Method, device, medium and device for determining abnormality of device

Abstract

The present application relates to the technical field of network security testing, and in particular to a method, device, medium and device for determining an abnormality of a device. The method includes: obtaining a data feature set X corresponding to a target device; processing X with a data size identifier as an observed state and a device identifier as a hidden state to obtain a target communication feature list MX of the target device within a target time window; obtaining a communication feature match PX between MX and a standard communication feature list BX; obtaining a key match PS based on the communication feature match PX and the sequence match PNH; if PS is greater than a preset key match threshold, the target device is determined to be an abnormal device. Compared with judging whether a target device is an abnormal device based only on PX, the present application is more accurate in determining abnormal devices.

Description

Background Art

[0002] When determining whether a communicative device has been hacked, it is usually necessary to analyze the content of the traffic packets sent by the communicative device, and then determine whether it has been hacked based on the analysis results. However, in industrial control networks, most of the communication protocols and methods used are non-standard, especially since many internal communications of the system are encrypted. Therefore, it is very difficult to directly analyze the content of the traffic packet to determine whether the corresponding target device has been hacked. Summary of the invention

[0003] The technical problem to be solved by this application is: how to achieve security detection of communicative devices in an industrial control network without analyzing the content of traffic packets.

[0004] In view of the above technical problem, according to a first aspect of the present application, a method for determining an abnormality of a device is provided, the method comprising:

[0005] S100, obtain the data feature group set X corresponding to the target device = (X1, X2, ..., Xi, ..., Xn); i = 1, 2, ..., n; wherein n is the number of target time periods arranged continuously in the target time window; Xi is the data feature group corresponding to the target device in the i-th target time period; Xi = (Ui, Hi); Ui is the data size identification sequence corresponding to the i-th target time period; Ui = (Ui1, Ui2, ..., Uia, ..., Uif(i)); a = 1, 2, ..., f(i); Uia is the data size identification sequence corresponding to the target device in the i-th target time period The data size identifier of the ath traffic packet sent within the i-th target time period; Uia∈D; D is the data size identifier list corresponding to the industrial control network where the target device is located; f(i) is the number of traffic packets sent by the target device within the i-th target time period within the target time window; Hi is the device identifier sequence corresponding to the i-th target time period; Hi=(Hi1, Hi2, ..., Hia, ..., Hif(i)); Hia is the device identifier of the receiving device corresponding to the a-th traffic packet; Hia∈T; T is the device identifier list corresponding to the industrial control network where the target device is located;

[0006] S200, processing X with the data size identifier as the observed state and the device identifier as the hidden state, and obtaining the target communication feature list MX=(MA, MT, Mπ) of the target device in the target time window; wherein MA is the state transition probability matrix corresponding to the target device in the target time window; MT is the observation probability matrix corresponding to the target device in the target time window; and Mπ is the initial state probability vector corresponding to the target device in the target time window;

[0007] S300, obtaining a communication feature matching degree PX between MX and a standard communication feature list BX;

[0008] S400, according to the communication feature matching degree PX and the sequence matching degree PNH, a key matching degree PS is obtained; wherein PNH is the matching degree between the device identification sequence NH corresponding to the target device and the predicted device identification sequence YNH corresponding to NH obtained based on the preset HMM model; PS meets the following conditions: PS = b1*PX+b2*PNH; b1 is a preset first weight; b2 is a preset second weight;

[0009] S500: If the PS is greater than a preset critical matching degree threshold, the target device is determined to be an abnormal device.

[0010] According to a second aspect of the present application, a device for determining an abnormality of a device is provided, the device comprising:

[0011] The data feature acquisition module is used to obtain the data feature group set X corresponding to the target device, X = (X1, X2, ..., Xi, ..., Xn); i = 1, 2, ..., n; wherein n is the number of target time periods arranged continuously in the target time window; Xi is the data feature group corresponding to the target device in the i-th target time period; Xi = (Ui, Hi); Ui is the data size identification sequence corresponding to the i-th target time period; Ui = (Ui1, Ui2, ..., Uia, ..., Uif(i)); a = 1, 2, ..., f(i); Uia is the target The data size identifier of the ath traffic packet sent by the device in the i-th target time period; Uia∈D; D is the data size identifier list corresponding to the industrial control network where the target device is located; f(i) is the number of traffic packets sent by the target device in the i-th target time period within the target time window; Hi is the device identifier sequence corresponding to the i-th target time period; Hi=(Hi1, Hi2, ..., Hia, ..., Hif(i)); Hia is the device identifier of the receiving device corresponding to the a-th traffic packet; Hia∈T; T is the device identifier list corresponding to the industrial control network where the target device is located;

[0012] The target list acquisition module is used to process X with the data size identifier as the observation state and the device identifier as the hidden state to obtain the target communication feature list MX=(MA, MT, Mπ) of the target device in the target time window; wherein MA is the state transition probability matrix corresponding to the target device in the target time window; MT is the observation probability matrix corresponding to the target device in the target time window; and Mπ is the initial state probability vector corresponding to the target device in the target time window;

[0013] A feature matching degree acquisition module is used to obtain the communication feature matching degree PX between MX and the standard communication feature list BX;

[0014] The key matching degree acquisition module is used to obtain the key matching degree PS according to the communication feature matching degree PX and the sequence matching degree PNH; wherein PNH is the matching degree between the device identification sequence NH corresponding to the target device and the predicted device identification sequence YNH corresponding to NH obtained based on the preset HMM model; PS meets the following conditions: PS = b1*PX+b2*PNH; b1 is the preset first weight; b2 is the preset second weight;

[0015] The abnormal device determination module is used to determine that the target device is an abnormal device if the PS is greater than a preset critical matching degree threshold.

