through the integrated calculation formula, the system can more accurately obtain the bandwidth reference value and the protocol reference value. This helps to improve the accuracy of network performance and protocol recognition, enhances the system's detection and response capabilities for intrusion and anomalies. Introducing the logarithmic function log in the integrated calculation makes the system's processing of reference values more flexible. This helps to balance the influence of each reference value and further improve the stability and robustness of the overall system.

[0100] Embodiment 5

[0101] Please refer to Figure 1 , the data analysis unit 4 includes a first comparison module 401 and a second comparison module 402, where the first comparison module 401 is used to generate a first comparison result, and the second comparison module 402 is used to generate a second comparison result;

[0102] The first comparison result is: when Tckz ≤ Y, it means that the current system does not need to be adjusted and continues to maintain full-automatic protocol matching. When Tckz > Y, it means that the current system needs to be adjusted;

[0103] Where Tckz is the adjustment reference value and Y is the first threshold;

[0104] The second comparison result is: when Tcz ≤ R, it means that the current system is at the first adjustment level;

[0105] When R < Tcz ≤ R × 105%, it means that the current system is at the second adjustment level;

[0106] When Tcz > R × 105%, it means that the current system is at the third adjustment level;

[0107] Where Tcz is the correction difference and R is the second threshold;

[0108] The correction difference Tcz is calculated by the following formula:

[0109]

[0110] Wherein: Tckz is the adjustment reference value, and Y is the first threshold.

[0111] In this embodiment: the first comparison module 401 determines whether the system needs to be adjusted by comparing the adjustment reference value Tckz with the first threshold value Y. This flexible mechanism enables the system to dynamically adjust the protocol matching method according to real-time conditions, thereby improving the system's adaptability to different network environments and traffic changes.

[0112] The second comparison module 402 introduces a multi-level adjustment level, which is divided into a first adjustment level, a second adjustment level and a third adjustment level according to the size of the correction difference Tcz. This helps to adjust the system more finely, making the system more intelligent and detailed, and improving the system's ability to handle abnormal situations.

[0113] The corrected difference Tcz can more intuitively reflect the change of the adjustment reference value relative to the first threshold value, which helps the system to more accurately determine whether adjustment is needed, thereby enhancing the intelligence of the system.

[0114] Example 6

[0115] Please refer to Figure 1 The decision unit 5 includes a storage unit 501, a matching module 502 and an execution module 503, wherein the storage unit 501 is used to store a preset correction scheme, the matching module 502 is used to adapt the preset correction scheme and the second comparison result, and the execution module 503 is used to execute the correction scheme;

[0116] The correction scheme stored in the storage unit 501:

[0117] When the second comparison result is the first adjustment level, the full protocol match is modified to match and identify the version field Xbzd, the protocol start field Xqsz, and the protocol end field Xjsz, and 2% to 5% of the existing bandwidth is released for the protocol identifier;

[0118] When the second comparison result is the second adjustment level, the full protocol match is modified to match and identify the protocol start field Xqsz and the protocol end field Xjsz, and 5% to 8% of the existing bandwidth is released for the protocol identifier;

[0119] When the second comparison result is the third adjustment level, the full protocol match is modified to the match identification of the protocol start field Xqsz and the protocol end field Xjsz, and 8% to 10% of the existing bandwidth is freed up for the protocol identifier, and 8% to 10% of the local servers are disabled to reduce bandwidth pressure.

[0120] The alarm unit 6 includes a classification module 601 and an information sending module 602. The classification module 601 is used to classify the logs generated by the decision unit 5 according to specific magnitudes, and the information sending module 602 sends alarm information to the maintenance personnel according to the classification results.

[0121] The classification module 601 is classified as follows: when the log is displayed as the first adjustment level, the log level is set to green, and the log code begins with G, and is recorded as G1, G2, G3, ..., Gn;

[0122] When the log is displayed at the second adjustment level, the log level is set to yellow, and the log code begins with H, and is recorded as H1, H2, H3, ..., Hn;

[0123] When the log is displayed as the third adjustment level, the log level is set to red, and the log code begins with M, and is recorded as M1, M2, M3, ..., Mn;

[0124] The alarm information sending method of the information sending module 602 is as follows: when the log shows the first adjustment level, an alarm message is sent to the management personnel, with the alarm message beginning with a green G;

[0125] When the log shows the second adjustment level, three alarm messages are sent to the management personnel in succession. The interval between alarm messages is one minute, and the alarm message starts with yellow H.

