Method and system for monitoring flow in industrial control system network based on P4 model

Abstract

The invention provides an industrial control system intra-network flow monitoring method based on a P4 model, and the method comprises the steps: compiling a configuration file for intra-network flow analysis and monitoring through a P4 language according to the communication protocol type and protection requirements of an industrial control system, and transmitting the configuration file to a programmable industrial switch; extracting a key field of the data packet by using an industrial control protocol analyzer, and generating metadata of an embedded counter and register structure; the metadata are input into an assembly line comprising three data processing units including a protocol feature monitoring unit, a sequence feature monitoring unit and a flow feature monitoring unit, and monitoring and interception of a data packet are achieved; re-packaging the unintercepted data packet by using an industrial protocol inverse parser, and forwarding the re-packaged data packet according to the current network load condition; and on the basis of an information feedback mechanism of the industrial switch, updating an intra-network flow monitoring and protection strategy, and recompiling and issuing an analysis and monitoring configuration file. And a flow monitoring and protection strategy can be flexibly customized according to specific requirements of the industrial control system.

Description

Technical Field

[0001] The present invention relates to the field of industrial control technology, and in particular to a method and system for monitoring network flow in an industrial control system based on a P4 model. Background Art

[0002] With the popularization of IoT technology, industrial control systems have become more interconnected and intelligent, however, this has also exposed these systems to a wider range of network threats. Traditional security measures are often difficult to cope with these emerging network attacks, and the P4 model provides a flexible and powerful tool that can monitor network traffic on switches within the network to identify and respond to abnormal behavior, thereby protecting industrial control systems from potential network attacks. In addition, the reliability and stability of industrial control systems are crucial. Any interruption or failure may cause production stagnation and even huge economic losses. The P4 model allows users to define packet processing logic programmatically to achieve precise traffic monitoring and control. This real-time response capability greatly improves the reliability of industrial control systems and reduces downtime and maintenance costs. With the deepening of industrial digital transformation, the dependence of industrial control systems on data will continue to increase. By using the P4 model to implement traffic monitoring, industrial control systems can collect more detailed and accurate network traffic data, providing a reliable foundation for data analysis and optimization. This not only helps to improve the security and stability of the system, but also promotes the development of industrial control systems in the direction of intelligence and data-driven. Summary of the invention

[0003] The technical problem to be solved by the present invention is to overcome the shortcomings of the prior art in realizing automated monitoring and detection, thereby providing a method for monitoring network traffic in an industrial control system based on the P4 model. The present invention targets the technical bottleneck of network traffic monitoring in an industrial control system, can flexibly customize traffic monitoring strategies according to the specific needs of the industrial control system, and realizes distributed monitoring of network traffic on industrial switches through the programmable P4 language, which can not only improve the performance of traffic monitoring in the industrial control system, but also enable the industrial control system to maintain an efficient operating state in a high-traffic environment.

[0004] The technical solution of the present invention to solve the above technical problems is as follows:

[0005] In a first aspect, the present invention provides a method for monitoring network traffic of an industrial control system based on a P4 model, the method comprising the following steps: according to the communication protocol type and protection requirements of the industrial control system, using the P4 language to compile a configuration file for network traffic parsing and monitoring, and sending it to a programmable industrial switch; after the industrial switch receives a data packet, using an industrial control protocol parser to extract key fields of the data packet, and generate metadata of an embedded counter and register structure; inputting the metadata into a pipeline including three data processing units of protocol feature monitoring, sequence feature monitoring, and traffic feature monitoring, to monitor and intercept the data packet; using an industrial protocol reverse parser to repackage the data packets that are not intercepted, and forwarding the repackaged data packets according to the current network load situation; based on the information feedback mechanism of the industrial switch, updating the network traffic monitoring and protection strategy, and recompiling and sending the parsing and monitoring configuration files.

[0006] Optionally, according to the communication protocol type and protection requirements of the industrial control system, a configuration file for network traffic parsing and monitoring is compiled using the P4 language and sent to the programmable industrial switch, including: constructing a data packet parsing tree according to the protocol type and frame structure of the industrial control system, the nodes of the parsing tree represent the structural units of the data packets after being unpacked layer by layer; establishing minimum protection requirements in combination with the industrial control system business, and constructing a traffic monitoring policy table, the table items of the policy table represent the interception rules after the data packets are parsed; using the P4 language to compile the program at the control level, and after generating the configuration file and application program interface, the control level sends the flow table to the programmable industrial switch at the data level.

