Industrial controller honeypot identification method and device based on device memory fingerprint

Abstract

The present invention discloses a method and device for identifying an industrial controller honeypot based on device memory fingerprint. The method includes: constructing a target device memory fingerprint library; extracting a communication template from the historical network communication traffic of the target device; requesting memory features from the object to be detected; setting a memory feature matching mechanism, performing system state memory similarity comparison, system state memory semantic conflict detection, memory operation failure detection, control logic test case execution error detection, sensor measurement value noise distribution similarity comparison, actuator disturbance impact comparison; using a threshold judgment mechanism for the three types of features based on similarity comparison, and using a one-vote veto mechanism for the three types of features based on rule adaptation to obtain a honeypot identification result. The present invention solves the problem of difficulty in identifying industrial controller honeypots with high memory simulation, optimizes detection resource overhead, and realizes efficient and accurate identification of industrial control honeypots.

Description

Technical Field

[0001] The present invention belongs to the field of industrial control system security, and in particular relates to an industrial controller honeypot identification method and device based on device memory fingerprint. Background Art

[0002] As industrial control systems continue to become more intelligent, digital, and open, many industrial controllers are exposed to the public network environment, and advanced persistent attacks against them are emerging in an endless stream, including scanning detection, denial of service attacks, malicious program injection, replay attacks, etc. As a typical active defense method, industrial controller honeypots can deceive attackers into interacting deeply with the honeypot by imitating the services and operations of real devices, effectively collecting zero-day vulnerabilities, threat methods, attack impacts and other intelligence, and providing technical support for network situational awareness. At present, the design of industrial controller honeypots has gradually evolved from the original low-interaction protocol implementation to a highly deceptive honeypot system with real operating system fingerprints, complete industrial protocol implementation, and accurate industrial process simulation.

[0003] For IoT device search engines, etc., industrial controller honeypots will lead to inaccurate mapping of current cyberspace assets. The current identification of industrial controller honeypots mainly includes: 1) TCP / IP protocol stack fingerprint identification of target objects represented by NMAP tools. This method has been bypassed by the fingerprint camouflage technology of the existing open source honeypot HoneyPLC; 2) HoneyScore mechanism represented by SHODAN search engine, which uses information such as the Internet provider information of IP and historical identification data of IP address to comprehensively judge the characteristics of target IP. Honeypot designers can use public network IP alone to bypass detection; 3) Industrial control basic information scanning represented by PLC Scan, which cannot identify current high-interaction industrial controller honeypots using only simple identification information. Therefore, it is necessary to expand the existing honeypot identification research, model and extract features of the memory characteristics of industrial controllers, use the overall memory characteristics of the device as the main feature to distinguish honeypots, and improve the recognition accuracy and efficiency of honeypots. Summary of the invention

[0004] The purpose of the present invention is to address the deficiencies in the prior art, provide an industrial controller honeypot identification method and device based on device memory fingerprint, and build a related prototype system for experimental verification.

[0005] The object of the present invention is to achieve the following technical solution: a method for identifying an industrial controller honeypot based on device memory fingerprint, the method comprising the following steps:

[0006] S1, taking the real industrial controller simulated by the honeypot as the target device, collecting the target device's system status memory snapshot, semantic fields in the description file, operation responses of memory data, correct output of control logic test cases, and industrial process history data recorded in memory, and building the target device memory fingerprint library;

[0007] S2, sorting and differentially analyzing the historical network communication traffic of the target device by timestamp to obtain the sequence number field and the length field; collecting the function execution records of the upper computer, performing differential analysis on the network message group generated by multiple executions of each function to obtain the fixed field and the user field; using the fixed field, the sequence number field, the length field and the user field as the communication template of the function;

[0008] S3, a communication template that calls a function and requests the corresponding memory features from the object to be detected;

[0009] S4, set up a memory feature matching mechanism to perform system state memory similarity comparison, system state memory semantic conflict detection, memory operation failure detection, control logic test case execution error detection, sensor measurement value noise distribution similarity comparison, and actuator disturbance impact comparison;

[0010] S5, using a threshold judgment mechanism to identify honeypots based on the deviation degree obtained by comparing the system state memory similarity, sensor measurement value noise distribution similarity and actuator disturbance influence;

[0011] S6, uses a one-vote veto mechanism to identify honeypots based on the number of semantic conflicts, the number of memory operation failures, and the number of control logic test case execution errors.

