Industrial control asset identification method, device, equipment and storage medium

Abstract

The present application discloses an industrial control asset identification method, device, equipment and storage medium, and the present application relates to the field of industrial control network technology. The industrial control asset identification method comprises: determining a target storage space where at least one first configuration file generated when the configuration monitoring software monitors a real industrial control network is stored; searching the target storage space for a first configuration file whose corresponding file name matches any regular expression in a preset regular expression list, and obtaining at least one target configuration file; extracting the industrial control asset information contained in each target configuration file, and obtaining an industrial control asset identification result. The present application can minimize the interference caused to the network.

Description

Technical Field

[0001] The present application relates to the field of industrial control network technology, and in particular to an industrial control asset identification method, device, equipment and storage medium. Background Art

[0002] In industrial control systems, industrial control equipment is an important device for realizing industrial automation. The industrial control asset information of industrial control equipment is an important basis for risk assessment of industrial control systems. To conduct risk assessment based on asset information, it is first necessary to identify the industrial control asset information corresponding to the industrial control equipment.

[0003] Currently, the method of identifying industrial control asset information usually adopts active scanning. Active scanning requires sending specific detection signals to identify devices in the network. This method can discover more devices, including those that do not communicate frequently or are configured with specific communication protocols. However, active scanning will cause certain interference to the network, especially when there are sensitive devices in the network.

[0004] Therefore, in the process of industrial control asset identification, how to reduce the interference caused to the network becomes an urgent problem to be solved. Summary of the invention

[0005] The main purpose of this application is to provide an industrial control asset identification method, device, equipment and storage medium, aiming to solve the existing technical problem of large interference to the industrial control network during the process of identifying industrial control assets.

[0006] To achieve the above objectives, the present application provides an industrial control asset identification method, the industrial control asset identification method comprising:

[0007] In the simulation platform, different versions of simulation tests are performed based on a pre-built test model; the test model is built based on a real industrial control network, and the test model includes a virtual host computer and at least one virtual industrial control device; each of the virtual industrial control devices is connected to the virtual host computer;

[0008] When executing each version of the simulation test, controlling the virtual host computer to perform specific actions on each of the virtual industrial control devices, and obtaining at least one second configuration file generated after the specific actions are performed;

[0009] Comparing the file contents of different versions of each of the second configuration files to obtain a comparison result;

[0010] If the comparison result of any of the second configuration files is inconsistent, marking the second configuration file;

[0011] Identify the file name of each marked second configuration file, and construct at least one regular expression based on each identified file name;

[0012] generating the regular expression list based on the at least one regular expression;

[0013] Determine a target storage space where at least one first configuration file generated when monitoring a real industrial control network through configuration monitoring software is stored;

[0014] Searching the target storage space for a first configuration file whose corresponding file name matches any regular expression in a preset regular expression list, to obtain at least one target configuration file;

[0015] The industrial control asset information contained in each of the target configuration files is extracted to obtain an industrial control asset identification result.

[0016] In one embodiment, the step of constructing at least one regular expression based on each identified file name includes:

[0017] Common features among the plurality of file names are identified, and the regular expression is constructed based on the common features.

[0018] In one embodiment, the step of identifying common features among the plurality of file names and constructing the regular expression based on the common features comprises:

[0019] Identifying file extensions in each of the file names, and clustering file names with the same file extension into a cluster;

[0020] For a plurality of the file names included in any of the clusters, determining that a first common feature among the plurality of the file names is a file extension corresponding to the cluster;

[0021] For any of the clusters, identifying the main file names in the file names in the cluster, and determining whether the identified main file names contain common attributes;

[0022] If yes, taking the common attribute as the second common feature among the plurality of the file names in the cluster, and constructing the regular expression based on the first common feature and the second common feature corresponding to the cluster;

[0023] If not, construct the regular expression based on the first common feature corresponding to the clusters.

[0024] In one embodiment, the step of performing a file content comparison between different versions of each second configuration file to obtain a comparison result includes:

[0025] Compare the file content of the first version and the file content of the second version corresponding to the second configuration file byte by byte;

[0026] If any byte comparison is detected to be inconsistent during the comparison process, the comparison result is determined to be inconsistent;

[0027] If all bytes are compared and consistent, the comparison result is determined to be consistent.