[0007] Optionally, after receiving a data packet, the industrial switch uses an industrial control protocol parser to extract key fields of the data packet and generates metadata with embedded counters and register structures, including: after the industrial switch completes configuration, the received data packet is input into a buffer to be processed, and different priorities are configured for the data packets according to different types of data packets; the header and payload of the data packet output from the buffer are separated, and key fields are extracted from the header of the data packet using a parser compiled by a data packet parsing tree, wherein the parser can support the unpacking and parsing of the industrial control protocol at the application layer; a metadata structure is generated using the extracted key fields, and multiple counters and registers for storing and calculating intermediate data are embedded in the metadata, and the metadata is grouped and marked according to the data packet sequence identifier.

[0008] Optionally, metadata is input into a pipeline including three data processing units, namely, protocol feature monitoring, sequence feature monitoring, and flow feature monitoring, to achieve monitoring and interception of data packets, including: sending metadata into a matching action table compiled by a flow monitoring strategy table for regular matching, determining a data packet processing flow, and generating a pipeline including three data processing units, namely, protocol feature monitoring, sequence feature monitoring, and flow feature monitoring; inputting metadata into a protocol feature monitoring unit, checking a status flag in the metadata, if the flag is abnormal, discarding the corresponding data packet and terminating the current pipeline process, if the flag is normal, outputting metadata; inputting metadata into a sequence feature monitoring unit, accurately matching a data register value in the metadata with a preset malicious data sequence, if the register value is abnormal, discarding the corresponding data packet and terminating the current pipeline process, if the register value is normal, outputting metadata; inputting metadata into a flow feature monitoring unit, calculating a flow rate and a frequency feature according to the timestamp information in the metadata, if the flow feature is abnormal, opening a redundant pipeline for parallel processing and outputting metadata, if the flow feature is normal, only outputting metadata.

[0009] Optionally, the data processing process of the protocol feature monitoring, sequence feature monitoring, and traffic feature monitoring units includes: extracting operation instructions from the matching action table, reading them into the instruction register in the metadata in sequence, and initializing the program counter in the metadata; searching in the data register of the metadata according to the operands required for the operation instructions, and if the operands do not exist, searching for the corresponding data content in the data packet payload and reading them into the data register; performing calculations or judgment processing based on the operation instructions and operands, and storing the processing results in the data register of the metadata.

[0010] Optionally, an industrial protocol reverse parser is used to re-encapsulate the unintercepted data packets, and the re-encapsulated data packets are forwarded according to the current network load conditions, including: extracting key fields from the metadata after pipeline processing, restoring the data packet header using a reverse parser compiled by the data packet parsing tree, and re-encapsulating it with the original data packet payload; determining the forwarding port of the re-encapsulated data packet based on the proxy forwarding rules and load balancing rules, and inputting the data packet into a buffer to be forwarded; and outputting the data packet from the buffer and sending it to the Industrial Internet according to the different priorities configured for different types of data packets.

[0011] Optionally, based on the information feedback mechanism of the data layer and the information feedback mechanism of the industrial switch, the network traffic monitoring and protection strategy is updated, and the parsing and monitoring configuration files are recompiled and issued, including: the traffic monitoring results in the metadata are stored in the local storage of the industrial switch, and the control layer periodically calls the application program interface to read the monitoring results stored in the switch; based on the statistical information fed back from the data layer, the traffic monitoring strategy is modified at the control layer, and the flow table is recompiled and issued through the P4 language to update the industrial switch configuration.

[0012] In the second aspect, an embodiment of the present invention provides an industrial control system network traffic monitoring and protection system based on the P4 model, including: a program compilation module, used to compile and generate a configuration file for an industrial switch using the P4 language; a data packet parsing module, used to extract key fields from the data packet header and generate metadata; a pipeline processing module, used to perform network traffic monitoring and interception processing on the data packet based on the detection of the metadata content; a data packet inverse parsing module, used to extract key fields from the metadata and re-encapsulate the data packet; a data packet forwarding module, used to route and forward the data packet according to the load balancing situation.

[0013] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method described in the first aspect or any optional implementation manner of the first aspect by executing the computer instructions.

[0014] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method described in the first aspect or any optional implementation manner of the first aspect.