[0012] Furthermore, S1 is specifically:

[0013] Collect the system status memory snapshot M of the target device t , M t Contains e system status records {z1,z2,…,z e};

[0014] Use natural language processing technology to analyze the target device's description file, identify the description containing semantic field location identifiers and semantic content, and extract M t All semantic fields {θ1,θ2,…,θ n};

[0015] Collect the host computer software's methods of creating, reading, overwriting, and deleting the target device's memory data, and record the correct response communication messages and the error response communication messages after the operation is completed;

[0016] Randomly generate control logic test cases containing Boolean operations, four arithmetic operations, and encapsulated mathematical functions. Given the initial input value I, calculate the correct output value O of the control logic test case;

[0017] The noise distribution N of the sensor measurement value Y recorded in the memory of the sample target device;

[0018] A small disturbance ΔU of the actuator output value recorded in the memory of the sampling target device affects the deviation ΔY of the sensor measurement value of its controlled object.

[0019] Further, S2 is specifically:

[0020] Split the historical network traffic into two halves according to the packet time series F a and F b , F a Each message in the message is sorted according to the timestamp, and the message sequence is aligned at the same time. The difference analysis is performed on two adjacent messages to search for the fields with changing data values; the field with linearly increasing data values ​​is marked as the sequence number field, and the field with affine consistency between the statistical distribution of the data value and the statistical distribution of the message length is marked as the length field, and the data is collected in F. b After successful verification, the final sequence number field and length field are obtained.

[0021] Collect the function execution records of the host computer {E1, E2, …, E C}, for the host computer specific function E executed p times i , extract p groups of functions E from the historical network traffic F i Generated network message group Each message group contains the execution function E i All q messages of

[0022] In the network message group Intranet Message Perform differential analysis, retain the fixed fields in the message, exclude the length field and sequence number field that have been parsed, mark the remaining fields with changed data values ​​as user fields, and form the target device execution function E i The communication template includes a fixed field, a length field, a sequence number field and a user field; finally, all functions {E1, E2, …, E C} Respective communication templates.

[0023] Further, S3 is specifically:

[0024] Call the communication template for requesting the target device system status memory snapshot, fill in the system status record number in the user field, fill in the length of the current message in the length field, fill in the sequence number of the current message in the sequence number field, send it to the target device to be detected, and extract the system status memory snapshot from the user field of the response message, denoted as M t ′;

[0025] Call the communication template for the creation, reading, overwriting and deletion of the target device's memory data, send the creation, reading, overwriting and deletion requests for the memory data block, organization block and function block to the object to be detected, and obtain the response message denoted as R sem ;

[0026] Call the communication template downloaded from the control logic test case, fill in the control logic test case in the user field, and send it to the object to be detected; call the communication template that assigns the input variable of the control logic test case, assign the initial input value I to the input, and send it to the object to be detected; call the communication template that reads the output variable of the control logic test case, send it to the object to be detected and read the control logic test case output value O′ from the user field of the response message;

[0027] Calling a communication template for reading a sensor measurement value Y recorded in the memory of the object to be detected, sending the value to the object to be detected, and extracting a noise distribution N′ of the sensor measurement value recorded in the memory of the object to be detected from the user field of the response message;

[0028] Call the communication template that modifies the actuator output value U recorded in the memory of the object to be detected, fill in the actuator output value small disturbance ΔU in the user field, and send it to the object to be detected. Call the communication template that reads the sensor measurement value Y recorded in the memory of the object to be detected again, send it to the object to be detected and read the sensor measurement value influence deviation ΔY′ from the user field of the response message.

[0029] Further, S4 is specifically:

[0030] ① System state memory similarity comparison: From the system state memory snapshot M in the fingerprint library t Extract the system state record z1 from S3 and obtain the system state memory snapshot M from S3 t ′, where z1 and z1′ have the same identifier and the similarity S between z1 and z1′ is z1 The calculation formula is as follows:

[0031]

[0032] Among them, the levenshtein function calculates the edit distance between z1 and z1′, and the max function calculates the maximum byte length of z1 and z1′; the overall similarity λ1 is calculated as follows:

[0033]

[0034] Among them, |e| is the system state memory snapshot M t The total number of system status records in;

[0035] ② System state memory semantic conflict detection: The system state memory snapshot M obtained in S3 t ′ in the semantic field {θ′1,θ′2,…,θ′ m}Do the following tests:

[0036] 1) For a specific semantic field θ′ i , can be modified according to semantic requirements;

[0037] 2) If a state of the object to be detected has an association rule between several semantic fields, the semantic meanings expressed in these semantic fields should be the same;

[0038] 3) For a specific semantic field θ′ i , its value space should be consistent with the value space of the corresponding semantic field in the fingerprint library;

[0039] Cannot be modified, do not express the same meaning, and are not consistent. That is, if any one of the above conditions 1), 2), and 3) is not met, it is considered a conflict, and λ2 is used to record the number of semantic conflicts.