[0016] According to a third aspect of the present application, a non-transitory computer-readable storage medium is provided, in which at least one instruction or at least one program is stored, and the at least one instruction or at least one program is loaded and executed by a processor to implement the abnormality determination method of the above-mentioned device.

[0017] According to a fourth aspect of the present application, there is provided an electronic device comprising a processor and the above-mentioned non-transitory computer-readable storage medium.

[0018] This application has at least the following beneficial effects:

[0019] The abnormal determination method of the device provided by the present application first obtains the data feature set corresponding to the target device, so as to know the data size identifier of each traffic packet sent by the target device in each target time period of the target time window and the device identifier of the corresponding receiving device. Secondly, based on the principle of the HMM model, the above data feature set is processed with the data size identifier as the observation state and the device identifier as the hidden state to obtain the target communication feature list MX=(MA, MT, Mπ) of the target device in the target time window; wherein MA is the state transition probability matrix corresponding to the target device in the target time window; MT is the observation probability matrix corresponding to the target device in the target time window; Mπ is the initial state probability vector corresponding to the target device in the target time window. According to MX, the various parameters of the HMM model corresponding to the data feature set can be obtained. Finally, the communication feature matching degree PX between MX and the standard communication feature list BX is obtained. Here, in order to improve the accuracy of abnormal device judgment, the present application also obtains the matching degree PNH between the device identification sequence NH corresponding to the target device and the predicted device identification sequence YNH corresponding to NH obtained based on the preset HMM model, and determines whether the target device is an abnormal device based on the key matching degree obtained according to the above two matching degrees. Compared with judging whether the target device is an abnormal device only based on PX, the determination of abnormal devices is more accurate. In addition, this application only uses the characteristics of the receiving device and data size of the traffic packet sent by the target device, and does not analyze the content of the traffic packet sent by the target device. The processing process is simpler and the processing efficiency is higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A flowchart of a method for determining an abnormality of a device provided by an embodiment of the present application;

[0022] Figure 2 A structural block diagram of an abnormality determination device of a device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0024] like Figure 1 As shown, a method for determining an abnormality of a device is provided according to an embodiment of the present application, comprising:

[0025] S100, obtain the data feature group set X corresponding to the target device = (X1, X2, ..., Xi, ..., Xn); i = 1, 2, ..., n; wherein n is the number of target time periods arranged continuously in the target time window; Xi is the data feature group corresponding to the target device in the i-th target time period; Xi = (Ui, Hi); Ui is the data size identification sequence corresponding to the i-th target time period; Ui = (Ui1, Ui2, ..., Uia, ..., Uif(i)); a = 1, 2, ..., f(i); Uia is the data size identification sequence corresponding to the target device in the i-th target time period The data size identifier of the a-th traffic packet sent within the i-th target time period; Uia∈D; D is the data size identifier list corresponding to the industrial control network where the target device is located; f(i) is the number of traffic packets sent by the target device within the i-th target time period within the target time window; Hi is the device identifier sequence corresponding to the i-th target time period; Hi=(Hi1, Hi2, ..., Hia, ..., Hif(i)); Hia is the device identifier of the receiving device corresponding to the a-th traffic packet; Hia∈T; T is the device identifier list corresponding to the industrial control network where the target device is located.

[0026] Specifically, the target device may be any communicative device in the industrial control network. Here, the data feature set corresponding to the target device can be used to obtain the data size identifier of each traffic packet sent by the target device in each target time period of the target time window and the device identifier of the corresponding receiving device. The start time of the above-mentioned target time window can be the time when the industrial control network where the target device is located last started to process a fixed task. Among them, the data size identifier of each traffic packet belongs to the data size identifier list D corresponding to the industrial control network where the target device is located, and D is obtained by the following steps:

[0027] S110, obtaining a plurality of data size intervals according to the data size of each flow packet sent by the industrial control network where the target device is located within a preset time period; any two data size intervals do not overlap.

[0028] Step S110 includes:

[0029] S111, obtain the data size of each key data generated by the industrial control network where the target device is located within a preset time period, and obtain a data size set L = (L1, L2, ..., Lp, ..., Lq); wherein Lp is the data size of the pth key data generated by the industrial control network where the target device is located within the preset time period.

[0030] Here, there may be several communicative devices in the industrial control network where the target device is located, and the data size of each traffic packet in the industrial control network where the target device is located within a preset time period is obtained. It should be noted that the preset time period is a period of time before the start time of the target time window, and the length of the preset time period is much longer than the length of the target time window, so as to obtain the data size of as many traffic packets as possible.

[0031] S112, cluster L to obtain the first cluster identification set J = (J1, J2, ..., Jc, ..., Jd); c = 1, 2, ..., d; wherein J is obtained by sorting the average values ​​of all key data in each first cluster in ascending order; d is the number of first clusters; Jc is the c-th first cluster identification; Jc = [Jc, 1, Jc, 2]; Jc, 1 is the data size of the data packet with the smallest data size in the c-th first cluster; Jc, 2 is the data size of the data packet with the largest data size in the c-th first cluster.