[0028] In one embodiment, the step of extracting the industrial control asset information contained in each of the target configuration files to obtain the industrial control asset identification result includes:

[0029] Parsing each of the target configuration files by using a preset parsing tool to obtain the file structure and file content corresponding to each of the target configuration files;

[0030] Based on the file structures corresponding to the target configuration files, the industrial control asset information contained in the corresponding file contents is extracted using corresponding extraction rules.

[0031] In one embodiment, after the step of extracting the industrial control asset information contained in each of the target configuration files to obtain the industrial control asset identification result, the step further includes:

[0032] Arrange the industrial control asset information into a database record according to a preset format;

[0033] The database record is inserted into a preset asset table.

[0034] In addition, to achieve the above-mentioned purpose, the present application also provides an industrial control asset identification device, the industrial control asset identification device comprising:

[0035] A construction module is used to: execute different versions of simulation tests based on a pre-built test model in a simulation platform; the test model is built based on a real industrial control network, and the test model includes a virtual host computer and at least one virtual industrial control device; each of the virtual industrial control devices is connected to the virtual host computer; when executing each version of the simulation test, control the virtual host computer to perform specific actions on each of the virtual industrial control devices, and obtain at least one second configuration file generated after the specific action is executed; compare the file contents between different versions of each of the second configuration files to obtain a comparison result; if the comparison result of any of the second configuration files is inconsistent, mark the second configuration file; identify the file name of each marked second configuration file, and build at least one regular expression based on the identified file names; generate the regular expression list based on the at least one regular expression;

[0036] A determination module, used to determine a target storage space where at least one first configuration file generated when monitoring a real industrial control network through configuration monitoring software is stored;

[0037] A search module, configured to search the target storage space for a first configuration file whose corresponding file name matches any regular expression in a preset regular expression list, to obtain at least one target configuration file;

[0038] The identification module is used to extract the industrial control asset information contained in each of the target configuration files to obtain an industrial control asset identification result.

[0039] In addition, to achieve the above-mentioned purpose, the present application also provides an industrial control asset identification device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the industrial control asset identification method as described above.

[0040] In addition, to achieve the above-mentioned purpose, the present application also provides a storage medium, which is a computer-readable storage medium, and a program for implementing the industrial control asset identification method is stored on the computer-readable storage medium. The program for implementing the industrial control asset identification method is executed by a processor to implement the steps of the industrial control asset identification method as described above.

[0041] The industrial control asset identification method, device, equipment and storage medium provided by the present application determine the target storage space where at least one first configuration file generated when the configuration monitoring software monitors the real industrial control network is stored; search the target storage space for the first configuration file whose corresponding file name matches any regular expression in the preset regular expression list to obtain at least one target configuration file; extract the industrial control asset information contained in each target configuration file to obtain the industrial control asset identification result. Since the industrial control equipment information of this embodiment is extracted from the configuration file, and the configuration data existing in the network is passively collected and analyzed during the configuration analysis of the configuration monitoring software, there is no need to actively send a detection data packet to the network, so the configuration information of the industrial control equipment in the network will not be changed, which can minimize the interference to the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0044] Figure 1 A flowchart diagram of the first embodiment of the industrial control asset identification method of the present application;

[0045] Figure 2 A flow chart of the second embodiment of the industrial control asset identification method provided in this application;

[0046] Figure 3 A schematic diagram of a test model involved in the industrial control asset identification method of this application;

[0047] Figure 4 This is a schematic diagram of the module structure of the industrial control asset identification device according to an embodiment of the present application;

[0048] Figure 5 Schematic diagram of the structure of the hardware environment involved in the industrial control asset identification method in the embodiment of the present application.

[0049] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0050] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0051] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0052] The main solution of the present application is: determine the target storage space where at least one first configuration file generated when monitoring a real industrial control network through configuration monitoring software is stored; search the target storage space for a first configuration file whose corresponding file name matches any regular expression in a preset regular expression list to obtain at least one target configuration file; extract the industrial control asset information contained in each target configuration file to obtain an industrial control asset identification result.

[0053] Currently, active scanning is usually used to identify industrial control asset information, but this method will cause great interference to the industrial control network.

[0054] The present application determines the target storage space where at least one first configuration file generated when the configuration monitoring software monitors the real industrial control network is stored; searches the target storage space for the first configuration file whose corresponding file name matches any regular expression in the preset regular expression list to obtain at least one target configuration file; extracts the industrial control asset information contained in each target configuration file to obtain the industrial control asset identification result. Since the industrial control equipment information of the present application is extracted from the configuration file, and the configuration data existing in the network is passively collected and analyzed during the configuration analysis of the configuration monitoring software, there is no need to actively send a detection data packet to the network, so the configuration information of the industrial control equipment in the network will not be changed, which can minimize the interference to the network.

