Data processing method and device and electronic equipment

Abstract

The embodiment of the invention discloses a data processing method and device and electronic equipment, and relates to the technical field of computers. The method comprises the following steps: acquiring a data packet which is sent by external equipment to industrial control equipment and identifies that the external equipment requests to establish data connection with a target operation component in the industrial control equipment; analyzing communication parameters of the data packet, if the data packet is a suspicious data packet, controlling a virtual operation component constructed based on an operation function of the target operation component to establish data connection with external equipment, and obtaining interaction log information of the virtual operation component and the external equipment; if the data packet is a non-suspicious data packet, controlling the target operation component to establish data connection with external equipment; if the interaction log information indicates that the suspicious data packet is an attack data packet, repairing the target running component according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not the attack data packet, controlling the target operation component to establish data connection with external equipment; and the safety protection of the industrial control equipment is realized.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a data processing method, a data processing device, an electronic device, and a storage medium. Background Art

[0002] In the field of industrial control, industrial control devices in industrial control systems usually establish data connections with external devices through their communication interfaces [for example, network ports, serial ports, or USB (Universal Serial Bus) interfaces, etc.] and exchange data with external devices.

[0003] Similarly, external devices may also attack industrial control devices through their communication interfaces, threatening the data security of industrial control devices and even the entire industrial control system. In view of this, it is urgent to propose a data processing method to protect industrial control devices and prevent external devices from attacking them. Summary of the invention

[0004] The embodiment of the present disclosure provides a data processing method to solve the problem in the related art that external devices are prone to attack industrial control devices.

[0005] Correspondingly, the embodiments of the present disclosure also provide a data processing device, an electronic device and a storage medium to ensure the implementation and application of the above method.

[0006] In one aspect, an embodiment of the present disclosure provides a data processing method, the data processing method comprising: Acquire a data packet sent by an external device to an industrial control device; wherein the data packet is used to identify: the external device requests to establish a data connection with a target operating component in the industrial control device; Analyze the communication parameters of the data packet to determine whether the data packet is a suspicious data packet; If the data packet is a suspicious data packet, control the virtual operation component to establish a data connection with the external device, and obtain the interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, control the target operation component to establish a data connection with the external device; If the interaction log information indicates that the suspicious data packet is an attack data packet, the target running component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target running component is controlled to establish a data connection with an external device.

[0007] On the other hand, an embodiment of the present disclosure provides a data processing device, the data processing device comprising: The data packet acquisition module is used to acquire the data packet sent by the external device to the industrial control device; wherein the data packet is used to identify: the external device requests to establish a data connection with the target operating component in the industrial control device; A data packet analysis module, used to analyze the communication parameters of the data packet and determine whether the data packet is a suspicious data packet; If the data packet is a suspicious data packet, control the virtual operation component to establish a data connection with the external device, and obtain the interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, control the target operation component to establish a data connection with the external device; If the interaction log information indicates that the suspicious data packet is an attack data packet, the target running component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target running component is controlled to establish a data connection with an external device.

[0008] On the other hand, an embodiment of the present disclosure provides an electronic device, including a processor and a memory, wherein the processor and the memory are connected to each other; The memory is used to store computer programs; The above-mentioned processor is configured to execute the data processing method provided by the embodiment of the present disclosure when calling the above-mentioned computer program.

[0009] On the other hand, an embodiment of the present disclosure provides a computer-readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the data processing method provided by the embodiment of the present disclosure.

[0010] On the other hand, an embodiment of the present disclosure provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the data processing method provided by the embodiment of the present disclosure is implemented.

[0011] In the embodiment of the present disclosure, after obtaining a data packet sent by an external device to an industrial control device for requesting to establish a data connection with a target operating component in the industrial control device, the communication parameters of the data packet are parsed to determine whether the data packet is a suspicious data packet; in this way, it is possible to preliminarily determine whether the external device will attack the target operating component by establishing a data connection with the target operating component, thereby improving the operating security of the target operating component.

[0012] Furthermore, when the data packet is a non-suspicious data packet, the target operating component is controlled to establish a data connection with an external device; when the data packet is a suspicious data packet, the virtual operating component built based on the operating function of the target operating component is controlled to establish a data connection with the external device; in this way, it is possible to avoid directly establishing a data connection between the target operating component and an external device that may cause an attack on the target operating component, thereby improving the operating security of the target operating component.

[0013] Furthermore, after controlling the virtual operation component to establish a data connection with the external device, the interaction log information between the virtual operation component and the external device is obtained; when the interaction log information indicates that the suspicious data packet is an attack data packet, the target operation component is repaired according to the interaction log information; when the interaction log information indicates that the suspicious data packet is not an attack data packet, the target operation component is controlled to establish a data connection with the external device; in this way, by further determining whether the suspicious data packet is an attack data packet based on the interaction log information between the virtual operation component and the external device, it is possible to further determine whether the external device will attack the target operation component by establishing a data connection with the target operation component, and when it is determined that the external device will not attack the target operation component by establishing a data connection with the target operation component (that is, the suspicious data packet is not an attack data packet). In addition, by repairing the target operation component according to the interaction log information, the repaired target operation component can resist attacks generated by external devices, improve the operation security of the repaired target operation component, avoid external devices from causing the same attack on the target operation component, and realize security protection of industrial control equipment from the granularity of the operation components of industrial control equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings of the embodiments will be briefly described below. It should be noted that the drawings described below only relate to some embodiments of the present invention, but are not intended to limit the present invention, wherein: In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0015] Figure 1 A schematic diagram showing a flow chart of a data processing method provided by an embodiment of the present disclosure is shown; Figure 2 A schematic diagram of an architecture for implementing a data processing method provided by an embodiment of the present disclosure is shown; Figure 3A schematic diagram showing the structure of a data processing device provided by an embodiment of the present disclosure is shown; Figure 4 A schematic structural diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0017] In the relevant technologies, the information security threats of industrial control systems mainly include: external network security threats and internal terminal security threats. External network security threats are mainly reflected in: attackers (for example, external devices that are connected to the industrial control system for data) illegally enter the control network to access system resources without system authorization, such as tampering with control instructions, spreading viruses, and forging status information, which may interfere with the normal communication of the control channel and cause system paralysis; internal terminal security threats are mainly reflected in: malicious programs are implanted into software systems with open platform architectures. Traditional malicious code detection technology can only detect abnormal conditions that occur during the execution of software, and cannot effectively verify the security of the software itself. Once the malicious code hidden in the system firmware program is remotely activated by the attacker, it may lead to serious consequences such as the theft and deletion of system confidential information, or even system damage.