[0126] When the log shows the third adjustment level, five alarm messages are sent to the administrator in succession. The interval between the alarm messages is 30 seconds and the alarm message begins with a red S.

[0127] In this embodiment: the decision unit 5 includes a storage unit 501, a matching module 502, and an execution module 503. The storage unit 501 stores the preset correction scheme, and the matching module 502 can automatically adapt to different adjustment levels according to the second comparison result, thereby improving the system's flexible responsiveness to changes in network status. In the preset correction scheme, the protocol matching strategy is adjusted according to different adjustment levels to free up the corresponding existing bandwidth occupancy, thereby optimizing the utilization of bandwidth resources and improving network performance. In addition, by deactivating the local server and adjusting the two-way adjustment of the protocol byte feature capture method, the pressure on bandwidth transmission is effectively reduced. In the case of high bandwidth occupancy, unnecessary interference to other servers is reduced, thereby solving the problem of lengthy and cumbersome protocol identification.

[0128] The alarm unit classifies the logs generated by the decision unit according to specific levels through the classification module 601, so that the management personnel can understand the alarm content more clearly and help to take corresponding measures quickly. The information sending module 602 sends different levels of alarm information to the management personnel according to the classification results, ensuring the timeliness of the alarm information. In particular, in the case of the second and third adjustment levels, multiple alarm messages are sent continuously to ensure that the management personnel can fully understand the network status in a short time and take corresponding emergency measures.

[0129] Alarm information is divided into different levels by color and sent continuously at different frequencies, making it easier for managers to identify urgency and take corresponding measures. This humanized alarm strategy effectively reduces the false alarm rate and improves the efficiency of managers in handling alarm information.

[0130] By refining the decision unit 5 and the alarm unit 6, not only the real-time monitoring and response capabilities of the system are improved, but also the detection and response capabilities to network intrusions are enhanced, thereby comprehensively improving the performance and availability of the collaborative intrusion detection system.

[0131] The present invention also provides a collaborative intrusion detection method based on an industrial control network, the specific steps of which are as follows:

[0132] S1, data acquisition, the data acquisition unit 1 is responsible for collecting data on the bandwidth and security protocol of the industrial control network, thereby generating a bandwidth data group and a protocol data group;

[0133] S2, data preprocessing, the data preprocessing unit 2 receives the bandwidth data group and the protocol data group to perform data cleaning and sorting, and generates a first data group and a second data group to ensure the accuracy and consistency of the data;

[0134] S3, data analysis and calculation, the data analysis unit 3 integrates and calculates the first data group and the second data group to generate a bandwidth reference value Dckz and a protocol reference value Xckz, and generates an adjustment reference value Tckz by integrated calculation;

[0135] S4, data analysis, the data analysis unit 4 compares the adjustment reference value Tckz with the preset first threshold value Y, generates a first comparison result, and determines whether the protocol recognition mode needs to be adjusted according to the result;

[0136] S5, level division, if adjustment is required, calculate the correction difference Tcz, and compare it with the preset second threshold R, generate a second comparison result, and divide the correction level according to the result;

[0137] S6, alarm and decision, the decision unit 5 adapts and executes the second comparison result with the preset correction plan, generates a work log, and sends it to the alarm unit 6. The alarm unit reclassifies the work log according to the magnitude of the executed correction plan and sends corresponding alarm information.

[0138] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A collaborative intrusion detection system based on an industrial control network, comprising a data acquisition unit (1), a data preprocessing unit (2), a data parsing unit (3), a data analysis unit (4), a decision unit (5) and an alarm unit (6), characterized in that: The data collection unit (1) is used to collect data on network bandwidth and security protocol respectively, thereby obtaining bandwidth data groups and protocol data groups, and inputting the obtained bandwidth data groups and protocol data groups into the data preprocessing unit (2); The data preprocessing unit (2) performs data cleaning and data sorting on the bandwidth data group and the protocol data group, thereby generating a first data group and a second data group, and inputs the processed first data group and the second data group into the data parsing unit (3); The data parsing unit (3) is used to integrate and calculate the first data group and the second data group, thereby generating a bandwidth reference value Dckz and a protocol reference value Xckz, and to integrate and calculate the bandwidth reference value Dckz and the protocol reference value Xckz, thereby generating an adjustment reference value Tckz, and to input the calculated adjustment reference value Tckz into the data analysis unit (4); The data analysis unit (4) is used to compare the calculated adjustment reference value Tckz with a preset first threshold value Y to generate a first pair of results, and judge whether the protocol recognition mode needs to be adjusted according to the first comparison result. When the comparison result shows that no adjustment is required, the full field matching of the protocol is maintained. If the comparison result shows that adjustment is required, the adjustment reference value Tckz and the first threshold value Y are integrated and calculated to generate a correction difference value Tcz, and the correction difference value Tcz is compared with a preset second threshold value R to generate a second comparison result, thereby dividing the correction level, and the second comparison result is input into the decision unit (5); The decision unit (5) matches and executes the second comparison result with a preset correction scheme, and generates a work log and sends it to the alarm unit (6); The alarm unit (6) reclassifies the work log according to the magnitude of the correction plan specifically implemented therein, and sends an alarm message.