[0055] It should be noted that the execution subject of this embodiment can be an industrial control asset identification device, or a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an industrial control asset identification device capable of realizing the above functions, etc., and this embodiment does not specifically limit this. The following takes the industrial control asset identification device as the execution subject as an example to illustrate this embodiment and the following embodiments.

[0056] Based on this, this application proposes a first embodiment of the industrial control asset identification method, please refer to Figure 1 The industrial control asset identification method of this embodiment includes steps S10 to S30:

[0057] Step S10, determining a target storage space where at least one first configuration file generated when monitoring a real industrial control network through configuration monitoring software is stored.

[0058] It should be noted that the above-mentioned real industrial control network refers to an industrial control network system deployed in a real (or actual) environment, which generally includes a host computer and various industrial control devices, and the host computer communicates with each industrial control device respectively.

[0059] It should be noted that configuration monitoring software is a special software for data acquisition and process control, usually referred to as SCADA (Supervisory Control and Data Acquisition) software. Configuration monitoring software can collect data in real time by connecting sensors and devices, and perform data analysis and processing to achieve monitoring of the Internet of Things / industrial control network system. At the same time, the configuration monitoring software can also generate at least one configuration file corresponding to the configuration action performed by the target object, and the configuration file is used to embed the industrial control device information and other data associated with the configuration action. Among them, the configuration action refers to the operation performed by the target object (such as the user) in the configuration monitoring software to complete a specific task or function. These operations may include selecting controls, setting control properties, configuring data connections, defining event trigger conditions, etc. For example, a scheduled task can be defined by the configuration monitoring software, and when the scheduled task node arrives, the configuration monitoring software sends a status acquisition instruction to the industrial control device in the real industrial control network, which triggers the generation of at least one configuration file. Each configuration file records some status information of the relevant industrial control device, and the generated at least one configuration file is stored in the installation directory of the configuration monitoring software by default.

[0060] As an example, the configuration monitoring software can be WinCC configuration software, which is provided by Siemens and is currently widely used in industrial control systems. When WinCC software communicates with industrial control devices in the industrial control network, it uses specific configuration files to store properties and parameters related to the connection with the industrial control devices. These files usually contain important information such as network addresses, communication protocols, industrial control device types, connection strings, etc., to ensure that WinCC configuration software can correctly establish connections with industrial control devices and exchange data.

[0061] Specifically, in this embodiment, when monitoring a real industrial control network through configuration monitoring software, the target storage space where the first configuration file is stored can be pre-set. The target storage space can be a default storage space or other storage modules. The default storage space can be the installation directory of the configuration monitoring software.

[0062] More specifically, the above step S10 may be to start asset identification of the real industrial control network device when receiving the asset identification task start instruction. During asset identification, the pre-configured configuration monitoring configuration information is first read from the local storage module or the cloud storage, and the configuration monitoring configuration information includes the target storage space corresponding to the first configuration file, so that the target storage space can be determined based on the configuration monitoring configuration information.

[0063] Step S20: Search the target storage space for a first configuration file whose corresponding file name matches any regular expression in a preset regular expression list, to obtain at least one target configuration file.

[0064] It should be noted that, since the configuration monitoring software generates one or more first configuration files each time it executes a configuration action, these first configuration files are set to be stored in the target storage space. Since not all first configuration files are used to record industrial control asset information, it is first necessary to identify the target configuration file that records the industrial control asset information. Among them, the industrial control asset information may include relevant information of various equipment and systems used to control and monitor industrial processes, such as equipment information and communication information of industrial control equipment. Equipment information may include equipment name, model and manufacturer information; communication information may include the communication protocol and network configuration information of the equipment as well as network identifiers such as the IP address and port number of the equipment.

[0065] Specifically, the file name (or file type) of the first configuration file that may record the industrial control asset information can be inferred based on the product function specification provided by the supplier of the configuration monitoring software, and each regular expression can be constructed based on each file name (or file type). A regular expression list is obtained based on each regular expression, and the regular expression list is stored in a local storage module or cloud storage so that it can be read from the local storage module or cloud storage when needed.