[0040] ③Memory operation failure detection: Use λ3 to record the response message R obtained in S3 sem The number of error response messages in the

[0041] ④ Error detection of control logic test case execution: compare the control logic test case output value O′ obtained in S3 with the correct output value O stored in the fingerprint library, and use λ4 to record the number of times O≠O′ occurs;

[0042] ⑤Sensor measurement value noise distribution similarity comparison: Use the noise distribution N′ obtained in S3 and the noise distribution N in the fingerprint library to calculate the noise distribution similarity λ5. The calculation formula is as follows:

[0043]

[0044] Where, Q = (N + N') / 2, KL function is the Kullback-Leibler divergence calculation function;

[0045] ⑥Comparison of the impact of actuator disturbance: Calculate the deviation degree λ6=|ΔY using the sensor measurement value impact deviation ΔY′ obtained in S3 and the sensor measurement value impact deviation ΔY in the fingerprint library ′ -ΔY|.

[0046] Further, in S5, a threshold judgment mechanism is adopted for the overall similarity λ1, the noise distribution similarity λ5, and the deviation degree λ6. If one of the following conditions is not met, the object to be detected is judged to be a honeypot:

[0047] λ1<τ1,λ5<τ5,λ6>τ6

[0048] Among them, τ1, τ5, τ6 are thresholds set in advance.

[0049] Further in S5, a one-vote veto mechanism is adopted for the number of semantic conflicts λ2, the number of memory operation failures λ3, and the number of control logic test case execution errors λ4. When any one of λ2, λ3, and λ4 is greater than 0, it is determined that the object to be detected is a honeypot.

[0050] The present invention also provides an industrial controller honeypot identification device based on device memory fingerprint, comprising a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, the above-mentioned industrial controller honeypot identification method based on device memory fingerprint is implemented.

[0051] The present invention also provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the above-mentioned industrial controller honeypot identification method based on device memory fingerprint is implemented.

[0052] The beneficial effects of the present invention are as follows: the present invention first constructs a memory fingerprint library of the target device; then extracts a communication template from the historical network communication traffic of the target device; requests memory features from the object to be detected; sets a memory feature matching mechanism to perform system state memory similarity comparison, system state memory semantic conflict detection, memory operation failure detection, control logic test case execution error detection, sensor measurement value noise distribution similarity comparison, actuator disturbance impact comparison; finally, a threshold judgment mechanism is used for the three types of features based on similarity comparison, and a one-vote veto mechanism is used for the three types of features based on rule adaptation to obtain honeypot identification results. The present invention solves the problem of difficulty in identifying industrial controller honeypots with high memory simulation, optimizes detection resource overhead, and realizes efficient and accurate identification of industrial control honeypots. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A block diagram of an implementation method of an industrial controller honeypot identification method based on device memory fingerprint provided by an exemplary embodiment;

[0054] Figure 2 A honeypot identification platform for verification provided by an exemplary embodiment;

[0055] Figure 3A structural block diagram of an industrial controller honeypot identification device based on device memory fingerprint provided by an exemplary embodiment. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0057] Figure 1 FIG. 1 is a block diagram of an industrial controller honeypot identification method based on device memory fingerprint in an embodiment of the present invention. Figure 1 As shown, the industrial controller honeypot identification method based on device memory fingerprint specifically includes the following steps:

[0058] S1, build the target device memory fingerprint library

[0059] The real industrial controller simulated by the honeypot is used as the target device. The system status memory snapshot, semantic fields in the description file, operation responses of memory data, correct output of control logic test cases, and industrial process history data recorded in the memory are collected to build a memory fingerprint library of the target device for matching. Specifically, it includes:

[0060] Collect the system status memory snapshot M of the target device t , M t Contains e system status records {z1,z2,…,z e};

[0061] Use natural language processing technology to analyze the target device's description file, identify the description containing semantic field location identifiers and semantic content, and extract M t All semantic fields {θ1,θ2,…,θ n};