[0018] In the related technology, a security protection technology system based on trusted computing has been formed, mainly based on secure startup, data encryption, integrity measurement, and software trusted attribute verification. However, if trusted computing is used alone as a security protection means, it cannot guarantee that the program is still in a safe and trusted state during the running stage. With the increase in system applications, the measurement of multiple programs will also increase the system performance overhead. In view of this, the embodiment of the present disclosure proposes a data processing method to further improve the security of industrial control systems.

[0019] Figure 1 A flowchart of a data processing method provided by an embodiment of the present disclosure is shown. Figure 1 , the data processing method comprises: Step S10, obtaining a data packet sent by an external device to the industrial control device; wherein the data packet is used to identify: the external device requests to establish a data connection with a target operating component in the industrial control device.

[0020] Optionally, the data processing method provided in the embodiment of the present disclosure may be implemented by a data processing device. Optionally, the data processing device may be a device in an industrial control system.

[0021] Optionally, the data processing device may be a terminal or server with data control capability, or a processor, which is not limited in the embodiments of the present disclosure. When the data processing device is a processor, the data processing method may be implemented by the processor calling computer-readable instructions stored in a memory.

[0022] When the data processing device is a terminal, the terminal (also referred to as a user terminal or user equipment (UE)) may be a smart sensor, a PLC, an RTU, an industrial computer, a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.

[0023] When the data processing device is a server, the server may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server or server cluster that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. For example, an independent physical server may specifically be an industrial server.

[0024] Those skilled in the art should understand that the above-mentioned terminals and servers are only examples, and other existing or future terminals or servers that are applicable to the present disclosure should also be included in the protection scope of the present disclosure and are included here by reference.

[0025] Since the operation security of the target operation component is improved when the data processing method provided by the embodiment of the present disclosure is executed by the data processing device, and attacks on the target operation component by external devices are avoided, the security protection of the industrial control equipment is achieved at the granularity of the operation components of the industrial control equipment. In the embodiment of the present disclosure, the data processing device can also be called a security protection device.

[0026] Optionally, the industrial control system may also include industrial control equipment (also referred to as industrial control terminals, and the name of the equipment is not limited in the embodiments of the present disclosure). Specifically, the industrial control equipment can be any device in the industrial control system that can perform control operations to drive the industrial equipment to perform operations.

[0027] The embodiments of the present disclosure do not limit the specific implementation method of the industrial control device. For example, the industrial control device may include but is not limited to at least one of the following: a CNC machine tool, a programmable logic controller (PLC), an industrial control host, a measuring device for performing any industrial control operation, a simulation device for performing any industrial control operation, and an intelligent sensor for performing any industrial control operation.

[0028] Optionally, the industrial control device may include one or more operating components, wherein the target operating component may be one or more of the operating components included in the industrial control device.

[0029] For each running component, the communication parameters of the running component may include parameters related to communication with the running component, for example, may include but are not limited to at least one of the IP (Internet Protocol) address information of the running component, MAC (Medium / Media Access Control, media access control address, an address used to confirm the location of a network device) address information, the port number of the communication interface / communication port, the communication protocol adopted by the running component, etc.

[0030] Optionally, the external device may be a device that exchanges data with any device in the industrial control system, and the embodiments of the present disclosure are not limited to this. For example, the external device may be a switch (specifically, an industrial switch) or other information exchange devices. Optionally, the number of external devices may include one or more, and the embodiments of the present disclosure are described by taking the number of external devices including one as an example.

[0031] Optionally, a device may be referred to as an internal device or an external device according to its relationship with the industrial control system. For example, when a device is disposed inside the industrial control system, the device is referred to as an internal device; or, when a device is disposed outside the industrial control system, the device is referred to as an external device.

[0032] In the specific implementation process, the industrial control equipment and the data processing device are the equipment set inside the industrial control system, and the external equipment is the equipment set outside the industrial control system. Among them, the external equipment can be the equipment that needs to establish a connection with the industrial control terminal.

[0033] Optionally, the industrial control device can be monitored through probes pre-set in the data processing device to determine whether an external device sends a data packet to the industrial control device. If an external device is detected sending a data packet to the industrial control device, the data packet is saved for further analysis.

[0034] Optionally, a traffic redirection component in the data processing device may be controlled to send the data packet to the data processing control, and the data packet may be parsed by the data processing control.

[0035] Step S20, analyzing the communication parameters of the data packet to determine whether the data packet is a suspicious data packet; If the data packet is a suspicious data packet, control the virtual operation component to establish a data connection with the external device, and obtain the interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, control the target operation component to establish a data connection with the external device; If the interaction log information indicates that the suspicious data packet is an attack data packet, the target running component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target running component is controlled to establish a data connection with an external device.