[0015] Compared with the prior art, the present invention can flexibly customize the traffic monitoring strategy according to the specific needs of the industrial control system, and realize distributed monitoring of network traffic on the industrial switch through the programmable P4 language, which can not only improve the performance of traffic monitoring in the industrial control system, but also enable the industrial control system to maintain efficient operation in a high-traffic environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplifications do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0017] Figure 1A flow chart of a method for monitoring network traffic in an industrial control system based on a P4 model provided by an embodiment of the present invention;

[0018] Figure 2 A schematic diagram of the process of pipeline module compilation and data packet sequence processing using the P4 model provided in an embodiment of the present invention;

[0019] Figure 3 A schematic diagram of the structure of a flow monitoring system in an industrial control system network based on a P4 model provided by an embodiment of the present invention;

[0020] Figure 4 A schematic structural diagram of an electronic device provided in another embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the embodiments of the present disclosure will be described in detail below in conjunction with the accompanying drawings. However, it can be understood by those skilled in the art that in each embodiment of the present disclosure, many technical details are proposed in order to enable readers to better understand the present disclosure. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed for protection in the present disclosure can also be implemented. The division of the following embodiments is for the convenience of description and should not constitute any limitation on the specific implementation of the present disclosure. The various embodiments can be combined and referenced with each other without contradiction.

[0022] The embodiment of the present invention provides a method for monitoring network traffic in an industrial control system based on a P4 model. Figure 1 As shown, the method specifically comprises the following steps:

[0023] Step S1: According to the communication protocol type and protection requirements of the industrial control system, the configuration file for network traffic parsing and monitoring is compiled using the P4 language and sent to the programmable industrial switch.

[0024] Specifically, according to the protocol type and frame structure of the industrial control system, a data packet parsing tree is constructed, and the nodes of the parsing tree represent the structural units after the data packet is unpacked layer by layer. In this embodiment, the protocol types of the industrial control system include EtherNet, Modbus, Profibus, CANopen, OPC, etc. Taking the Modbus protocol as an example, the data packet parsing tree can construct at least three-layer branching structure, the first layer is used to parse the Ethernet header, the second layer is used to parse the TCP / IP header, and the third layer is used to parse the Modbus header; in combination with the industrial control system business to establish minimum protection requirements, a flow monitoring strategy table is constructed, and the table items of the strategy table represent the interception rules after the data packet is parsed. In this embodiment, the flow monitoring strategy may include matching rules for protocol types, whitelist addresses, and whitelist ports, detection rules for special fields and flags, and restrictions on register access ranges, etc. The monitoring strategy can be used to filter abnormal data packets; at the control level, the P4 language is used to compile the program, and after generating the configuration file and application program interface, the control level sends the flow table to the programmable industrial switch at the data level.

[0025] Step S2: After receiving the data packet, the industrial switch uses the industrial control protocol parser to extract the key fields of the data packet and generate metadata of the embedded counter and register structure.

[0026] Specifically, combined with Figure 2After the industrial switch completes the configuration, it inputs the received data packets into the buffer to be processed, and configures different priorities for the data packets according to the different types of data packets. In this embodiment, the data packets of real-time communication will be set to a higher priority, the status monitoring data packets will be configured to a medium priority, and the log and statistical data packets will be configured to a low priority; the header and payload of the data packets output from the buffer are separated, and the key fields are extracted from the header of the data packet using the parser compiled by the data packet parsing tree. The parser can support the decapsulation and parsing of the application layer industrial control protocol. In this embodiment, when the Modbus data packet is decapsulated by the parser, Ethernet, TCP / IP, Modbus header key fields, including MAC address, IP address, TCP port, Modbus protocol identifier, Modbus function code, Modbus data field length, etc.; generate a metadata structure using the extracted key fields, and embed multiple counters and registers for storing and calculating intermediate data in the metadata, and group and mark the metadata according to the data packet sequence identifier. In this embodiment, the metadata structure is composed of the key fields, counters, and registers extracted from the data packet. The counters can be used to store direct or offset addresses related to memory addressing, and can also be used to store statistical results of tracking and recording data packets. The registers can be used to store operation instructions, operands, and intermediate numbers related to data packet processing.

[0027] Step S3: Input the metadata into a pipeline including three data processing units: protocol feature monitoring, sequence feature monitoring, and flow feature monitoring, to achieve monitoring and interception of data packets.