2. The collaborative intrusion detection system based on industrial control network according to claim 1 is characterized in that: The data acquisition unit (1) comprises a first acquisition module (101) and a second acquisition module (102), wherein the first acquisition module (101) is used to acquire bandwidth data to generate a bandwidth data group, and the second acquisition module (102) is used to acquire protocol data to obtain a protocol data group.

3. The collaborative intrusion detection system based on industrial control network according to claim 2 is characterized in that: The first acquisition module (101) obtains the total bandwidth value Zdkz through the network manager, and detects the used bandwidth through the network traffic detection tool, and records them respectively according to the timestamps through the system clock, and the timestamps are recorded as S1, S2, S3, ..., Sn respectively, and the real-time bandwidth values ​​are recorded as S1Sdkz, S2Sdkz, S3Sdkz, ..., SnSdkz respectively.

4. The collaborative intrusion detection system based on industrial control network according to claim 3 is characterized in that: The second acquisition module (102) includes a protocol identification module and a protocol parsing module. The protocol identification module is used to obtain the protocol version field Xbzd and the protocol length field Xcdz in the data packet, and the protocol parsing module is used to obtain the protocol start field Xqsz and the protocol end field Xjsz.

5. The collaborative intrusion detection system based on industrial control network according to claim 4 is characterized in that: The data preprocessing unit (2) includes a data cleaning module (201) and a data sorting module (202). The data cleaning module (201) is used to clean the total bandwidth value Zdkz, the real-time bandwidth value SnSdkz, the protocol version field Xbzd, the protocol length field Xcdz, the protocol start field Xqsz, and the protocol end field Xjsz. The data sorting module (202) is used to reorganize them into a first data group and a second data group. The first data group includes the total bandwidth value Zdkz and the real-time bandwidth value SnSdkz, and the second data group includes the protocol version field Xbzd, the protocol length field Xcdz, the protocol start field Xqsz, and the protocol end field Xjsz.

6. The collaborative intrusion detection system based on industrial control network according to claim 5 is characterized in that: The data parsing unit (3) performs integrated calculations on the first data group and the second data group through the following formula to obtain a bandwidth reference value Dckz and a protocol reference value Xckz: Xckz = (a1 × Xbzd) + (a2 × Xcdz) × (a3 × Xqsz) + (a4 × Xjsz); In the formula: SnSdkz is the real-time bandwidth value, Zdkz is the total bandwidth value, Xbzd is the protocol version field, Xcdz is the protocol length field, Xqsz is the protocol start field, Xjsz is the protocol end field, a1, a2, a3, and a4 are all weight values, and a1 ≠ a2 ≠ a3 ≠ a4 ≠ 0. The values of a1, a2, a3, and a4 are adjusted and set by the user; The data parsing unit (3) also performs integrated calculations on the bandwidth reference value Dckz and the protocol reference value Xckz through the following formula to obtain an adjustment reference value Tckz; Tckz=log(b1×Dckz+1)×(b2×Xckz 2 +1); In the formula: Dckz is the bandwidth reference value Dckz, Xckz is the protocol reference value Xckz, log is the logarithmic function, b1 and b2 are both weight values, and b1 ≠ b2 ≠ 0. The values of b1 and b2 are adjusted and set by the user.