[0036] Optionally, the communication parameters of the data packet may include at least one of a source IP address, a destination IP address, a port number, a transmission protocol, and a data load.

[0037] Optionally, suspicious data packets, i.e., data packets that may cause attacks to target running components.

[0038] Optionally, the communication parameters associated with the destination end in the communication parameters of the data packet can be compared with the communication parameters of the target running component. If the two are consistent, the data packet is determined to be a non-suspicious data packet; if the two are inconsistent, the data packet is determined to be a suspicious data packet.

[0039] For example, when the target IP address of the data packet is the same as the IP address of the target running component, and the port number of the data packet is the same as the port number of the communication interface / communication port of the target running component, and the transmission protocol of the data packet is the same as the communication protocol adopted by the target running component, the data packet is determined to be a non-suspicious data packet. When the target IP address of the data packet is different from the IP address of the target running component, or the port number of the data packet is different from the port number of the communication interface / communication port of the target running component, or the transmission protocol of the data packet is different from the communication protocol adopted by the target running component, the data packet is determined to be a suspicious data packet.

[0040] Optionally, a virtual operation component corresponding to the operation function of each operation component in the industrial control device can be constructed in advance, that is, the virtual operation component can realize the operation function of the corresponding operation component. Optionally, the device composed of each virtual operation component can also be called a virtual industrial control device.

[0041] Optionally, by analyzing the interaction log information, information sent by the external device to the virtual operation component can be obtained, thereby determining whether the external device attacks the virtual operation component, and the specific attack content of the external device on the virtual operation component (for example, attack method, attack range, attack time, etc.).

[0042] It is understandable that, in the case where it is determined that the external device attacks the virtual operation component, that is, the suspicious data packet is an attack data packet, the names of the suspicious data packet and the attack data packet can be interchangeable.

[0043] When it is determined that the external device has attacked the virtual operating component, it can be determined that the external device has established a data connection with the target operating component to further attack the target operating component, that is, the above-mentioned data packet is an attack data packet; when it is determined that the external device has not attacked the virtual operating component, it can be determined that the external device has established a data connection with the target operating component to conduct normal data exchange with the target operating component, that is, the above-mentioned data packet is not an attack data packet.

[0044] When it is determined that the above data packet is an attack data packet, the target operation component can be repaired according to the attack content of the external device on the virtual operation component, so that the repaired target operation component can resist the attack generated by the external device.

[0045] In the disclosed embodiment, by parsing the communication parameters of the data packet to determine whether the data packet is a suspicious data packet, it is possible to preliminarily determine whether the external device will attack the target running component by establishing a data connection with the target running component, thereby improving the operating security of the target running component.

[0046] Furthermore, in the case that the data packet is a suspicious data packet, the virtual operating component constructed based on the operating function of the target operating component is controlled to establish a data connection with an external device, thereby avoiding directly establishing a data connection between the target operating component and an external device that may cause an attack on the target operating component, thereby improving the operating security of the target operating component.

[0047] Furthermore, by further determining whether a suspicious data packet is an attack data packet based on the interaction log information between the virtual operation component and the external device, it is possible to further determine whether the external device will attack the target operation component by establishing a data connection with the target operation component, and determine that the external device will not attack the target operation component by establishing a data connection with the target operation component (i.e., the suspicious data packet is not an attack data packet). In addition, by repairing the target operation component according to the interaction log information, the repaired target operation component can resist attacks generated by external devices, improve the operation security of the repaired target operation component, avoid external devices from causing the same attack on the target operation component, and realize security protection of industrial control equipment from the granularity of the operation components of industrial control equipment.

[0048] In a possible implementation, the determining whether the data packet is a suspicious data packet includes: If the preset reference communication parameters do not include the above communication parameters, the above data packet is determined to be a suspicious data packet; wherein the above reference communication parameters are generated based on the communication parameters of the historical data packets interacting with the above industrial control device; the above communication parameters include at least one of the source Internet Protocol IP address, the target IP address, the port number, the transmission protocol, and the data load; If the reference communication parameters include at least one of the communication parameters, it is determined that the data packet is not a suspicious data packet.

[0049] Optionally, the communication parameters of the data packet may further include flow and behavior.

[0050] Optionally, data packets of external devices that have interacted with industrial control devices (i.e., historical data packets) can be parsed to determine a normal network behavior baseline (including normal data traffic, access patterns, user behavior, etc.), and communication parameters of the historical data packets can be obtained by analyzing historical data packets and network audit records. After deduplication of the communication parameters of the historical data packets, reference communication parameters can be obtained.

[0051] Optionally, the communication parameters of the data packet may be compared with reference communication parameters through machine learning or pattern recognition algorithms to determine whether the data packet is a suspicious data packet and distinguish normal behavior from potential attack behavior. The embodiments of the present disclosure are not limited to this.

[0052] Optionally, known threat intelligence information, such as the attacker's IP address range, attack tools and methods, can be integrated to identify possible attack behaviors. When the communication parameters of a data packet are consistent with the communication parameters in the threat intelligence information, the data packet is determined to be a suspicious data packet.

[0053] Optionally, a trust model can be established based on the historical behavior of users, devices and networks. Based on the trust model, the communication parameters of the data packet are given a trust score. Data packets with lower scores are more likely to be initiated by attackers, that is, the data packets are suspicious data packets.

[0054] In the disclosed embodiment, by comparing the communication parameters of a data packet with reference communication parameters, it can be determined whether the data packet is a suspicious data packet, thus paving the way for preliminarily determining whether an external device will attack the target running component by establishing a data connection with the target running component.