[0066] Taking WinCC as an example, some file types recommended by the official website for storing connection properties with industrial control equipment may include:

[0067] (1) GSDML file: GSDML (Global Scripting Device Markup Language) is an XML format file used to describe device and controller properties. It can be used to configure GSD (GPRS Subsystem Description) devices in WinCC.

[0068] (2) OPC configuration file: When using industrial standard (OLE for Process Control, OPC) communication, WinCC may generate or use a configuration file to store the connection parameters of the OPC server, such as the server address, project name, access path, etc.

[0069] (3) Project configuration file: A WinCC project may contain configuration files for storing industrial control device connection settings. These files may be in XML format or in a WinCC-specific format.

[0070] (4) Communication driver configuration file: If you use a specific communication driver to communicate with industrial control equipment, WinCC may generate a configuration file to store the settings of the driver.

[0071] (5) System registry: In some cases, connection properties may be stored in the system's registry, especially when using communication components provided by Siemens.

[0072] (6) WinCC system database: The WinCC system database may contain configuration information related to industrial control equipment communication, which may be stored in .mdf files.

[0073] (7) User profile: Users may create profiles on their workstations to save personalized settings related to PLC connections.

[0074] (8) Other files in the project folder: The WinCC project folder may contain other files related to PLC connections, such as script files (.vbs, .cts, etc.). These files may contain script commands for establishing or managing connections.

[0075] Therefore, corresponding regular expressions can be established based on the file types or file names corresponding to the above-mentioned various situations. For example, for GSDML files, since they usually have the extension of .gsdml or .xml, the corresponding regular expression can be: \.gsdml$|\.xml$; for OPC configuration files, since they usually have the extension of .opc or .cfg, the corresponding regular expression can be: \.opc$|\.cfg$; for the above-mentioned project configuration files, the corresponding regular expression can be: \.xml$|\.cfg$|\.ini$; for the above-mentioned communication driver configuration files, the corresponding regular expression can be: \.drvcfg$; for the above-mentioned system registry, since the system registry itself is not a file but a part of the Windows system, it can be For identification through registry export files, they may have a .reg extension, so the corresponding regular expression can be: \.reg$; for WinCC system database files, since they may have a .mdf extension, the corresponding regular expression can be: \.mdf$; for user configuration files, they may have a variety of extensions, but the most common ones may be .cfg, .ini or .user, so the corresponding regular expression can be: \.cfg$|\.ini$|\.user$; for other files in the project folder: this includes a variety of file types, but regular expressions can be written for the mentioned script file extensions, and the corresponding regular expression can be: \.vbs$|\.cts$.

[0076] After obtaining the regular expressions corresponding to the above multiple types, the regular expressions corresponding to the multiple types can be combined to obtain a regular expression list.

[0077] Specifically, the file name in the present application includes a main file name and an extension, and its form may be "main file name.extension name". The corresponding file name matches any regular expression in the preset regular expression list, which means: the extension in the file name matches any regular expression, or the main file name in the file name matches any regular expression, or the extension and main file name in the file name match any regular expression. For example, assuming that the file name of one of the first configuration files is "project_1.opc", and assuming that one of the regular expressions is \.opc$, it can be determined that the first configuration file matches the regular expression; and assuming that one of the regular expressions is \.opc$&&\project $, it can also be determined that the first configuration file matches the regular expression. In this way, regular expressions can be used to filter out target configuration files that may record industrial control asset information from multiple first configuration files generated by the configuration monitoring software.

[0078] Step S30, extracting the industrial control asset information contained in each target configuration file to obtain an industrial control asset identification result.

[0079] Specifically, the above step S30 may include steps A1-A2:

[0080] Step A1: parse each target configuration file by a preset parsing tool to obtain the file structure and file content corresponding to each target configuration file.

[0081] There may be multiple preset parsing tools, and the corresponding parsing tool is selected according to the file format corresponding to each target configuration file. For example, for a target configuration file in XML format, an XML parsing tool is selected. The file structure and file content corresponding to each target configuration file can be parsed by the parsing tool.

[0082] It should be noted that the file structure is the organization and storage format of the data in the file. Different types of files can use different structures, depending on the information contained in the file and its purpose. For example, for an XML file, the parsed file structure can be composed of tags, attributes, and text content. The file content refers to the information stored in the file.

[0083] Step A2: based on the file structures corresponding to the respective target configuration files, the industrial control asset information contained in the corresponding file contents is extracted using corresponding extraction rules.