[0032] Here, the data size of each traffic packet is different. Each traffic packet is clustered according to its data size, and traffic packets with similar data sizes are clustered into one category to obtain a first cluster cluster to obtain J, and the first cluster clusters in J are ordered, and each first cluster cluster is sorted from small to large according to the corresponding traffic packet data size average value, that is, the average data size of all traffic packets contained in the first cluster cluster corresponding to Jc is less than Jc+1 The average value of the data size of all traffic packets contained in the corresponding first cluster. And each first cluster uses the data interval consisting of the maximum value and the minimum value of the corresponding data size as the cluster identifier of the first cluster.

[0033] S113, traverse J to obtain several second cluster identifiers; among which, if J c,2 ≠J c+1,1 , then we get the second cluster identifier Jc' corresponding to Jc = (J c,2 , J c+1,1 ).

[0034] Here, when L is clustered, there will be some discrete values ​​that do not exist in any of the first clusters, that is, there may be some discrete values ​​between two adjacent first clusters in J, which results in the maximum value of the cluster with a smaller average data size and the minimum value of the cluster with a larger average data size in the two adjacent first clusters being different. At this time, in order to ensure the continuity of the data size interval, several second cluster cluster identifiers are obtained. Here, when the maximum value of the cluster with a smaller average data size and the minimum value of the cluster with a larger average data size in the two adjacent first clusters are different, the above maximum value and minimum value are used as the corresponding second cluster cluster identifier. The minimum value of the second cluster cluster identifier is the maximum value of the cluster with a smaller average data size in the two adjacent first clusters. Similarly, the maximum value of the second cluster cluster identifier is the minimum value of the cluster with a larger average data size in the two adjacent first clusters. Thus, several second cluster cluster identifiers are obtained.

[0035] S114: Determine each first cluster identifier and each second cluster identifier as a data size interval.

[0036] Here, since the intervals corresponding to the second cluster identifiers are all interspersed between two adjacent first clusters, each of the first cluster identifiers and the second cluster identifiers can obtain a number of data size intervals with coherent data sizes.

[0037] S120, according to a number of data size intervals, obtain a data size identifier list D = (D1, D2, ..., Dp, ..., Dq) corresponding to the industrial control network where the target device is located; p = 1, 2, ..., q; wherein Dp is the data size identifier corresponding to the pth traffic packet sent by the industrial control network where the target device is located within a preset time period; q is the number of traffic packets sent by the industrial control network where the target device is located within the preset time period; the data size identifiers corresponding to any two data size intervals are different.

[0038] In this embodiment, since the number of traffic packets obtained within the preset time period whose time length is much longer than the length of the target time window is large, and the data sizes of the traffic packets may vary greatly, the present application performs binning processing on the data sizes of the traffic packets obtained within the above preset time period, clusters the traffic packets with similar data sizes, and sets a number of second clustering cluster identifiers for a number of discrete values ​​according to the average data size of the traffic packets in each first clustering cluster, so that the final data size interval is coherent, and traffic packets of various data sizes can have corresponding data size intervals. Finally, a corresponding data size identifier is set for each data size interval, that is, the data size identifiers corresponding to any two traffic packets in the same data size interval. Compared with setting a data size identifier for each traffic packet, the number of data size identifiers that need to be set is less, which reduces the amount of data processing, saves data processing time, and thus improves data processing efficiency.

[0039] In addition, the device identification of the receiving device of each traffic packet belongs to the device identification list T corresponding to the industrial control network where the target device is located. Specifically, T is obtained by the following steps:

[0040] S130, obtain the device identification of each communicative device other than the target device in the industrial control network where the target device is located, to obtain a device identification list T = (T1, T2, ..., Te, ..., Tf, W); e = 1, 2, ..., f; wherein f is the number of communicative devices other than the target device in the industrial control network where the target device is located; Te is the device identification of the e-th communicative device other than the target device in the industrial control network where the target device is located; and W is a preset external network device identification.

[0041] Here, since each communicative device in the industrial control network may communicate with each other within the industrial control network, and may also communicate with devices outside the industrial control network, the device identification list T includes the device identification of each communicative device in the industrial control network where the target device is located except the target device, and also includes a preset external network device identification W indicating communication with the external network.

[0042] S200, process X with the data size identifier as the observed state and the device identifier as the hidden state, and obtain the target communication feature list MX=(MA, MT, Mπ) of the target device in the target time window; wherein MA is the state transition probability matrix corresponding to the target device in the target time window; MT is the observation probability matrix corresponding to the target device in the target time window; and Mπ is the initial state probability vector corresponding to the target device in the target time window.

[0043] Specifically, X is processed with the data size identifier as the observed state and the device identifier as the hidden state to obtain its corresponding target communication feature list MX = (MA, MT, Mπ). Here, MX represents the corresponding relationship between the data size identifier and the receiving device corresponding to each traffic packet sent by the target device within the target time window.

[0044] S300: Obtain a communication feature matching degree PX between MX and a standard communication feature list BX.

[0045] Specifically, PX = (MX·BX) / (|MX|×|BX|), and BX is determined by the following steps:

[0046] S310, obtaining a data feature set X corresponding to the last time the target device was determined to be a normal device.

[0047] S320, using X as a training sample, training the initial HMM model to obtain a target HMM model.

[0048] S330, according to the target HMM model, obtain a standard communication feature list BX = (BA, BT, Bπ); wherein BA is a standard state transition probability matrix; BT is a standard observation probability matrix; and Bπ is a standard initial state probability vector.