[0055] In a possible implementation, the controlling virtual operation component establishes a data connection with the external device, including: According to the communication parameters, configuration information for interaction between the external device and the virtual operation component is determined; wherein the configuration information includes at least one of a virtual topology structure and virtual configuration information; the virtual topology structure is constructed based on path information for establishing a data connection between the target operation component and the external device; the virtual configuration information includes configuration information after modifying the network configuration information of the virtual operation component according to the communication parameters; Run the above configuration information to control the above virtual operation component to establish a data connection with the above external device.

[0056] Optionally, when the target running component establishes a data connection with an external device, it can establish a data connection with the external device directly, or it can establish a data connection with the external device through one or more other running components. The specific method can be determined based on actual conditions, and the embodiments of the present disclosure are not limited to this.

[0057] Optionally, the path information for the target running component to establish a data connection with the external device may include but is not limited to at least one of the component information of other running components in the path for the target running component to establish a data connection with the external device, the connection order between the running components in the path, etc.

[0058] Optionally, the virtual topology structure may include a component topology structure formed by connecting the above-mentioned virtual running component (for ease of distinction, it may also be referred to as the first virtual running component hereinafter) and the second virtual running component corresponding to other running components in the above-mentioned path according to the connection order between the running components in the above-mentioned path.

[0059] In the actual processing process, the virtual topology structure may also include a third virtual operation component associated with the data exchange operation during the process of the virtual operation component exchanging data with the external device, and a path for the third virtual operation component to exchange data with the first virtual operation component and the second virtual operation component.

[0060] Optionally, virtual configuration information, i.e., forged data, vulnerabilities, or resources that appear to be valuable to external devices, can modify network configuration information of the virtual operation component based on communication parameters of the data packet so that the virtual operation component can establish configuration information for connection with the external device.

[0061] During the actual processing process, the virtual configuration information may also include but is not limited to modifying the network configuration information of the second virtual operation component and the third virtual operation component according to the communication parameters of the data packet so that the virtual operation component can establish a connection with an external device. The embodiment of the present disclosure does not make specific limitations on this.

[0062] In the disclosed embodiment, by determining configuration information for the interaction between the external device and the virtual operation component according to the communication parameters of the data packet and executing the configuration information, the virtual operation component can be controlled to establish a data connection with the external device.

[0063] In a possible implementation, the method further includes: Determine the status information of the virtual operation component according to the interaction log information; wherein the status information includes any one of normal operation, stopped operation, or abnormal operation; If the above-mentioned state information is stopped running or running abnormally, it is determined that the above-mentioned suspicious data packet is an attack data packet; If the above status information indicates normal operation, it is determined that the above suspicious data packet is not an attack data packet.

[0064] In the embodiments of the present disclosure, when the status information of the virtual operation component is that it has stopped running or is running abnormally, it can be determined that the virtual operation component itself may have a vulnerability or that the virtual operation component has been attacked by an external device. In this case, the suspicious data packet is determined to be an attack data packet, and the target operation component is further repaired based on the interaction log information. For example, when it is determined through the interaction log information that the virtual operation component itself has a vulnerability, the vulnerability of the target operation component itself is repaired; when it is determined through the interaction log information that the virtual operation component has been attacked by an external device, further security protection measures are taken for the target operation component, so that the repaired target operation component can avoid attacks initiated by external devices that are similar to the attack behaviors caused to the virtual operation component.

[0065] Optionally, the above data processing method can also be applied to the test process of the target running component. Correspondingly, the status information of the virtual running component can include any one of normal completion of the test command, stop of operation, or abnormal operation.

[0066] Among them, the specific method of determining whether the suspicious data packet initiated by the external device during the test is an attack data packet can be referred to above. Specifically, if the status information of the virtual operation component is stopped or abnormal operation, the suspicious data packet is determined to be an attack data packet; if the status information of the virtual operation component is that the test command is completed normally, the above suspicious data packet is determined to be an attack data packet. In the case of determining that the suspicious data packet is an attack data packet, the operation function of the target operation component can be improved according to the specific interaction log information.

[0067] In a possible implementation, repairing the target running component according to the interaction log information includes: Determine attack information of the external device against the virtual running component according to the interaction log information; The attack information includes at least one of attack time information, attack trajectory information, attack location information, attack range, attack tool, information written to the virtual operation component by the external device, and information read from the virtual operation component by the external device; According to the above attack information, the above target running components are repaired.

[0068] Optionally, the attack time information may include but is not limited to: the attack start time (i.e., the time when the data packet is received), the attack end time (i.e., the time when the data packet stops being received and the time when the virtual running component stops running), and the attack duration (i.e., the duration from the attack start time to the attack end time).

[0069] The attack trajectory information may include, but is not limited to: a path consisting of virtual operation components of data exchange operations in the virtual industrial operation equipment within the attack duration.

[0070] In the embodiments of the present disclosure, by analyzing the interaction log information, different types of attack information of external devices against virtual running components are obtained, a profile of the attack information is achieved, and targeted repairs are performed on the target running components according to the different types of attack information. This can improve the repair efficiency of the target running components and simplify the repair process of the target running components.

[0071] Optionally, in some embodiments, the target operation component itself may have defects (for example, the target operation component has a vulnerability). In the process of interaction between the external device and the virtual operation component, the virtual operation component may also stop running or run abnormally when the external device does not attack the virtual operation component. By further parsing the interaction log information, it is possible to further determine the cause of the virtual operation component stopping running or running abnormally, whether the external device attacks the virtual operation component or the target operation component itself has defects. In the embodiment of the present application, no matter what the reason is, the parsing result of the interaction log information can be determined as attack information.