[0028] Specifically, combined with Figure 2, send the metadata into the matching action table compiled by the traffic monitoring strategy table for regular matching, determine the data packet processing flow, and generate a pipeline including three data processing units: protocol feature monitoring, sequence feature monitoring, and traffic feature monitoring; input the metadata into the protocol feature monitoring unit, check the status flag in the metadata, if the flag is abnormal, discard the corresponding data packet and terminate the current pipeline process, if the flag is normal, output the metadata. In this embodiment, if an abnormality is detected in the connection flag, control flag, status flag, error flag, etc., it means that the current data packet may be a malicious TCP connection, SYN scan, FIN scan, replay, forgery, etc. At this time, the data packet corresponding to the metadata is filtered; input the metadata into the sequence feature monitoring unit, accurately match the data register value in the metadata with the preset malicious data sequence, if the register value is abnormal If the register value is normal, the corresponding data packet is discarded and the current pipeline process is terminated. If the register value is normal, the metadata is output. In this embodiment, if it is detected that some register values ​​contain known malicious loads or abnormal instructions, it means that the current data packet may be a malicious injection attack or the current data packet has been maliciously tampered with. At this time, the data packet corresponding to the metadata is filtered; the metadata is input into the traffic feature monitoring unit, and the traffic rate and frequency characteristics are calculated according to the timestamp information in the metadata. If the traffic feature is abnormal, the redundant pipeline is started for parallel processing and metadata is output. If the traffic feature is normal, only metadata is output. In this embodiment, if abnormal traffic features such as burst traffic or continuous high-frequency requests are detected, it means that the current network may be attacked by DDoS. In order to avoid the adverse effects of network congestion on the business, the backup pipeline of the switch is started to process data packets in parallel, improve the processing rate, and reduce time delay.

[0029] In this embodiment, the data processing process of the protocol feature monitoring, sequence feature monitoring, and traffic feature monitoring units includes: extracting operation instructions from the matching action table, reading them into the instruction register in the metadata in sequence, and initializing the program counter in the metadata; searching in the data register of the metadata according to the operands required for the operation instructions. If the operands do not exist, searching for the corresponding data content in the data packet payload and reading them into the data register; performing calculations or judgment processing based on the operation instructions and operands, and storing the processing results in the data register of the metadata.

[0030] Step S4: Re-encapsulate the data packets that are not intercepted using the industrial protocol reverse parser, and forward the re-encapsulated data packets according to the current network load conditions.

[0031] Specifically, key fields are extracted from the metadata after pipeline processing, and the data packet header is restored using the reverse parser generated by compiling the data packet parsing tree, and the data packet is repackaged with the original data packet payload. In this embodiment, when the Modbus data packet is repackaged using the reverse parser, all key fields required for the Modbus frame structure are extracted from the metadata, including Ethernet header, TCP / IP header, Modbus header, etc., such as source address, destination address, source port, destination port, protocol identifier, function code, length field, status flag, etc.; based on the proxy forwarding rule and the load balancing rule, the forwarding port of the repackaged data packet is determined, and the data packet is input into the buffer to be forwarded. In this embodiment, the destination address can be calculated using a hash algorithm to distribute the data packets to different physical ports after load balancing; according to the different priorities configured for different types of data packets, the data packet is output from the buffer and sent to the industrial Internet. In this embodiment, according to the data packet priority settings from high to low, the real-time communication data packet, the status monitoring data packet, the log and statistical data packet are forwarded in turn.

[0032] Step S5: Based on the information feedback mechanism at the data level and the information feedback mechanism of the industrial switch, the network traffic monitoring and protection strategy is updated, and the parsing and monitoring configuration files are recompiled and issued.

[0033] Specifically, the traffic monitoring results in the metadata are stored in the local storage of the industrial switch, and the control layer periodically calls the application program interface to read the monitoring results stored in the switch. In this embodiment, the monitoring data stored locally in the switch will be used to evaluate the effectiveness of the current traffic monitoring and protection strategy, and identify potential traffic anomalies or security threats. The control layer periodically reads the data and clears it; based on the statistical information fed back from the data layer, the traffic monitoring strategy is modified at the control layer, and the flow table is recompiled and issued through the P4 language to update the industrial switch configuration. In this embodiment, the control layer analyzes based on the traffic monitoring results, such as which ports or devices have abnormal traffic, which time periods have high traffic peaks, whether there are suspicious duplicate data packets, etc., and adjusts the existing traffic monitoring strategy after making a decision. For example, if the traffic false alarm of a port is high, its monitoring frequency can be adjusted or the alarm threshold can be modified.