[0049] The present application first obtains the data feature set X corresponding to the last time the target device was determined to be a normal device, and then uses X as a training sample to obtain a target HMM model. The target HMM model is trained based on the observation sequence and hidden sequence when the target device is in a normal state. Therefore, the standard communication feature list BX obtained according to the target HMM model represents that when the target device is in a normal state, its data size identification list (observation sequence) and device identification list (hidden sequence) conform to the standard state transition probability matrix, standard observation probability matrix and standard initial state probability vector in BX.

[0050] S400, obtain the key matching degree PS according to the communication feature matching degree PX and the sequence matching degree PNH; wherein PNH is the matching degree between the device identification sequence NH corresponding to the target device and the predicted device identification sequence YNH corresponding to NH obtained based on the preset HMM model; PS meets the following conditions: PS = b1*PX+b2*PNH; b1 is the preset first weight; b2 is the preset second weight.

[0051] Specifically, the sequence matching degree PNH is determined by the following steps:

[0052] S410, obtain the data size identification sequence NU=(NU1, NU2, ..., NUg, ..., NUh) and the device identification sequence NH=(NH1, NH2, ..., NHg, ..., NHh) corresponding to the target device; g=1, 2, ..., h; wherein h is the number of target data whose data generation time is within the target time window in the target data corresponding to the target device; NUg is the data size identification of the g-th target data; NHg is the device identification of the key electronic device corresponding to NUg; the key electronic device corresponding to any device identification is in the same industrial control network as the above-mentioned target device.

[0053] Here, the target data may be a traffic packet sent by the target device. The data size identification sequence corresponding to the target data generated by the target device within the target time window and the device identification sequence obtained according to each receiving device of the target data are obtained to determine the traffic characteristics of the target data generated by the target device within the target time window.

[0054] S420, input NU into the preset HMM model to obtain the predicted device identification sequence YNH=(YH1, YH2, ..., YHg, ..., YHh) corresponding to NH; wherein YHg is the predicted device identification corresponding to NHg; the hidden state corresponding to the preset HMM model is the device identification, and the corresponding observed state is the data size identification.

[0055] Here, specifically, the preset HMM model is a preset hidden Markov model, which is trained by a number of historical data size identification sequences and a number of historical device identification sequences corresponding to when a target device with a target time window as the length is determined to be a normal device. NUg∈D;NHg∈T.

[0056] S430, obtaining the sequence matching degree PNH between NH and YNH.

[0057] Specifically, PNH satisfies the following condition: PNH = (NH·YNH) / (|NH|×|YNH|). The matching degree between the predicted device identification sequence and the device identification sequence corresponding to the target data generated by the target device within the target time window is obtained. The higher the matching degree, the more similar the device identification sequence corresponding to the target data generated by the target device within the target time window is to the predicted device identification sequence, that is, the greater the possibility that the target device is a normal device. Otherwise, it means that the target device may be an abnormal device.

[0058] S500: If the PS is greater than a preset critical matching degree threshold, the target device is determined to be an abnormal device.

[0059] Specifically, in order to improve the accuracy of abnormal device judgment, the present application also obtains the matching degree PNH between the device identification sequence NH corresponding to the target device and the predicted device identification sequence YNH corresponding to NH obtained based on the preset HMM model, and determines whether the target device is an abnormal device based on the key matching degree obtained according to the above two matching degrees. Compared with judging whether the target device is an abnormal device only based on PX, the determination of abnormal devices is more accurate. In addition, the present application only utilizes the characteristics of the receiving device of the traffic packet sent by the target device and the data size of the traffic packet, and does not analyze the content of the traffic packet sent by the target device. The processing process is simpler and the processing efficiency is higher.

[0060] In an exemplary embodiment of the present application, the target device may also determine whether it is an abnormal device by the following method: the above method further includes:

[0061] S500, obtain the data size identification sequence list U=(U1, U2, ..., Ui, ..., Un) and the device identification sequence list H=(H1, H2, ..., Hi, ..., Hn) of the target device in the target time window; i=1, 2, ..., n; wherein n is the number of target time periods arranged continuously in the target time window; Ui is the data size identification sequence corresponding to the i-th target time period; Ui=(Ui1, Ui2, ..., Uia, ..., Uif(i)); Uia is the data size identification of the a-th traffic packet sent by the target device in the i-th target time period in the target time window; Uia∈D; f(i) is the number of traffic packets sent by the target device in the i-th target time period in the target time window; Hi is the device identification sequence corresponding to the i-th target time period; Hi=(Hi1, Hi2, ..., Hia, ..., Hif(i)); Hia is the device identification of the receiving device corresponding to the a-th traffic packet; Hia∈T.

[0062] S600, input U into the pre-trained HMM model to obtain the predicted device identification sequence list YH=(YH1, YH2, ..., YHi, ..., YHn) corresponding to U; wherein YHi is the predicted device identification sequence corresponding to Hi; YHi=(YHi1, YHi2, ..., YHia, ..., YHif(i)); YHia is the predicted device identification corresponding to Hia; the above-mentioned pre-trained HMM model is trained based on the historical data size identification sequence list and the historical device identification sequence list corresponding to when the target device with a target time period as the length is determined to be a normal device.

[0063] Specifically, the pre-trained HMM model uses the length of the target time period when the target device obtains the data size identification sequence list as the time length of the training sample, and obtains several corresponding historical data size identification sequence lists and historical device identification sequence lists when the target device is determined to be a normal device; according to the pre-trained HMM model trained with the above training samples, when obtaining the predicted device identification sequence list corresponding to the data size identification sequence of each target time period, since the acquisition time length of the adopted training sample is consistent with the acquisition time length of the actually input data size identification sequence list, and is trained based on the historical data when the target device corresponding to the actually input data size identification sequence list is a normal device, the output predicted device identification sequence list is an output result with a higher probability that the target device corresponding to the actually input data size identification sequence list (U) is a normal device.