[0072] In a possible implementation, the repairing of the target running component includes at least one of the following: Update or upgrade the operating procedures of the above target operating components; Modify the configuration parameters of the above target running components; Adding a security layer for the above target running components; wherein the above security layer includes a firewall and an intrusion detection system; Modifying the communication parameters of the data packet associated with the target operating component; Encrypting or signing data packets associated with the above-mentioned target running components; Add a timestamp or sequence number to the data packets associated with the above target running component.

[0073] Optionally, when the attack information indicates that there is a vulnerability in the virtual operation component, the target operation component is updated or upgraded according to parameter information of the vulnerability.

[0074] Optionally, when the attack information indicates that there is an error in the configuration parameters of the virtual operation component, the configuration parameters of the target operation component may be modified.

[0075] Optionally, when the attack information indicates that the virtual operation component cannot protect against attacks from external devices, a security layer for the target operation component can be added, the communication parameters of the data packet associated with the target operation component can be modified, the data packet associated with the target operation component can be encrypted or signed, or a timestamp or serial number can be added to the data packet associated with the target operation component. Among them, by modifying the communication parameters of the data packet associated with the target operation component (to mark the data packet as a monitored or forged data packet), encrypting or signing the data packet associated with the target operation component (to ensure the integrity and authentication of the data), or adding a timestamp or serial number to the data packet associated with the target operation component (to track the transmission path and time of the data packet), it can be determined whether the data packet will cause an attack on the target operation component by parsing the data packet associated with the target operation component.

[0076] Optionally, when modifying the communication parameters of a data packet associated with a target running component, it may include but is not limited to at least one of the following: modifying the target IP address of the data packet; modifying the port number of the data packet; expanding the fields in the communication protocol used by the data packet (to accommodate additional information, such as a traceability identifier or an attack inducement tag).

[0077] Optionally, before a data packet associated with a target operation component is sent through the target operation component, the data packet may be encrypted or signed, or a timestamp or a serial number may be added to the data packet.

[0078] As an example, taking the S7 protocol adopted by the target running component as an example, the repair process is as follows: Rule 1: All S7 packets passing through a monitoring point (such as a gateway or switch) need to have a specific tag field added to identify the packet as being monitored and analyzed.

[0079] Rule 2: If an abnormal S7 packet is detected, the system will automatically modify the destination address of the packet and redirect it to a disguised S7 server in order to collect further behavior of the attacker.

[0080] Rule 3: During a specific tracing analysis phase, the system will tamper with certain information in the data packet, such as returning incorrect device status or configuration parameters, to lure the attacker into further interaction.

[0081] Rule 4: All S7 data packets processed by the system need to be digitally signed to ensure the integrity of the data packets and that they have not been tampered with.

[0082] In the disclosed embodiment, by repairing the target running component in a targeted manner according to different types of attack information, the efficiency of repairing the target running component can be improved.

[0083] In a possible implementation, the virtual running component is constructed based on the running function of the target running component by at least one of the following methods: Simulate the traffic patterns of the above target operating components; Simulate the communication parameters of the above target operating components; Simulate the operating parameter information of the above target running components.

[0084] Optionally, the traffic pattern of the target running component may include, but is not limited to: at least one of periodically sending data packets, periodically sending data requests, and performing traffic transmission delay.

[0085] Optionally, the communication parameters of the simulation target running component may include, but are not limited to: at least one of an IP address, a port number, and a transmission protocol of the simulation target running component.

[0086] As an example, the invalid IP address of the target running component is used as the IP address of the virtual running component, and an IP address similar to the valid IP address of the target running component is used as the IP address of the virtual running component to prevent external devices from obtaining the real IP address of the target running component.

[0087] Optionally, the operating parameter information of the simulated target operating component may include, but is not limited to: delaying response to data packets sent by external devices, exposing vulnerabilities of virtual operating components, weakening encryption algorithms for data packets sent by virtual operating components, and providing authorization information to external devices, so as to further induce the external device to interact with the virtual operating component.

[0088] It should be noted that the above construction method is only an example, but the embodiments of the present disclosure may also cover other methods of constructing virtual running components according to the running functions of the target running components, which will not be elaborated here.

[0089] Optionally, when constructing a virtual running component based on the running function of the target running component, the following characteristics need to be considered: Controllability: This means ensuring that these false vulnerabilities can be fully controlled and managed to ensure that they do not become real security threats.

[0090] Monitoring and recording: This means that the interaction of virtual running components can be monitored and recorded in detail to facilitate source tracing analysis after an attack occurs.

[0091] Regular updates: As attack techniques evolve, the vulnerabilities in the disguised components need to be regularly updated and adjusted to maintain their effectiveness.

[0092] Coordination with other security measures: that is, by building virtual operating components, it may be part of the security strategy of the industrial control system. It needs to be closely combined with other security measures (such as firewalls (specifically industrial firewalls), intrusion detection systems (specifically industrial control intrusion detection systems), etc.) to form a powerful defense system.

[0093] In the embodiments of the present disclosure, a virtual operating component is constructed based on the operating function of the target operating component, and the vulnerabilities in the virtual operating component are set in a targeted manner. In this way, during the interaction between the virtual operating component and the external device, the deception of the virtual operating component to potential attackers can be enhanced, and the external device can be induced to have a deeper data interaction with the virtual operating component, thereby obtaining more information about the external device, paving the way for subsequent repairs to the target operating component, thereby improving the efficiency and accuracy of the traceability processing.

[0094] In order to illustrate the data processing method provided by the embodiment of the present disclosure, the following Figure 2 The data processing device shown illustrates the process of implementing the data processing method by combining different modules of the data processing device: See also Figure 2 The data processing device may include three parts: a probe 21 (wherein the number of the probe 21 may include one or more), a camouflage component 22 and a management center 23.