[0084] Specifically, according to the file structures corresponding to each target configuration file, extraction rules corresponding to the corresponding file structures can be read from the local storage module or cloud storage. The extraction rules can be a piece of executable code, which is used to implement the function of extracting industrial control asset information of the corresponding file structure.

[0085] In this embodiment, at least one first configuration file generated when the configuration monitoring software monitors the real industrial control network is stored in the target storage space; the first configuration file whose corresponding file name matches any regular expression in the preset regular expression list is searched in the target storage space to obtain at least one target configuration file; the industrial control asset information contained in each target configuration file is extracted to obtain the industrial control asset identification result. Since the industrial control equipment information of this embodiment is extracted from the configuration file, and the configuration data existing in the network is passively collected and analyzed during the configuration analysis of the configuration monitoring software, there is no need to actively send a detection data packet to the network, so the configuration information of the industrial control equipment in the network will not be changed, which can minimize the interference to the network.

[0086] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the first embodiment can refer to the above introduction, and will not be repeated in the following. Figure 2 In the above step S20, before searching the target storage space for a first configuration file whose corresponding file name matches any regular expression in a preset regular expression list to obtain at least one target configuration file, the industrial control asset identification method further includes steps S11 to S15:

[0087] Step S11, in the simulation platform, different versions of simulation tests are performed based on a pre-built test model; the test model is built based on a real industrial control network, and the test model includes a virtual host computer and at least one virtual industrial control device; each virtual industrial control device is connected to the virtual host computer.

[0088] Compared with the first embodiment described above, this embodiment takes into account that the configuration file type provided by the configuration industrial control software supplier that may be used to store the relevant attributes and parameters of the industrial control equipment may not be accurate or comprehensive enough. In order to more accurately determine the configuration file that stores the industrial control asset information, this embodiment simulates multiple second configuration files generated when different versions of industrial control equipment communicate with the host computer through simulation testing. When the file content of the second configuration file changes before and after the version change, it means that the second configuration file changes with the version of the industrial control equipment, and the corresponding generated device basic information also changes. Therefore, it can be determined that the second configuration file stores the industrial control asset information, which can achieve accurate identification of the industrial control asset information, thereby narrowing the scope of the target configuration file search and improving the identification efficiency.

[0089] Specifically, the simulation software S7-PLCSIM can be connected to the configuration monitoring software to build a simulation platform. Then, a test model is built in the simulation platform. The test model is constructed based on the real virtual machine in the real industrial control network and the network connection relationship between the real virtual machine and each real industrial control device. For example, assuming that the real industrial control network contains a real virtual machine A, a real industrial control device B1 of the first model, a real industrial control device B2 of the second model, and a real industrial control device B3 of the third model, and the real virtual machine A is respectively communicated with the real industrial control device B1, the real industrial control device B2, and the real industrial control device B3, then the constructed test model can be as follows: Figure 3 shown.

[0090] Specifically, at least two versions of simulation tests can be performed. Before each version of the simulation test, the versions of the virtual industrial control devices included in the test model are adjusted to the same version, for example, the version firmware of each virtual industrial control device is adjusted to version V1. During each version of the simulation test, specific actions are performed on multiple virtual industrial control devices of the corresponding version, and corresponding test results are obtained.

[0091] Step S12, when executing the simulation test of each version, controlling the virtual host computer to execute a specific action on each virtual industrial control device, and obtaining at least one second configuration file generated after the execution of the specific action.

[0092] Specifically, the specific action may be: requesting to view device information of each virtual industrial control device. Execution of the specific action triggers generation of at least one second configuration file, and the second configuration file is generated in a simulation environment.

[0093] Step S13, comparing the file contents of different versions of each second configuration file to obtain a comparison result; if the comparison result of any second configuration file is inconsistent, the second configuration file is marked.

[0094] Specifically, for each second configuration file, binary comparison may be performed on the file contents of different versions corresponding to the second configuration file to obtain a comparison result.

[0095] More specifically, the file content of the first version and the file content of the second version corresponding to the second configuration file can be compared byte by byte; if any byte is detected to be inconsistent during the comparison process, the comparison result is determined to be inconsistent; if all bytes are consistent, the comparison result is determined to be consistent.

[0096] Specifically, when the file content of any second configuration file changes before and after the version is changed, it means that the second configuration file is used to store the asset information of the industrial control device, and the second configuration file is marked.