[0064] S700, according to H and YH, obtain a device identification sequence matching degree list PH = (PH1, PH2, ..., PHi, ..., PHn); wherein PHi is the device identification sequence matching degree of Hi and YHi.

[0065] Specifically, according to H and YH, the matching degree of several device identification sequences is obtained, and then PH is obtained. PHi meets the following conditions: PHi = (Hi·YHi) / (|Hi|×|YHi|). Here, the larger the PHi, the higher the matching degree between Hi and YHi, that is, the more similar Hi and YHi are. On the contrary, it means that Hi and YHi are less similar.

[0066] S800, obtaining the device identification sequence matching degree fluctuation value PHB of PH; PHB=(∑ni=1(PHi-avg(PH))2) / n; wherein: avg() is a preset average value determination function.

[0067] S900: If the PHB is greater than a preset device identification sequence matching degree fluctuation value threshold, the target device is determined to be an abnormal device.

[0068] Specifically, since PH includes the matching degree between several device identification sequences and the corresponding predicted device identification sequences, in order to comprehensively reflect the overall matching degree, the device identification sequence matching degree fluctuation value PHB of PH is obtained. Here, the larger the PHB, the uneven the size of several matching degrees, and there may be a small matching degree, that is, there may be a large difference between one or several device identification sequences and the corresponding predicted device identification sequence, and the target device may be an abnormal device. When it is greater than the preset device identification sequence matching degree fluctuation value threshold, the target device is determined to be an abnormal device.

[0069] In an exemplary embodiment of the present application, after the PHB is greater than a preset device identification sequence matching degree fluctuation value threshold, the method further includes:

[0070] S1000, according to PH, obtain the average device identification sequence matching degree PHJ=avg(PH) / n; wherein: avg() is a preset average value determination function.

[0071] S1100, obtain the comprehensive matching degree PHM according to PHJ and the communication feature matching degree PX; wherein PHM meets the following conditions: PHM=k1*PHJ+k2*PX; wherein k1 is the preset average device identification sequence weight; k2 is the preset communication feature weight; wherein PX is the matching degree between the target communication feature list MX and the standard communication feature list BX of the target device within the target time window.

[0072] Specifically, the larger the PHB is, the more uneven the sizes of the matching degrees are. There may be a smaller matching degree, or the matching degree may fluctuate greatly due to the presence of a larger matching degree. Therefore, in this embodiment, in order to improve the accuracy of abnormal device determination, a communication feature matching degree PX is set, and a comprehensive matching degree PHM is obtained based on PHJ and the communication feature matching degree PX. Here, PX is the communication feature matching degree in the above steps S100-S400. It will not be repeated here.

[0073] S1200: If the PHM is less than a preset comprehensive matching degree threshold, the target device is determined to be an abnormal device.

[0074] In this embodiment, if PHB is greater than the preset device identification sequence matching degree fluctuation value threshold, it means that the sizes of several matching degrees are relatively uneven, there may be a smaller matching degree, or there may be a larger matching degree that causes a larger matching degree fluctuation value. Therefore, it is not accurate enough to judge whether the target device is an abnormal device only based on PHB. Therefore, in this embodiment, when PHB is greater than the preset device identification sequence matching degree fluctuation value threshold, the communication feature matching degree PX is obtained. Here, PX is the matching degree between the target communication feature list MX and the standard communication feature list BX of the target device within the target time window. The comprehensive matching degree PHM is obtained based on PHB and PX, and further matching degree judgment is performed. If PHM is also less than the preset comprehensive matching degree threshold, the target device is determined to be an abnormal device. Compared with judging whether the target device is an abnormal device only based on PHB, the determination of abnormal devices is more accurate.

[0075] In an exemplary embodiment of the present application, BX may also be determined by the following steps:

[0076] The first step is to obtain B target sequence group sets X corresponding to the target device being determined as a normal device for the most recent B times.

[0077] In the second step, the B target sequence groups X are taken as B feature vectors to obtain the center vector of the B feature vectors.

[0078] The third step is to obtain the standard communication feature list BX = (BA, BT, Bπ) based on the above center vector; where BA is the standard state transition probability matrix; BT is the standard observation probability matrix; and Bπ is the standard initial state probability vector.

[0079] Here, the above B historical target sequence sets X are obtained as B feature vectors to obtain the center vector of the B feature vectors. Here, the center vector reduces the contingency caused by using a random target sequence set compared to the target sequence set X when any target device is determined to be a normal device at a historical time, so that the obtained standard communication feature list BX is more accurate and will not be too large or too small.

[0080] In an exemplary embodiment of the present application, the start time of the target time window is the end time of the most recent initialization of the industrial control network where the target device is located.

[0081] In an exemplary embodiment of the present application, the target device may also determine whether it is an abnormal device by the following method:

[0082] S1300, obtain the data size identification sequence NU=(NU1, NU2, ..., NUg, ..., NUh) of the target device in the target time window; g=1, 2, ..., h; wherein h is the number of traffic packets sent by the target device in the target time window; NUg is the data size identification of the g-th traffic packet sent by the target device in the target time window; NUg∈D; D is the data size identification sequence table corresponding to the industrial control network where the target device is located.

[0083] Specifically, compared with the previous embodiment, the target time window is used as the time length here, and the target time period is no longer divided.