7. The collaborative intrusion detection system based on industrial control network according to claim 6 is characterized in that: The data analysis unit (4) includes a first comparison module (401) and a second comparison module (402). The first comparison module (401) is used to generate a first comparison result, and the second comparison module (402) is used to generate a second comparison result; The first comparison result is: when Tckz ≤ Y, it means that the current system does not need to be adjusted and the protocol full-automatic matching is continued. When Tckz > Y, it means that the current system needs to be adjusted; Where Tckz is the adjustment reference value and Y is the first threshold; The second comparison result is: when Tcz ≤ R, it means that the current system is at the first adjustment level; When R < Tcz ≤ R × 105%, it means that the current system is at the second adjustment level; When Tcz > R × 105%, it means that the current system is at the third adjustment level; Where Tcz is the correction difference and R is the second threshold; The correction difference Tcz is calculated by the following formula: Wherein: Tckz is the adjustment reference value, and Y is the first threshold.

8. The collaborative intrusion detection system based on industrial control network according to claim 7 is characterized in that: The decision unit (5) comprises a storage unit (501), a matching module (502) and an execution module (503), wherein the storage unit (501) is used to store a preset correction scheme, the matching module (502) is used to adapt the preset correction scheme and the second comparison result, and the execution module (503) is used to execute the correction scheme; The correction scheme stored in the storage unit (501): When the second comparison result is the first adjustment level, the full protocol match is modified to match and identify the version field Xbzd, the protocol start field Xqsz, and the protocol end field Xjsz, and 2% to 5% of the existing bandwidth is released for the protocol identifier; When the second comparison result is the second adjustment level, the full protocol match is modified to match and identify the protocol start field Xqsz and the protocol end field Xjsz, and 5% to 8% of the existing bandwidth is released for the protocol identifier; When the second comparison result is the third adjustment level, the full protocol match is modified to the match identification of the protocol start field Xqsz and the protocol end field Xjsz, and 8% to 10% of the existing bandwidth is freed up for the protocol identifier, and 8% to 10% of the local servers are disabled to reduce bandwidth pressure.

9. The collaborative intrusion detection system based on industrial control network according to claim 8, characterized in that: The alarm unit (6) comprises a classification module (601) and an information sending module (602), wherein the classification module (601) is used to classify the logs generated by the decision unit (5) according to specific magnitudes, and the information sending module (602) sends alarm information to maintenance personnel according to the classification results; The classification module (601) is classified as follows: when the log is displayed as the first adjustment level, the log level is set to green, and the log code begins with G, and is recorded as G1, G2, G3, ..., Gn; When the log is displayed at the second adjustment level, the log level is set to yellow, and the log code begins with H, and is recorded as H1, H2, H3, ..., Hn; When the log is displayed as the third adjustment level, the log level is set to red, and the log code begins with M, and is recorded as M1, M2, M3, ..., Mn; The alarm information sending method of the information sending module (602) is as follows: when the log shows the first adjustment level, an alarm message is sent to the management personnel, with the alarm message beginning with a green G; When the log shows the second adjustment level, three alarm messages are sent to the management personnel in succession. The interval between alarm messages is one minute, and the alarm message starts with yellow H. When the log shows the third adjustment level, five alarm messages are sent to the administrator in succession. The interval between the alarm messages is 30 seconds and the alarm message begins with a red S.

10. A collaborative intrusion detection method based on an industrial control network, comprising the collaborative intrusion detection system based on an industrial control network as claimed in any one of claims 1 to 9, characterized in that: The specific steps are as follows: S1, data collection, the data collection unit (1) is responsible for collecting data on the bandwidth and security protocol of the industrial control network, thereby generating a bandwidth data group and a protocol data group; S2, data preprocessing, the data preprocessing unit (2) receives the bandwidth data group and the protocol data group, performs data cleaning and sorting, and generates a first data group and a second data group to ensure data accuracy and consistency; S3, data analysis and calculation, the data analysis unit (3) integrates and calculates the first data group and the second data group to generate a bandwidth reference value Dckz and a protocol reference value Xckz, and generates an adjustment reference value Tckz by integrated calculation; S4, data analysis, the data analysis unit (4) compares the adjustment reference value Tckz with a preset first threshold value Y, generates a first comparison result, and determines whether the protocol recognition mode needs to be adjusted according to the result; S5, level division, if adjustment is required, calculate the correction difference Tcz, and compare it with the preset second threshold R, generate a second comparison result, and divide the correction level according to the result; S6, alarm and decision, the decision unit (5) adapts and executes the second comparison result with the preset correction plan, generates a work log, and sends it to the alarm unit (6). The alarm unit reclassifies the work log according to the magnitude of the executed correction plan and sends corresponding alarm information.

Images