[0095] Among them, the probe 21 is used to collect data and traffic, parse the communication parameters of the data packet, determine whether the data packet is a suspicious data packet, and redirect the suspicious data packet, that is, to obtain the data packet sent by the external device to the industrial control device, parse the communication parameters of the data packet, and determine whether the data packet is a suspicious data packet.

[0096] The disguise component 22 is used to construct a virtual bait to lure the external device to interact with the virtual operation component, that is, to control the virtual operation component to establish a data connection with the external device and obtain the interaction log information between the virtual operation component and the external device.

[0097] The management center 23 is used to direct suspicious data packets to specific virtual operation components, check the intrusion status of external devices, and take processing measures. That is, if the interaction log information indicates that the suspicious data packet is an attack data packet, the target operation component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target operation component is controlled to establish a data connection with the external device.

[0098] Specifically, the probe 21 may include a network monitoring module 211 and a traffic redirection module 212. The camouflage component 22 may include a traffic receiving component 221, a traffic analysis component 222, a traffic redirection component 223, a log recording component 224, and a response simulation component 225. The management center 23 may include an event monitoring module 231, an event analysis module 232, a source tracing module 233, an emergency response module 234, a threat log module 235, a virtual management module 236, a probe management module 237, a user management module 238, a network management module 239, a system configuration module 240, and a system information module 241.

[0099] Specifically, in the probe 21, the network monitoring module 211 is used to collect data and traffic, and the traffic redirection module 212 is used to parse the communication parameters of the data packet, determine whether the data packet is a suspicious data packet, and direct the data packet to a specific virtual operation component.

[0100] In the disguise component 22, the traffic receiving component 221 is used to receive the attack traffic directed from the network monitoring probe 21, that is, to receive suspicious data packets, and to perform preliminary filtering and analysis on the traffic (suspicious data packets) to identify the attack traffic against the industrial control equipment. The traffic analysis component 222 is used to perform in-depth analysis on the received attack traffic, extract the characteristics and behavior patterns of the attacker, identify the attack type, attack tools, attack source and other information, and provide key clues for tracing the source. The traffic redirection component 223 is used to redirect the attack traffic to the virtual environment provided by the virtual management module 236 according to the analysis results of the traffic analysis component 222, simulate the response of the industrial control equipment, thereby simulating the factory site environment, and virtually disguise the industrial site PLC equipment by deploying the equipment and protocol simulation module, and virtually disguise the host computer system by deploying the configuration software simulation module, deceive the external device, induce the external device to continue to interact, realize the simulation of the real business scenario, and confuse the attacker to detect the virtual trap, that is, according to the above communication parameters, determine the configuration information for the above external device to interact with the above virtual operation component, so as to collect more attack information. The logging component 224 is used to record all received, analyzed and redirected traffic information, including traffic content, timestamp, source and destination information. It provides log query and export functions for subsequent analysis and evidence collection. The response simulation component 225 is used to simulate the normal response and abnormal response of industrial control equipment to confuse attackers and increase the complexity of the tracing process. For example, different device models, versions and configurations can be simulated as needed to increase the success rate of the lure.

[0101] In the management center 23, the event monitoring module 231 is used to monitor various activities in the industrial control equipment in real time, including traffic, equipment status, user behavior, etc., to find any abnormal or suspicious behavior. The event analysis module 232 (also known as the statistical analysis module) is used to perform in-depth analysis on the abnormal data sent by the event monitoring module 231 after receiving it, including traffic analysis, behavior analysis, pattern recognition, etc., to finally determine whether there is an attack data packet (i.e., there is a network attack). The source tracing module 233 is used to determine the existence of an attack data packet in the event analysis module 232, and track the attack information, including the attacker's IP address, attack path, attack tool, etc., to provide a basis for subsequent defense and response. Emergency response module 234: According to the results of the source tracing module 233, quickly respond and take measures, such as isolating the attack source, restoring the system, notifying relevant personnel, etc., to minimize losses. The threat log module 235 is used to record and manage all logs related to network attacks and source tracing processing to provide support for subsequent audits and analysis. The virtual management module 236 is used to create, configure and manage virtual environments (such as the above-mentioned virtual operating devices and virtual operating components), maintain the status of virtual resources, including virtual devices, networks and storage, and provide a disguise component 22 in the virtual environment to simulate real industrial control equipment to attract attack traffic. The probe management module 237 is used to manage the probe 21, ensure that the probe 21 can monitor and analyze network traffic in real time, collect data captured by the probe 21, and perform preliminary analysis to identify suspicious traffic (i.e., suspicious data packets), and guide suspicious traffic to the disguise component 22 for further analysis and processing. The user management module 238 is used to manage user accounts, including authority allocation and identity authentication, record user activities to ensure the security and compliance of the traceability process, and provide a user interface so that users can interactively monitor and manage traceability processing tasks. The network management module 239 is used to monitor the status and performance of the network, ensure the stability and security of the network, and configure network devices and parameters to support the needs of the traceability process, and coordinate the allocation of network resources to ensure the efficiency and accuracy of the traceability process. The system configuration module 240 is responsible for the configuration management of the entire traceability processing system, for example, setting and managing system parameters, including hardware and software configuration, to ensure that the system configuration complies with security best practices to improve the system's resistance and recovery capabilities. The system information module 241 is used to collect and manage the system's logs and monitoring data, provide information on system status and performance to support decision-making in the traceability processing process, and support troubleshooting and system optimization to improve the efficiency and accuracy of the traceability processing.

[0102] In the data processing device, through the collaborative work of the above modules and components, a complete industrial control network attack event tracing and processing system can be formed, which can quickly and accurately discover and respond to network attacks, and realize comprehensive tracing and processing of industrial control network attack events, thereby effectively responding to and preventing network attacks and ensuring the security and stable operation of the industrial control network.