[0062] Collect the host computer software's methods of creating, reading, overwriting, and deleting the target device's memory data, and record the correct response communication messages and the error response communication messages after the operation is completed;

[0063] Randomly generate control logic test cases containing Boolean operations, four arithmetic operations, and encapsulated mathematical functions. Given the initial input value I, calculate the correct output value O of the control logic test case;

[0064] The noise distribution N of the sensor measurement value Y recorded in the memory of the sample target device;

[0065] A small disturbance ΔU of the actuator output value recorded in the memory of the sampling target device affects the deviation ΔY of the sensor measurement value of its controlled object;

[0066] S2, extract the communication template from the historical network communication flow F of the target device

[0067] The historical network communication flow F is sorted and differentially analyzed by timestamp to obtain the sequence number field and the length field; the function execution records of the upper computer are collected, and the network message group generated by multiple executions of each function is differentially analyzed to obtain the fixed field and the user field; the fixed field, the sequence number field, the length field and the user field are used as the communication template of the function; specifically including:

[0068] Split the historical network traffic F into half according to the packet time series F a and F b (For example, there are 1000 data packets in F, which are sorted as 1, 2, 3, etc. in time series. The data packets sorted 1-500 are divided into F a , sort the packets from 501 to 1000 into F b ), F a Each message in the message is sorted according to the timestamp, and the message sequence is aligned at the same time. The difference analysis is performed on two adjacent messages to search for the fields with changing data values; the field with linearly increasing data values ​​is marked as the sequence number field, and the field with affine consistency between the statistical distribution of the data value and the statistical distribution of the message length is marked as the length field, and the data is collected in F. b After successful verification, the final sequence number field and length field are obtained.

[0069] Collect the function execution records of the host computer {E1, E2, …, E C}, for the host computer specific function E executed p times i , extract p groups of functions E from the historical network traffic F i Generated network message group Each message group contains the execution function E i All q messages of

[0070] In the network message group Intranet Message Perform differential analysis, retain the fixed fields in the message, exclude the length field and sequence number field that have been parsed, mark the remaining fields with changed data values ​​as user fields, and form the target device execution function E i The communication template includes a fixed field, a length field, a sequence number field and a user field;

[0071] And so on, we finally get all the functions {E1, E2, …, E C} respective communication templates;

[0072] S3, request memory features from the object to be detected (usually an unknown device pointed to by an IP address)

[0073] Call the communication template for requesting the target device system status memory snapshot, fill in the system status record number in the user field, fill in the length of the current message in the length field, fill in the sequence number of the current message in the sequence number field, send it to the target device to be detected, and extract the system status memory snapshot from the user field of the response message, denoted as M t ′;

[0074] Call the communication template for the creation, reading, overwriting and deletion of the target device's memory data, send the creation, reading, overwriting and deletion requests for the memory data block, organization block and function block to the object to be detected, and obtain the response message denoted as R sem ;

[0075] Call the communication template downloaded from the control logic test case, fill in the control logic test case in the user field, and send it to the object to be detected; call the communication template that assigns the input variable of the control logic test case, assign the initial input value I to the input, and send it to the object to be detected; call the communication template that reads the output variable of the control logic test case, send it to the object to be detected and read the control logic test case output value O′ from the user field of the response message;

[0076] Calling a communication template for reading a sensor measurement value Y recorded in the memory of the object to be detected, sending the value to the object to be detected, and extracting a noise distribution N′ of the sensor measurement value recorded in the memory of the object to be detected from the user field of the response message;

[0077] Call the communication template that modifies the actuator output value U recorded in the memory of the object to be detected, fill in the actuator output value small disturbance ΔU in the user field, and send it to the object to be detected. Call the communication template that reads the sensor measurement value Y recorded in the memory of the object to be detected again, send it to the object to be detected, and read the sensor measurement value influence deviation ΔY′ from the user field of the response message;

[0078] S4, set up six types of memory feature matching mechanisms, including:

[0079] ① System state memory similarity comparison: From the system state memory snapshot M in the fingerprint library t Extract the system state record z1 from S3 and obtain the system state memory snapshot M from S3 t ′, where z1 and z1′ have the same identifier and the similarity S between z1 and z1′ is z1 The calculation formula is as follows:

[0080]