[0084] S1400, obtain the first device identification sequence NH1 = (NH11, NH12, ..., NH1g, ..., NH1h), and the second device identification sequence NH2 = (NH21, NH22, ..., NH2g, ..., NH2h) of the target device within the target time window; NH1g is the device group identification corresponding to the receiving device of the g-th traffic packet; NH1g∈Z, Z is the first device identification sequence table corresponding to the industrial control network where the target device is located; NH2g is the device identification corresponding to the receiving device of the g-th traffic packet; NH1g∈E; E is the second device identification sequence table corresponding to the industrial control network where the target device is located.

[0085] Specifically, Z is obtained by the following steps:

[0086] Obtain the device group identifier of each device group in the industrial control network where the target device is located to obtain a first device identifier sequence table Z = (Z1, Z2, ..., Zr, ..., Zs, W); r = 1, 2, ..., s; wherein s is the number of device groups in the industrial control network where the target device is located except the device group where the target device is located; Zr is the device group identifier of the rth device group in the industrial control network where the target device is located except the device group where the target device is located; W is a preset external network device identifier.

[0087] Here, the industrial control network where the target device is located includes several device groups. As an example, the devices can be grouped according to the properties of the communicative devices, that is, the properties of each communicative device in each device group are the same. The identifiers of other device groups other than the device group where the target device is located in the industrial control network where the target device is located are obtained. Each device group corresponds to a device group identifier, and the device group identifiers of any two device groups are different. In addition, the target device may also communicate with devices outside the industrial control network, and each device identifier of the devices outside the industrial control network is determined to be W. This indicates that the target device has communicated with the external device.

[0088] In addition, E is obtained by the following steps:

[0089] Obtain the device identification of each communicative device in the device group where the target device is located to obtain a second device identification sequence table E=(E1, E2, ..., Et, ..., Eu, E(u+1); W); t=1, 2, ..., u; wherein u is the number of communicative devices in the device group where the target device is located excluding the target device; Et is the device identification of the tth communicative device in the device group where the target device is located excluding the target device; E(u+1) is the preset device group unified identification of other device groups in the industrial control network where the target device is located excluding the device group where the target device is located; W is the preset external network device identification.

[0090] Here, the communication status between the target device and the devices in its device group is obtained as part of the traffic characteristics of the target device. At the same time, the preset device group unified identification of the target device and other device groups outside its device group is recorded, that is, when the target device sends a traffic packet to any communicable device in any device group outside its device group, its device identification is determined as E(u+1).

[0091] S1500, input NU into the pre-trained first HMM model and the pre-trained second HMM model respectively to obtain the corresponding first prediction device identification sequence YNH1 = (YNH11, YNH12, ..., YNH1g, ..., YNH1h); and the second prediction device identification sequence YNH2 = (YNH21, YNH22, ..., YNH2g, ..., YNH2h); wherein YNH1g is the prediction device group identification corresponding to NH1g; YNH2g is the prediction device identification corresponding to NH2g; the pre-trained first HMM model is obtained by training based on the historical data size identification sequence and the historical first device identification sequence corresponding to when the target device with the target time window as the length is determined to be a normal device; the pre-trained second HMM model is obtained by training based on the historical data size identification sequence and the historical second device identification sequence corresponding to when the target device with the target time window as the length is determined to be a normal device.

[0092] Specifically, the pre-trained first HMM model is obtained by training based on the historical data size identification sequence and the historical first device identification sequence corresponding to when the target device with the target time window as the length is determined to be a normal device; the pre-trained second HMM model is obtained by training based on the historical data size identification sequence and the historical second device identification sequence corresponding to when the target device with the target time window as the length is determined to be a normal device; therefore, the corresponding first predicted device identification sequence and the second predicted device identification sequence are both obtained based on the data size identification sequence of the target device within the target time window when the target device is in a normal state.

[0093] S1600, obtaining a target matching degree PN according to NH1, NH2, YNH1 and YNH2.

[0094] Specifically, step S1600 includes:

[0095] The first step is to obtain the matching degree PN1 of NH1 and YNH1; PN1 meets the following conditions: PN1 = (NH1·YNH1) / (|NH1|×|YNH1|);

[0096] The second step is to obtain the matching degree PN2 of NH2 and YNH2; PN2 meets the following conditions: PN2 = (NH2·YNH2) / (|NH2|×|YNH2|);

[0097] The third step is to obtain the target matching degree PN according to PN1 and PN2; PN=z1*PN1+z2*PN2; wherein z1 is the first preset target weight; z2 is the second preset target weight.

[0098] In the fourth step, if PN is less than a preset target matching threshold, the target device is determined to be an abnormal device.

[0099] Specifically, according to NH1, NH2, YNH1 and YNH2, the target matching degree PN is obtained, that is, the matching degree between the first predicted device identification sequence and the second predicted device identification sequence and the corresponding first device identification sequence and the second device identification sequence obtained actually is obtained, and then the comprehensive matching degree is obtained. The flow characteristic changes between device groups and between devices in the group can be obtained respectively, and then whether the target device is an abnormal device can be comprehensively judged.

[0100] This embodiment uses the target time window as the data acquisition dimension, and comprehensively judges the status of the target device from two dimensions: the changes in traffic characteristics between device groups and between devices within a group. The obtained status of the target device is more accurate.