[0097] Step S14: identifying the file names of the marked second configuration files, and constructing at least one regular expression based on the identified file names.

[0098] Specifically, constructing at least one regular expression based on the identified file names may include: identifying common features among multiple file names, and constructing a regular expression based on the common features, wherein the common features may refer to common character strings or other feature information contained in the file names.

[0099] More specifically, constructing at least one regular expression based on each identified file name may include steps C1 to C4:

[0100] Step C1, identifying the file extensions in each file name, and clustering the file names with the same file extension into one cluster.

[0101] Step C2: for a plurality of file names included in any cluster, determining a first common feature among the plurality of file names as a file extension corresponding to the cluster.

[0102] Among them, the file name of each configuration file is in the form of "main file name.file extension". The file names with the same file extension are first clustered into a cluster, and the common file extension among multiple file names clustered in the same cluster is used as the first common feature among the multiple file names.

[0103] Step C3: for any cluster, identify the main file name in each file name in the cluster, and determine whether the identified main file names contain common attributes.

[0104] The common attribute may be a common string, that is, identifying whether the main file names contain a common string.

[0105] Step C4: if yes, then use the common attribute as the second common feature between the multiple file names in the cluster, and construct a regular expression based on the first common feature and the second common feature corresponding to the cluster. If no, then construct a regular expression based on the first common feature corresponding to the cluster.

[0106] Specifically, if the second common feature between multiple file names in any cluster is identified, a regular expression is constructed based on the first common feature and the second common feature corresponding to the cluster; if not, a regular expression is constructed based on the first common feature corresponding to the cluster.

[0107] Incorporating the common attribute as the second common feature into the regular expression can further improve the matching accuracy.

[0108] Step S15: Generate a regular expression list based on at least one regular expression.

[0109] Specifically, multiple regular expressions can be combined to obtain a regular expression list.

[0110] Through the above implementation scheme, by comparing whether there are differences in the file contents of the second configuration files corresponding to the industrial control equipment before and after the version change, and screening out the second configuration files storing the industrial control asset information from multiple second configuration files according to the comparison results, the target configuration file can be accurately identified.

[0111] Based on the first / second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the first / second embodiment can be referred to the above description, and will not be repeated in the following. On this basis, in the above step S30, after extracting the industrial control asset information contained in each target configuration file and obtaining the industrial control asset identification result, the industrial control asset identification method further includes steps S50 to S60:

[0112] Step S50, organizing the industrial control asset information into database records according to a preset format.

[0113] Specifically, the industrial control asset information may include the device name, model, IP address, MAC address, software version, firmware version, etc. of the industrial control equipment. After the industrial control asset information is extracted, it can be cleaned, deduplicated, and invalid or incorrectly formatted data can be removed, and the integrity of the data can be verified, and the missing data can be filled.

[0114] Step S60: inserting the database record into the preset asset table.

[0115] Specifically, a database connection library or tool may be used to establish a connection with a database, and the industrial control asset information may be converted according to a preset database record format and then inserted into the asset table one by one.

[0116] Through the above implementation scheme, the industrial control asset information of the industrial control equipment can be organized into database records according to a preset format, which is convenient for subsequent query, analysis and management.

[0117] In a feasible implementation manner, before the above step 30 and after step S50, the following may also be included: copying the extracted industrial control asset information to a local custom directory.

[0118] The present application also provides an industrial control asset identification device, please refer to Figure 4 , the industrial control asset identification device comprises:

[0119] A determination module 10, for determining a target storage space where at least one first configuration file generated when monitoring a real industrial control network through configuration monitoring software is stored;

[0120] A search module 20, configured to search the target storage space for a first configuration file whose corresponding file name matches any regular expression in a preset regular expression list, to obtain at least one target configuration file;

[0121] The identification module 30 is used to extract the industrial control asset information contained in each target configuration file to obtain an industrial control asset identification result.

[0122] Optionally, the industrial control asset identification device further includes a construction module, and the construction module is used to:

[0123] In the simulation platform, different versions of simulation tests are performed based on pre-built test models; the test model is built based on a real industrial control network, and the test model includes a virtual host computer and at least one virtual industrial control device; each virtual industrial control device is connected to the virtual host computer;

[0124] When executing each version of the simulation test, the virtual host computer is controlled to perform specific actions on each virtual industrial control device, and at least one second configuration file generated after the specific action is executed is obtained;

[0125] Comparing the file contents of different versions of each second configuration file to obtain a comparison result;

[0126] If the comparison result of any second configuration file is inconsistent, marking the second configuration file;

[0127] Identify the file name of each marked second configuration file, and construct at least one regular expression based on each identified file name;

[0128] Generates a regular expression list based on at least one regular expression.