[0081] Among them, the levenshtein function calculates the edit distance between z1 and z1′, and the max function calculates the maximum byte length of z1 and z1′; the overall similarity λ1 is calculated as follows:

[0082]

[0083] Among them, |e| is the system state memory snapshot M t The total number of system status records in;

[0084] ② System state memory semantic conflict detection: The system state memory snapshot M obtained in S3 t ′ in the semantic field {θ′1,θ′2,…,θ′ n}Do the following tests:

[0085] 1) For a specific semantic field θ′ i , can be modified according to semantic requirements (e.g., to send an "open" request, the semantic field marking the system running needs to be modified to "True");

[0086] 2) If there is an association rule between several semantic fields for a certain state of the object to be detected, the semantic meanings expressed in these semantic fields should be the same (for example, in the "on" state, the semantic field marking the system operation is "True", and the semantic field marking the indicator light state is "green", and the operation "True" and the indicator light "green" are association rules);

[0087] 3) For a specific semantic field θ′ i , its value space should be consistent with the value space of the corresponding semantic field in the fingerprint library;

[0088] Cannot be modified, do not express the same meaning, and are not consistent. That is, if any one of the above conditions 1), 2), and 3) is not met, it is considered a conflict, and λ2 is used to record the number of semantic conflicts.

[0089] ③Memory operation failure detection: Use λ3 to record the response message R obtained in S3 sem The number of error response messages in the

[0090] ④ Error detection of control logic test case execution: compare the control logic test case output value O′ obtained in S3 with the correct output value O stored in the fingerprint library, and use λ4 to record the number of times O≠O′ occurs;

[0091] ⑤Sensor measurement value noise distribution similarity comparison: Use the noise distribution N′ obtained in S3 and the noise distribution N in the fingerprint library to calculate the noise distribution similarity λ5. The calculation formula is as follows:

[0092]

[0093] Where, Q = (N + N') / 2, KL function is the Kullback-Leibler divergence calculation function;

[0094] ⑥Comparison of the influence of actuator disturbance: The deviation degree λ6 is calculated using the sensor measurement value influence deviation ΔY′ obtained in S3 and the sensor measurement value influence deviation ΔY in the fingerprint library. The calculation formula is as follows:

[0095] λ6=|ΔY ′ -ΔY|

[0096] S5, uses a threshold judgment mechanism for the overall similarity λ1, the noise distribution similarity λ5, and the deviation degree λ6. If one of the following conditions is not met, the object to be detected is judged to be a honeypot:

[0097] λ1<τ1,λ5<τ5,λ6>τ6

[0098] Among them, τ1, τ5, τ6 are thresholds set in advance;

[0099] S6, a one-vote veto mechanism is adopted for the number of semantic conflicts λ2, the number of memory operation failures λ3, and the number of control logic test case execution errors λ4. When any one of λ2, λ3, and λ4 is greater than 0, the object to be detected is judged to be a honeypot.

[0100] In the following embodiments, four highly simulated honeypot systems in a real industrial local area network are verified using the honeypot identification method of the present invention. Figure 2 It is a honeypot identification platform built in this embodiment. The honeypot scanner is connected to the industrial intranet through the industrial gateway. The intranet includes Conpot honeypot, HoneyPLC honeypot, ICSpot honeypot and hardware honeypot with industrial process simulation. Table 1 shows the values ​​of memory features in four honeypots identified by the honeypot identification method of the present invention. The memory features that are not identified are not shown in the table. In this embodiment, τ1=0.85, τ2=0, τ3=0, τ4=0, τ5=0.1, τ6=3, which can accurately detect all four honeypot systems.

[0101] Table 1

[0102]

[0103]

[0104] Corresponding to the above-mentioned embodiment of the industrial controller honeypot identification method based on device memory fingerprint, the present invention also provides an embodiment of the industrial controller honeypot identification device based on device memory fingerprint.

[0105] See also Figure 3An industrial controller honeypot identification device based on device memory fingerprint provided by an embodiment of the present invention includes a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement the industrial controller honeypot identification method based on device memory fingerprint in the above embodiment.

[0106] The embodiment of the industrial controller honeypot identification device based on device memory fingerprint of the present invention can be applied to any device with data processing capability, and the device with data processing capability can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capability in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory for execution. From the hardware level, if Figure 3 As shown, it is a hardware structure diagram of any device with data processing capability where the industrial controller honeypot identification device based on device memory fingerprint of the present invention is located, except Figure 3 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in the embodiment of the device may also include other hardware according to the actual function of the device with data processing capabilities, which will not be described in detail. The implementation process of the functions and effects of each unit in the above device is specifically detailed in the implementation process of the corresponding steps in the above method, which will not be described in detail here.