[0101] The embodiment of the present application also provides a device 200 for determining abnormality of a device, such as Figure 2 As shown, the above device comprises:

[0102] The data feature acquisition module 210 is used to acquire the data feature group set X corresponding to the target device, where X = (X1, X2, ..., Xi, ..., Xn); i = 1, 2, ..., n; wherein n is the number of target time periods arranged continuously in the target time window; Xi is the data feature group corresponding to the target device in the i-th target time period; Xi = (Ui, Hi); Ui is the data size identification sequence corresponding to the i-th target time period; Ui = (Ui1, Ui2, ..., Uia, ..., Uif(i)); a = 1, 2, ..., f(i); Uia is The data size identifier of the ath traffic packet sent by the target device in the i-th target time period; Uia∈D; D is the data size identifier list corresponding to the industrial control network where the target device is located; f(i) is the number of traffic packets sent by the target device in the i-th target time period within the target time window; Hi is the device identifier sequence corresponding to the i-th target time period; Hi=(Hi1, Hi2, ..., Hia, ..., Hif(i)); Hia is the device identifier of the receiving device corresponding to the a-th traffic packet; Hia∈T; T is the device identifier list corresponding to the industrial control network where the target device is located;

[0103] The target list acquisition module 220 is used to process X with the data size identifier as the observed state and the device identifier as the hidden state to obtain the target communication feature list MX=(MA, MT, Mπ) of the target device in the target time window; wherein MA is the state transition probability matrix corresponding to the target device in the target time window; MT is the observation probability matrix corresponding to the target device in the target time window; and Mπ is the initial state probability vector corresponding to the target device in the target time window;

[0104] A feature matching degree acquisition module 230 is used to acquire a communication feature matching degree PX between MX and a standard communication feature list BX;

[0105] The key matching degree acquisition module 240 is used to obtain the key matching degree PS according to the communication feature matching degree PX and the sequence matching degree PNH; wherein PNH is the matching degree between the device identification sequence NH corresponding to the target device and the predicted device identification sequence YNH corresponding to NH obtained based on the preset HMM model; PS meets the following conditions: PS = b1*PX+b2*PNH; b1 is the preset first weight; b2 is the preset second weight;

[0106] The abnormal device determination module 250 is configured to determine that the target device is an abnormal device if the PS is greater than a preset critical matching degree threshold.

[0107] An embodiment of the present application further provides a computer program product, which includes program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present application described above in this specification.

[0108] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0109] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0110] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0111] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0112] The electronic device according to this embodiment of the present application is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0113] The electronic device is presented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: the at least one processor mentioned above, the at least one storage device mentioned above, and a bus connecting different system components (including storage devices and processors).

[0114] The storage stores program codes, which can be executed by the processor, so that the processor executes the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present application.

[0115] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).

[0116] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0117] The bus may represent one or more of several types of bus structures including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0118] The electronic device can also communicate with one or more external devices (such as keyboards, pointing devices, Bluetooth devices, etc.), and can also communicate with one or more devices that enable users to interact with the electronic device, and / or communicate with any device (such as routers, modems, etc.) that enables the electronic device to communicate with one or more other computing devices. This communication can be carried out through an input / output (I / O) interface. In addition, the electronic device can also communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs) and / or public networks, such as the Internet) through a network adapter. As shown in the figure, the network adapter communicates with other modules of the electronic device through a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0119] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0120] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present application described in the above "Exemplary Method" section of the present specification.

[0121] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0122] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0123] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0124] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0125] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present application, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0126] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0127] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for determining abnormality of a device, characterized in that: The method comprises: S100, obtain the data feature group set X=(X1, X2, ..., Xi, ..., Xn) corresponding to the target device; i=1, 2, ..., n; wherein n is the number of target time periods arranged continuously in the target time window; Xi is the data feature group corresponding to the target device in the i-th target time period; Xi=(Ui, Hi); Ui is the data size identification sequence corresponding to the i-th target time period; Ui=(Ui1, Ui2, ..., Uia, ..., Uif(i)); a=1, 2, ..., f(i); Uia is the data size identification sequence corresponding to the target device in the i-th target time period The data size identifier of the ath traffic packet sent in the i-th target time period; Uia∈D; D is the data size identifier list corresponding to the industrial control network where the target device is located; f(i) is the number of traffic packets sent by the target device in the i-th target time period within the target time window; Hi is the device identifier sequence corresponding to the i-th target time period; Hi=(Hi1, Hi2, ..., Hia, ..., Hif(i)); Hia is the device identifier of the receiving device corresponding to the a-th traffic packet; Hia∈T; T is the device identifier list corresponding to the industrial control network where the target device is located; S200, process X with the data size identifier as the observed state and the device identifier as the hidden state, and obtain the target communication feature list MX=(MA, MT, Mπ) of the target device in the target time window; wherein MA is the state transition probability matrix corresponding to the target device in the target time window; MT is the observation probability matrix corresponding to the target device in the target time window; Mπ is the initial state probability vector corresponding to the target device in the target time window; S300, obtaining a communication feature matching degree PX between MX and a standard communication feature list BX; S400, according to the communication feature matching degree PX and the sequence matching degree PNH, a key matching degree PS is obtained; wherein PNH is the matching degree between the device identification sequence NH corresponding to the target device and the predicted device identification sequence YNH corresponding to NH obtained based on the preset HMM model; PS meets the following conditions: PS=b1×PX+b2×PNH; b1 is a preset first weight; b2 is a preset second weight; S500, if the PS is greater than a preset critical matching degree threshold, the target device is determined to be an abnormal device; PNH is determined by the following steps: S410, obtain the data size identification sequence NU=(NU1, NU2, ..., NUG, ..., NUh) and the device identification sequence NH=(NH1, NH2, ..., NHg, ..., NHh) corresponding to the target device; g=1, 2, ..., h; wherein h is the number of target data whose data generation time is within the target time window in the target data corresponding to the target device; NUg is the data size identification of the g-th target data; NHg is the device identification of the key electronic device corresponding to NUg; the key electronic device corresponding to any device identification is in the same industrial control network as the target device; S420, input NU into the preset HMM model to obtain the predicted device identification sequence YNH=(YH1, YH2, ..., YHg, ..., YHh) corresponding to NH; wherein YHg is the predicted device identification corresponding to NHg; the hidden state corresponding to the preset HMM model is the device identification, and the corresponding observed state is the data size identification; S430, obtaining the sequence matching degree PNH between NH and YNH; BX is determined by the following steps: S310, obtaining B target sequence groups X corresponding to the target device being determined as a normal device for the most recent B times; S320, taking the B target sequence groups X as B feature vectors, and obtaining the center vector of the B feature vectors; S330, according to the central vector, obtain a standard communication feature list BX=(BA, BT, Bπ); wherein BA is a standard state transition probability matrix; BT is a standard observation probability matrix; and Bπ is a standard initial state probability vector.