[0034] The embodiment of the present invention provides a method for monitoring network traffic in an industrial control system based on the P4 model. The traffic monitoring strategy can be flexibly customized according to the specific needs of the industrial control system, and distributed monitoring of network traffic can be implemented on industrial switches through the programmable P4 language. This method can not only improve the performance of traffic monitoring in the industrial control system, but also enable the industrial control system to maintain an efficient operating state in a high-traffic environment.

[0035] like Figure 3As shown, an embodiment of the present invention provides an in-network traffic monitoring and protection system for an industrial control system based on a P4 model, the system comprising: a program compilation module 310, for compiling and generating a configuration file for an industrial switch using the P4 language; a data packet parsing module 320, for extracting key fields from a data packet header and generating metadata; a pipeline processing module 330, for performing in-network traffic monitoring and interception processing on data packets based on detection of metadata content; a data packet inverse parsing module 340, for extracting key fields from metadata and repackaging data packets; and a data packet forwarding module 350, for routing and forwarding data packets based on load balancing conditions.

[0036] The embodiment of the present invention provides an industrial control system network traffic monitoring and protection system based on the P4 model. The traffic monitoring strategy can be flexibly customized according to the specific needs of the industrial control system, and distributed monitoring of network traffic can be realized on industrial switches through the programmable P4 language. This can not only improve the performance of traffic monitoring in the industrial control system, but also enable the industrial control system to maintain an efficient operating state in a high-traffic environment.

[0037] Another embodiment of the present disclosure relates to an electronic device, such as Figure 4 As shown, including:

[0038] at least one processor 401; and,

[0039] A memory 402 is communicatively connected to at least one processor 401; wherein,

[0040] The memory 402 stores instructions that can be executed by at least one processor 401. The instructions are executed by at least one processor 401 so that the at least one processor 401 can execute the method for monitoring traffic within an industrial control system network based on the P4 model described in the above embodiment.

[0041] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.

[0042] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0043] Another embodiment of the present disclosure relates to a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the method for monitoring network traffic in an industrial control system based on the P4 model as described in the above embodiment.

[0044] That is, those skilled in the art can understand that all or part of the steps in the method described in the above embodiments can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions for making a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0045] Those skilled in the art will appreciate that the above-mentioned embodiments are specific embodiments for implementing the present disclosure, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present disclosure.

Claims

1. A method for monitoring network traffic in an industrial control system based on a P4 model, characterized in that: The method comprises the following steps: According to the communication protocol type and protection requirements of the industrial control system, the configuration file for network traffic analysis and monitoring is compiled using the P4 language and sent to the programmable industrial switch; After receiving the data packet, the industrial switch uses the industrial control protocol parser to extract the key fields of the data packet and generate metadata of the embedded counter and register structure; Inputting the metadata into a pipeline including three data processing units, namely, protocol feature monitoring, sequence feature monitoring, and flow feature monitoring, to achieve monitoring and interception of data packets; Re-encapsulating the data packets that were not intercepted using an industrial protocol reverse parser, and forwarding the re-encapsulated data packets according to the current network load; Based on the information feedback mechanism of industrial switches, update the network traffic monitoring and protection strategy, recompile and distribute the parsing and monitoring configuration files.

2. According to the method for monitoring network traffic in an industrial control system based on the P4 model in claim 1, it is characterized in that: According to the communication protocol type and protection requirements of the industrial control system, the switch configuration file for network traffic analysis and monitoring is compiled and issued using the P4 language, including: According to the protocol type and frame structure of the industrial control system, a data packet parsing tree is constructed; wherein the nodes of the parsing tree represent structural units after the data packet is unpacked layer by layer; Combined with the industrial control system business, the minimum protection requirements are established to construct a traffic monitoring strategy table; wherein the table items of the strategy table represent the interception rules after the data packets are parsed; At the control layer, the P4 language is used to compile the program, generate the configuration file and application program interface, and then the flow table is sent from the control layer to the programmable industrial switch at the data layer.