[0107] An embodiment of the present invention further provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the industrial controller honeypot identification method based on device memory fingerprint in the above embodiment is implemented.

[0108] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0109] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0110] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0111] The above description is merely a preferred embodiment of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present specification shall be included in the scope of protection of one or more embodiments of the present specification.

Claims

1. A method for identifying industrial controller honeypots based on device memory fingerprints, characterized in that: include: S1, taking the real industrial controller simulated by the honeypot as the target device, collecting the target device's system status memory snapshot, semantic fields in the description file, operation responses of memory data, correct output of control logic test cases, and industrial process history data recorded in memory, and building the target device memory fingerprint library; S2, sorting and differentially analyzing the historical network communication traffic of the target device by timestamp to obtain the sequence number field and length field; Collect the function execution records of the host computer, perform differential analysis on the network message groups generated by multiple executions of each function, and obtain fixed fields and user fields; use the fixed fields, sequence number fields, length fields and user fields as communication templates for the functions; S3, a communication template that calls a function and requests the corresponding memory features from the object to be detected; S4, set up a memory feature matching mechanism to perform system state memory similarity comparison, system state memory semantic conflict detection, memory operation failure detection, control logic test case execution error detection, sensor measurement value noise distribution similarity comparison, and actuator disturbance impact comparison; S5, using a threshold judgment mechanism to identify honeypots based on the deviation degree obtained by comparing the system state memory similarity, sensor measurement value noise distribution similarity and actuator disturbance influence; S6, uses a one-vote veto mechanism to identify honeypots based on the number of semantic conflicts, the number of memory operation failures, and the number of control logic test case execution errors.

2. The industrial controller honeypot identification method based on device memory fingerprint according to claim 1 is characterized in that: S1 is specifically: Collect the system status memory snapshot M of the target device t , M t Contains e system status records {z1,z2,…,z e }; Use natural language processing technology to analyze the target device's description file, identify the description containing semantic field location identifiers and semantic content, and extract M t All semantic fields {θ1,θ2,…,θ n }; Collect the host computer software's methods of creating, reading, overwriting, and deleting the target device's memory data, and record the correct response communication messages and the error response communication messages after the operation is completed; Randomly generate control logic test cases containing Boolean operations, four arithmetic operations, and encapsulated mathematical functions. Given the initial input value I, calculate the correct output value O of the control logic test case; The noise distribution N of the sensor measurement value Y recorded in the memory of the sample target device; A small disturbance ΔU of the actuator output value recorded in the memory of the sampling target device affects the deviation ΔY of the sensor measurement value of its controlled object.

3. The industrial controller honeypot identification method based on device memory fingerprint according to claim 2 is characterized in that: S2 is specifically: Split the historical network traffic into two halves according to the packet time series F a and F b , F a Each message in the message is sorted according to the timestamp, and the message sequence is aligned at the same time. The difference analysis is performed on two adjacent messages to search for the fields with changing data values; the field with linearly increasing data values ​​is marked as the sequence number field, and the field with affine consistency between the statistical distribution of the data value and the statistical distribution of the message length is marked as the length field, and the data is collected in F. b After successful verification, the final sequence number field and length field are obtained. Collect the function execution records of the host computer {E1, E2, …, E C }, for the host computer specific function E executed p times i , extract p groups of functions E from the historical network traffic F i Generated network message group Each message group contains the execution function E i All q messages of In the network message group Intranet Message Perform differential analysis, retain the fixed fields in the message, exclude the length field and sequence number field that have been parsed, mark the remaining fields with changed data values ​​as user fields, and form the target device execution function E i The communication template includes a fixed field, a length field, a sequence number field and a user field; finally, all functions {E1, E2, …, E C } Respective communication templates.