2. The method for determining an abnormality of a device according to claim 1, characterized in that: The start time of the target time window is the end time of the most recent initialization of the industrial control network where the target device is located.

3. The method for determining abnormality of a device according to claim 1, characterized in that: PX meets the following conditions: PX=(MX·BX) / (|MX|×|BX|).

4. The method for determining abnormality of a device according to claim 1, characterized in that: PNH meets the following conditions: PNH=(NH·YNH) / (|NH|×|YNH|).

5. A device for determining abnormality of equipment, characterized in that: The device comprises: The data feature acquisition module is used to obtain the data feature group set X=(X1, X2, ..., Xi, ..., Xn) corresponding to the target device; i=1, 2, ..., n; where n is the number of target time periods arranged continuously in the target time window; Xi is the data feature group corresponding to the target device in the i-th target time period; Xi=(Ui, Hi); Ui is the data size identification sequence corresponding to the i-th target time period; Ui=(Ui1, Ui2, ..., Uia, ..., Uif(i)); a=1, 2, ..., f(i); Uia is the target The data size identifier of the ath traffic packet sent by the device in the i-th target time period; Uia∈D; D is the data size identifier list corresponding to the industrial control network where the target device is located; f(i) is the number of traffic packets sent by the target device in the i-th target time period within the target time window; Hi is the device identifier sequence corresponding to the i-th target time period; Hi=(Hi1, Hi2, ..., Hia, ..., Hif(i)); Hia is the device identifier of the receiving device corresponding to the a-th traffic packet; Hia∈T; T is the device identifier list corresponding to the industrial control network where the target device is located; The target list acquisition module is used to process X with the data size identifier as the observed state and the device identifier as the hidden state to obtain the target communication feature list MX=(MA, MT, Mπ) of the target device in the target time window; wherein MA is the state transition probability matrix corresponding to the target device in the target time window; MT is the observation probability matrix corresponding to the target device in the target time window; and Mπ is the initial state probability vector corresponding to the target device in the target time window. A feature matching degree acquisition module is used to obtain the communication feature matching degree PX between MX and the standard communication feature list BX; The key matching degree acquisition module is used to obtain the key matching degree PS according to the communication feature matching degree PX and the sequence matching degree PNH; wherein PNH is the matching degree between the device identification sequence NH corresponding to the target device and the predicted device identification sequence YNH corresponding to NH obtained based on the preset HMM model; PS meets the following conditions: PS=b1×PX+b2×PNH; b1 is the preset first weight; b2 is the preset second weight; An abnormal device determination module, used to determine that the target device is an abnormal device if the PS is greater than a preset critical matching degree threshold; PNH is determined by the following steps: Obtain the data size identification sequence NU=(NU1, NU2, ..., NUg, ..., NUh) and the device identification sequence NH=(NH1, NH2, ..., NHg, ..., NHh) corresponding to the target device; g=1, 2, ..., h; wherein h is the number of target data whose data generation time is within the target time window in the target data corresponding to the target device; NUg is the data size identification of the g-th target data; NHg is the device identification of the key electronic device corresponding to NUg; the key electronic device corresponding to any device identification is in the same industrial control network as the target device; Input NU into the preset HMM model to obtain the predicted device identification sequence YNH=(YH1, YH2, ..., YHg, ..., YHh) corresponding to NH; where YHg is the predicted device identification corresponding to NHg; the hidden state corresponding to the preset HMM model is the device identification, and the corresponding observed state is the data size identification; Get the sequence matching degree PNH between NH and YNH; BX is determined by the following steps: Obtain B target sequence group sets X corresponding to the target device being determined as a normal device for the most recent B times; Take B target sequence groups X as B feature vectors and obtain the center vector of B feature vectors; According to the central vector, a standard communication feature list BX=(BA, BT, Bπ) is obtained; wherein BA is a standard state transition probability matrix; BT is a standard observation probability matrix; and Bπ is a standard initial state probability vector.

6. A non-transitory computer-readable storage medium, wherein at least one instruction or at least one program is stored in the storage medium, characterized in that: The at least one instruction or the at least one program is loaded and executed by the processor to implement the method according to any one of claims 1 to 4.

7. An electronic device, characterized in that: The invention comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 6.

Images