[0129] Optionally, the industrial control asset identification device is also used for:

[0130] Identify common features among multiple file names and construct regular expressions based on the common features.

[0131] Optionally, the above building blocks are also used to:

[0132] Identify the file extensions in each file name and cluster the file names with the same file extension into one cluster;

[0133] For a plurality of file names contained in any cluster, setting a first common feature among the plurality of file names as a file extension corresponding to the cluster;

[0134] For any cluster, identify the main file names in each file name in the cluster, and determine whether the identified main file names contain common attributes;

[0135] If so, the common attribute is used as the second common feature between the multiple file names in the cluster, and a regular expression is constructed based on the first common feature and the second common feature corresponding to the cluster;

[0136] If not, a regular expression is constructed based on the first common feature corresponding to the cluster.

[0137] Optionally, the above building blocks are also used to:

[0138] Compare the file content of the first version corresponding to the second configuration file with the file content of the second version byte by byte;

[0139] If any byte comparison is detected to be inconsistent during the comparison process, the comparison result is determined to be inconsistent;

[0140] If all bytes are consistent, the comparison result is determined to be consistent.

[0141] Optionally, the industrial control asset identification device is also used for:

[0142] Parse each target configuration file through a preset parsing tool to obtain the file structure and file content corresponding to each target configuration file;

[0143] Based on the file structures corresponding to each target configuration file, the corresponding extraction rules are used to extract the industrial control asset information contained in the corresponding file content.

[0144] Optionally, the industrial control asset identification device is also used for:

[0145] Organize industrial control asset information into database records according to preset formats;

[0146] Insert database records into the preset asset table.

[0147] The industrial control asset identification device provided in the embodiment of the present application adopts the industrial control asset identification method in the above embodiment, which can solve the technical problem of large interference to the industrial control network in the process of identifying industrial control assets. Compared with the prior art, the beneficial effects of the industrial control asset identification device provided in the embodiment of the present application are the same as the beneficial effects of the industrial control asset identification method provided in the above embodiment, and other technical features in the industrial control asset identification device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0148] The present application provides an industrial control asset identification device, which includes: at least one processor; and a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the industrial control asset identification method in the above-mentioned embodiment one.

[0149] Reference below Figure 5 , which shows a schematic diagram of the structure of an industrial control asset identification device suitable for implementing the embodiment of the present application. The industrial control asset identification device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The industrial control asset identification device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0150] like Figure 5As shown, the industrial control asset identification device may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the industrial control asset identification device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the industrial control asset identification device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows an industrial control asset identification device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided instead.

[0151] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0152] The industrial control asset identification device provided by the present application adopts the industrial control asset identification method in the above embodiment, which can solve the technical problem of large interference to the industrial control network in the process of identifying industrial control assets. Compared with the prior art, the beneficial effects of the industrial control asset identification device provided by the present application are the same as the beneficial effects of the industrial control asset identification method provided by the above embodiment, and the other technical features in the industrial control asset identification device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0153] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0154] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the industrial control asset identification method in the above-mentioned embodiment.

[0155] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0156] The above-mentioned computer-readable storage medium may be included in the industrial control asset identification device; or it may exist independently without being assembled into the industrial control asset identification device.

[0157] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the industrial control asset identification device, the industrial control asset identification device: determines the target storage space where at least one first configuration file generated when monitoring the real industrial control network through the configuration monitoring software is stored; searches the target storage space for the first configuration file whose corresponding file name matches any regular expression in the preset regular expression list, and obtains at least one target configuration file; extracts the industrial control asset information contained in each target configuration file to obtain the industrial control asset identification result.

[0158] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0159] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0160] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0161] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned industrial control asset identification method, and can solve the technical problem of large interference to the industrial control network in the existing process of identifying industrial control assets. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the industrial control asset identification method provided by the above-mentioned embodiment, and will not be repeated here.

[0162] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent processing scope of the present application.