[0103] Assuming that the industrial control system is a TXP system, and the communication protocol adopted by the TXP system is S7, then in the data processing method provided by the embodiment of the present disclosure, the target operation component in the TXP system is attacked by simulating an external device. For example, the S7 protocol service can be deployed in the virtual operation component. After running the S7 protocol service, the attacker (external device) is controlled to run the attack script. When the attacker accesses the virtual operation component, the internal network traffic of the virtual operation component is obtained through the probe 21. Combined with the attacker's interaction log information with the virtual operation component, the communication protocol content of the TXP system is modified using predetermined rules. Specifically, (1) Configure and deploy S7 services in the simulated TXP system; (2) Determine the S7 test tool, trigger the S7 test tool to run, and obtain the interaction log of the attacker accessing the simulated TXP system: ①Prepare a test environment; ②Install dependencies associated with the S7 service; ③Execute the test script; The specific process of executing the test script is as follows: 1. Network monitoring stage First, the system deploys a monitoring component (e.g., probe 21) in the network to monitor the data connection of the S7 communication protocol in real time. The monitoring component can be deployed at key nodes of the network, such as gateways or switches, to capture all S7 communication traffic passing through.

[0104] 2. Attract attack traffic When the monitoring component detects a suspicious data connection (for example, abnormal packet size, frequency, or content), the decoy mechanism is triggered. The decoy mechanism can be implemented in one of the following ways: Data packet tampering: The monitoring component can modify the destination address or port of the data packet to point it to a disguised component 22 (i.e., a virtual running component) that pretends to be a real S7 device. The disguised component 22 can be a virtual device that can simulate the response of the S7 device, but is actually controlled by the system.

[0105] Introducing delays: The snooping component can introduce delays in the transmission of data packets, making the attacker think that they are establishing a connection with the target device, but in fact the connection has been redirected to the masquerading component22.

[0106] 3. Traffic redirection When the attack traffic is lured to the masquerade component 22, the masquerade component 22 begins to receive and process the traffic. The masquerade component 22 can simulate the response of the S7 device, such as sending a confirmation message or returning a preset error code, to further lure the attacker to interact.

[0107] 4. Analyze the elicitation results At the same time, the system will conduct a detailed analysis of the traffic (i.e., interaction log information) captured during the luring process. The analysis can include the content of the data packet, communication patterns, abnormal behavior, etc. Through analysis, the system can determine the attacker's behavior patterns, the tools and methods used, and possible attack targets.

[0108] 5. Repairing real devices Based on the analysis of the luring results, the system can determine possible security vulnerabilities or configuration errors in the real device. Based on this information, the system can take one of the following actions to fix the real device: Update or upgrade device software: If the analysis shows that the device software has vulnerabilities, the system can download and install the latest software version to fix known security issues.

[0109] Adjust device configuration: If the issue is due to a misconfigured device, the system can modify the device's configuration parameters to ensure it complies with security best practices.

[0110] Added security measures: The system can add additional security layers on the device, such as firewall rules, intrusion detection systems, etc., to enhance the security of the device.

[0111] 6. Records and Reports Finally, the system will record the entire tracing process, including the details of the induced attack traffic, analysis results, and remediation measures taken. This information can be used as evidence and reporting basis for security incidents, so as to facilitate subsequent security audits and incident response.

[0112] When an attacker accesses the simulated TXP system, the simulated TXP system may have the following three operating results: (1) the S7 service runs normally; (2) the test command execution is completed normally; (3) abnormal access logs are captured, including S7Comm events.

[0113] Among them, "normal operation of S7 services" means that the service functions of the S7 communication protocol in the industrial control network are normal and are not affected or interfered with in any way. This usually means: (1) The S7 server and client can communicate correctly, including sending and receiving data. (2) All functions of the S7 protocol can work as expected, such as reading and writing device data, controlling device operations, etc. (3) There are no communication failures, errors or timeouts.

[0114] "Normal completion of test command execution" means that when executing a specific test command, the system is able to execute the command as expected and return the correct result. This usually involves: (1) Accuracy and integrity of the test command: Ensure that the test command is correctly sent to the target device and is not tampered with or interrupted during execution. (2) Validity of command execution: After the test command is executed on the target device, it should be able to return the expected result or perform the expected operation. (3) Verification of results: Verify the results after the test command is executed to ensure that they are correct and valid.

[0115] During the source tracing process, the normal completion of the test command execution is usually to verify the status and function of the network or device in order to determine whether they have been affected by the attack. By executing the test command and verifying its execution results, analysts can understand the actual status of the network or device during the attack event, thereby conducting more accurate source tracing analysis.

[0116] Probe 21 is used to monitor the traffic of the industrial control network in real time, capture the data packets of the S7 communication protocol, and extract key information such as source IP address, destination IP address, port number, communication parameters, etc.

[0117] (3) Check the interaction log of the attacker accessing the simulated TXP system.

[0118] Specifically, the collected S7 communication protocol data packets can be analyzed through the management center 23, and compared with the normal communication behavior pattern to identify abnormal behavior or deviation from the expected communication pattern. In the case of abnormal behavior or deviation from the expected communication pattern, known threat intelligence information is integrated, such as the attacker's IP address range, attack tools and methods, especially threat information related to the S7 communication protocol; then based on the results of data analysis and threat intelligence information, possible attackers are identified, and the data connection initiated by them is traced and analyzed; in which, if it is determined that there is an attacker, a specific luring strategy can be formulated, and a suitable disguise component 22 (such as a disguised S7 server or client) and bait can be selected to simulate a real industrial control environment to attract the attacker to further interact, and the attacker's behavior on the disguise component 22 is monitored, and all logs related to the attack event are recorded, including network traffic, attacker behavior, execution of the luring strategy, etc., and a detailed report is generated for subsequent analysis and investigation.