3. According to the method for monitoring network traffic in an industrial control system based on the P4 model in claim 1, it is characterized in that: After receiving the data packet, the industrial switch uses the industrial control protocol parser to extract the key fields of the data packet and generates metadata of the embedded counter and register structure, including: After the industrial switch is configured, the received data packets are input into a buffer to be processed, and different priorities are configured for the data packets according to different types of data packets; Separating the header and the payload of the data packet outputted from the buffer, and extracting key fields from the header of the data packet using a parser compiled and generated by the data packet parsing tree, wherein the parser can support the decapsulation and parsing of the industrial control protocol at the application layer; A metadata structure is generated using the extracted key fields, and a plurality of counters and registers for storing and calculating intermediate data are embedded in the metadata, and the metadata is grouped and marked according to a data packet sequence identifier.

4. A method for monitoring network traffic in an industrial control system based on a P4 model according to any one of claims 1 to 3, characterized in that: The metadata is input into a pipeline including three data processing units of protocol feature monitoring, sequence feature monitoring, and flow feature monitoring to realize monitoring and interception of data packets, including: Send the metadata to the matching action table compiled by the traffic monitoring strategy table for regular matching, determine the data packet processing flow, and generate a pipeline including three data processing units: protocol feature monitoring, sequence feature monitoring, and traffic feature monitoring; Input the metadata into the protocol feature monitoring unit, check the status flag in the metadata, if the flag is abnormal, discard the corresponding data packet and terminate the current pipeline process, if the flag is normal, output the metadata; Input the metadata into a sequence feature monitoring unit, accurately match the data register value in the metadata with a preset malicious data sequence, and if the register value is abnormal, discard the corresponding data packet and terminate the current pipeline process; if the register value is normal, output the metadata; The metadata is input into the traffic feature monitoring unit, and the traffic rate and frequency characteristics are calculated according to the timestamp information in the metadata. If the traffic characteristics are abnormal, the redundant pipeline is started for parallel processing and metadata output. If the traffic characteristics are normal, only the metadata is output.

5. The method for monitoring network traffic in an industrial control system based on a P4 model according to claim 4, characterized in that: The data processing process of the protocol feature monitoring, sequence feature monitoring, and flow feature monitoring units includes: Extract operation instructions from the matching action table, read them into the instruction register in the metadata in order, and initialize the program counter in the metadata; Searching in the data register of the metadata according to the operand required by the operation instruction, if the operand does not exist, searching for the corresponding data content from the data packet payload and reading it into the data register; Perform calculation or judgment processing based on the operation instruction and operands, and store the processing results in the data register of the metadata.

6. A method for monitoring network traffic in an industrial control system based on a P4 model according to any one of claims 1 to 3, characterized in that: The method of repackaging the unintercepted data packets by using the industrial protocol reverse parser and forwarding the repackaging data packets according to the current network load condition includes: Extract key fields from the metadata after pipeline processing, use the inverse parser compiled from the packet parse tree to restore the packet header, and re-encapsulate it with the original packet payload; Based on the proxy forwarding rule and the load balancing rule, determine the forwarding port of the repackaged data packet, and input the data packet into the buffer to be forwarded; According to different priorities configured for different types of data packets, the data packets are output to the buffer and sent to the industrial Internet.

7. A method for monitoring network traffic in an industrial control system based on a P4 model according to any one of claims 1 to 3, characterized in that: The information feedback mechanism based on the industrial switch updates the network traffic monitoring and protection strategy, recompiles and sends the parsing and monitoring configuration files, including: The traffic monitoring results in the metadata are stored in the local storage of the industrial switch, and the control layer periodically calls the application program interface to read the monitoring results stored in the switch; Based on the statistical information fed back from the data layer, the traffic monitoring and protection strategy is modified at the control layer, and the flow table is recompiled and issued through the P4 language to update the industrial switch configuration.

8. A P4 model-based industrial control system network traffic monitoring and protection system, characterized in that: The system comprises: Program compilation module, used to compile and generate configuration files of industrial switches using P4 language; A data packet parsing module, used to extract key fields from the data packet header and generate metadata; A pipeline processing module, used to perform network traffic monitoring and interception processing on data packets based on the detection of metadata content; The packet reverse parsing module is used to extract key fields from metadata and repackage the packet; The data packet forwarding module is used to route and forward data packets according to the load balancing situation.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for monitoring network traffic in an industrial control system based on the P4 model as described in any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method for monitoring network traffic in an industrial control system based on the P4 model as described in any one of claims 1 to 7.

Images