Claims

1. A method for identifying industrial control assets, characterized in that: The industrial control asset identification method comprises: In the simulation platform, different versions of simulation tests are performed based on a pre-built test model; the test model is built based on a real industrial control network, and the test model includes a virtual host computer and at least one virtual industrial control device; each of the virtual industrial control devices is connected to the virtual host computer; When executing each version of the simulation test, controlling the virtual host computer to perform specific actions on each of the virtual industrial control devices, and obtaining at least one second configuration file generated after the specific actions are performed; Comparing the file contents of different versions of each of the second configuration files to obtain a comparison result; If the comparison result of any of the second configuration files is inconsistent, marking the second configuration file; Identify the file name of each marked second configuration file, and construct at least one regular expression based on each identified file name; generating the regular expression list based on the at least one regular expression; Determining a target storage space in which at least one first configuration file generated when monitoring a real industrial control network through configuration monitoring software is stored, wherein the configuration monitoring software is connected to the simulation software; Searching the target storage space for a first configuration file whose corresponding file name matches any regular expression in a preset regular expression list, to obtain at least one target configuration file; The industrial control asset information contained in each of the target configuration files is extracted to obtain an industrial control asset identification result.

2. The method according to claim 1, further characterized in that: The step of constructing at least one regular expression based on the identified file names comprises: Common features among the plurality of file names are identified, and the regular expression is constructed based on the common features.

3. The method according to claim 2, characterized in that The step of identifying common features among the plurality of file names and constructing the regular expression based on the common features comprises: Identifying file extensions in each of the file names, and clustering file names with the same file extension into a cluster; For a plurality of the file names included in any of the clusters, determining that a first common feature among the plurality of the file names is a file extension corresponding to the cluster; For any of the clusters, identifying the main file names in the file names in the cluster, and determining whether the identified main file names contain common attributes; If yes, taking the common attribute as the second common feature among the plurality of the file names in the cluster, and constructing the regular expression based on the first common feature and the second common feature corresponding to the cluster; If not, construct the regular expression based on the first common feature corresponding to the clusters.

4. The method according to claim 1, characterized in that The step of comparing the file contents of different versions of each second configuration file to obtain a comparison result comprises: Compare the file content of the first version and the file content of the second version corresponding to the second configuration file byte by byte; If any byte comparison is detected to be inconsistent during the comparison process, the comparison result is determined to be inconsistent; If all bytes are compared and consistent, the comparison result is determined to be consistent.

5. The method according to claim 1, characterized in that The step of extracting the industrial control asset information contained in each of the target configuration files to obtain the industrial control asset identification result includes: Parsing each of the target configuration files by using a preset parsing tool to obtain the file structure and file content corresponding to each of the target configuration files; Based on the file structures corresponding to the target configuration files, the industrial control asset information contained in the corresponding file contents is extracted using corresponding extraction rules.

6. The method according to claim 1, characterized in that After the step of extracting the industrial control asset information contained in each of the target configuration files to obtain the industrial control asset identification result, the following step further includes: Arrange the industrial control asset information into a database record according to a preset format; The database record is inserted into a preset asset table.

7. An industrial control asset identification device, characterized in that: The industrial control asset identification device comprises: A construction module is used to: execute different versions of simulation tests based on a pre-built test model in a simulation platform; the test model is built based on a real industrial control network, and the test model includes a virtual host computer and at least one virtual industrial control device; each of the virtual industrial control devices is connected to the virtual host computer; when executing each version of the simulation test, control the virtual host computer to perform specific actions on each of the virtual industrial control devices, and obtain at least one second configuration file generated after the specific action is executed; compare the file contents between different versions of each of the second configuration files to obtain a comparison result; if the comparison result of any of the second configuration files is inconsistent, mark the second configuration file; identify the file name of each marked second configuration file, and build at least one regular expression based on the identified file names; generate the regular expression list based on the at least one regular expression; A determination module, used to determine a target storage space in which at least one first configuration file generated when monitoring a real industrial control network through configuration monitoring software is stored, wherein the configuration monitoring software is connected to the simulation software; A search module, configured to search the target storage space for a first configuration file whose corresponding file name matches any regular expression in a preset regular expression list, to obtain at least one target configuration file; The identification module is used to extract the industrial control asset information contained in each of the target configuration files to obtain an industrial control asset identification result.

8. An industrial control asset identification device, characterized in that: The industrial control asset identification device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the industrial control asset identification method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the industrial control asset identification method according to any one of claims 1 to 6 are implemented.

Images