4. The industrial controller honeypot identification method based on device memory fingerprint according to claim 3 is characterized in that: S3 is specifically: Call the communication template for requesting the target device system status memory snapshot, fill in the system status record number in the user field, fill in the length of the current message in the length field, fill in the sequence number of the current message in the sequence number field, send it to the target device to be detected, and extract the system status memory snapshot from the user field of the response message, denoted as M t ′; Call the communication template for the creation, reading, overwriting and deletion of the target device's memory data, send the creation, reading, overwriting and deletion requests for the memory data block, organization block and function block to the object to be detected, and obtain the response message denoted as R sem ; Call the communication template downloaded from the control logic test case, fill in the control logic test case in the user field, and send it to the object to be detected; call the communication template that assigns the input variable of the control logic test case, assign the initial input value I to the input, and send it to the object to be detected; call the communication template that reads the output variable of the control logic test case, send it to the object to be detected and read the control logic test case output value O′ from the user field of the response message; Calling a communication template for reading a sensor measurement value Y recorded in the memory of the object to be detected, sending the value to the object to be detected, and extracting a noise distribution N′ of the sensor measurement value recorded in the memory of the object to be detected from the user field of the response message; Call the communication template that modifies the actuator output value U recorded in the memory of the object to be detected, fill in the actuator output value small disturbance ΔU in the user field, and send it to the object to be detected. Call the communication template that reads the sensor measurement value Y recorded in the memory of the object to be detected again, send it to the object to be detected and read the sensor measurement value influence deviation ΔY′ from the user field of the response message.

5. The industrial controller honeypot identification method based on device memory fingerprint according to claim 4 is characterized in that: S4 is specifically: ① System state memory similarity comparison: From the system state memory snapshot M in the fingerprint library t Extract the system state record z1 from S3 and obtain the system state memory snapshot M from S3 t ′, where z1 and z1′ have the same identifier and the similarity S between z1 and z1′ is z1 The calculation formula is as follows: Among them, the levenshtein function calculates the edit distance between z1 and z1′, and the max function calculates the maximum byte length of z1 and z1′; the overall similarity λ1 is calculated as follows: Among them, |e| is the system state memory snapshot M t The total number of system status records in; ② System state memory semantic conflict detection: The system state memory snapshot M obtained in S3 t ′ in the semantic field {θ′1, θ′2, ..., θ′ n }Do the following tests: 1) For a specific semantic field θ′ i , can be modified according to semantic requirements; 2) If a state of the object to be detected has an association rule between several semantic fields, the semantic meanings expressed in these semantic fields should be the same; 3) For a specific semantic field θ′ i , its value space should be consistent with the value space of the corresponding semantic field in the fingerprint library; Cannot be modified, do not express the same meaning, and are not consistent. That is, if any one of the above conditions 1), 2), and 3) is not met, it is considered a conflict, and λ2 is used to record the number of semantic conflicts. ③Memory operation failure detection: Use λ3 to record the response message R obtained in S3 sem The number of error response messages in the ④ Error detection of control logic test case execution: compare the control logic test case output value O′ obtained in S3 with the correct output value O stored in the fingerprint library, and use λ4 to record the number of times O≠O′ occurs; ⑤Sensor measurement value noise distribution similarity comparison: Use the noise distribution N′ obtained in S3 and the noise distribution N in the fingerprint library to calculate the noise distribution similarity λ5. The calculation formula is as follows: Where, Q = (N + N') / 2, KL function is the Kullback-Leibler divergence calculation function; ⑥ Comparison of the impact of actuator disturbance: Calculate the deviation degree λ6=|ΔY′-ΔY| using the sensor measurement value impact deviation ΔY′ obtained in S3 and the sensor measurement value impact deviation ΔY in the fingerprint library.

6. The industrial controller honeypot identification method based on device memory fingerprint according to claim 5 is characterized in that: In S5, a threshold judgment mechanism is used for the overall similarity λ1, the noise distribution similarity λ5, and the deviation degree λ6. If one of the following conditions is not met, the object to be detected is judged to be a honeypot: λ1<τ1, λ5<τ5, λ6>τ6 Among them, τ1, τ5, τ6 are thresholds set in advance.

7. The industrial controller honeypot identification method based on device memory fingerprint according to claim 5 is characterized in that: In S5, a one-vote veto mechanism is used for the number of semantic conflicts λ2, the number of memory operation failures λ3, and the number of control logic test case execution errors λ4. When any one of λ2, λ3, and λ4 is greater than 0, the object to be detected is judged to be a honeypot.

8. An industrial controller honeypot identification device based on device memory fingerprint, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the processor executes the executable code, it is used to implement the industrial controller honeypot identification method based on device memory fingerprint as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, it is used to implement the industrial controller honeypot identification method based on device memory fingerprint as described in any one of claims 1 to 7.

Images