[0119] Optionally, when it is determined that an abnormal access log has been captured, you can log in to the virtual management interface provided by the management center 23, view the warning log information, capture the abnormal communication establishment, and restore the entire process of establishing a connection and writing and reading data by the external device through tracing the information of the simulated TXP system. The timeline record of the attack on the simulated TXP system can be used to deceive and accurately capture the attacker through the virtual running component, and complete the tracing and alarm work.

[0120] In this example, the attack traffic can be lured to the camouflage component 22, the luring results can be analyzed, and the real device can be repaired, helping the real device to respond quickly when an attack occurs, reduce losses, and improve the overall security of the network.

[0121] Based on the same principle as the data processing method provided in the embodiment of the present disclosure, a data processing device is also provided in the embodiment of the present disclosure, see Figure 3 , the data processing device 300 comprises: The data packet acquisition module 310 is used to acquire a data packet sent by an external device to an industrial control device; wherein the data packet is used to identify: the external device requests to establish a data connection with a target operating component in the industrial control device; The data packet analysis module 320 is used to analyze the communication parameters of the data packet and determine whether the data packet is a suspicious data packet; The data interaction module 330 is used to control the virtual operation component to establish a data connection with the external device if the data packet is a suspicious data packet, and obtain the interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, control the target operation component to establish a data connection with the external device; If the interaction log information indicates that the suspicious data packet is an attack data packet, the target running component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target running component is controlled to establish a data connection with an external device.

[0122] In a possible implementation, the data packet parsing module 320 determines whether the data packet is a suspicious data packet, including: If the preset reference communication parameters do not include the above communication parameters, the above data packet is determined to be a suspicious data packet; wherein the above reference communication parameters are generated based on the communication parameters of the historical data packets interacting with the above industrial control device; the above communication parameters include at least one of the source Internet Protocol IP address, the target IP address, the port number, the transmission protocol, and the data load; If the reference communication parameters include at least one of the communication parameters, it is determined that the data packet is not a suspicious data packet.

[0123] In a possible implementation, the data interaction module 330 controls the virtual operation component to establish a data connection with the external device, including: According to the communication parameters, configuration information for interaction between the external device and the virtual operation component is determined; wherein the configuration information includes at least one of a virtual topology structure and virtual configuration information; the virtual topology structure is constructed based on path information for establishing a data connection between the target operation component and the external device; the virtual configuration information includes configuration information after modifying the network configuration information of the virtual operation component according to the communication parameters; Run the above configuration information to control the above virtual operation component to establish a data connection with the above external device.

[0124] In a possible implementation, the data interaction module 330 is further used to: Determine the status information of the virtual operation component according to the interaction log information; wherein the status information includes any one of normal operation, stopped operation, or abnormal operation; If the above-mentioned state information is stopped running or running abnormally, it is determined that the above-mentioned suspicious data packet is an attack data packet; If the above status information indicates normal operation, it is determined that the above suspicious data packet is not an attack data packet.

[0125] In a possible implementation, the data interaction module 330 repairs the target running component according to the interaction log information, including: Determine attack information of the external device against the virtual running component according to the interaction log information; The attack information includes at least one of attack time information, attack trajectory information, attack location information, attack range, attack tool, information written to the virtual operation component by the external device, and information read from the virtual operation component by the external device; According to the above attack information, the above target running components are repaired.

[0126] In a possible implementation, the data interaction module 330 repairs the target running component, including at least one of the following: Update or upgrade the operating procedures of the above target operating components; Modify the configuration parameters of the above target running components; Adding a security layer for the above target running components; wherein the above security layer includes a firewall and an intrusion detection system; Modifying the communication parameters of the data packet associated with the target operating component; Encrypting or signing data packets associated with the above-mentioned target running components; Add a timestamp or sequence number to the data packets associated with the above target running component.

[0127] In a possible implementation, the virtual running component is constructed based on the running function of the target running component by at least one of the following methods: Simulate the traffic patterns of the above target operating components; Simulate the communication parameters of the above target operating components; Simulate the operating parameter information of the above target running components.

[0128] The device of the embodiments of the present disclosure can execute the method provided by the embodiments of the present disclosure, and the implementation principles are similar. The actions performed by each module in the device of each embodiment of the present disclosure correspond to the steps in the method of each embodiment of the present disclosure. For the detailed functional description of each module of the device, please refer to the description in the corresponding method shown in the previous text, which will not be repeated here.

[0129] Based on the same principles as the data processing method and data processing device provided in the embodiments of the present disclosure, an electronic device (such as a server) is also provided in the embodiments of the present disclosure. The electronic device may include a memory, a processor, and a computer program stored in the memory. The processor executes the above computer program to implement the above method.

[0130] See also Figure 4 , Figure 4 FIG. 1 shows a schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Figure 4As shown, the electronic device 400 in this embodiment may include: a processor 401, a network interface 404 and a memory 405. In addition, the above-mentioned electronic device 400 may also include: an object interface 403, and at least one bus 402. Among them, the bus 402 is used to realize the connection and communication between these components. Among them, the object interface 403 may include a display screen (Display), a keyboard (Keyboard), and the object interface 403 may optionally include a standard wired interface and a wireless interface. The network interface 404 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 405 may be a high-speed RAM memory, or it may be a non-volatile memory (NVM), such as at least one disk storage. The memory 405 may optionally also be at least one storage device located away from the aforementioned processor 401. As Figure 4 As shown, the memory 405 as a computer-readable storage medium may include an operating system, a network communication module, an object interface module, and a device control application program.

[0131] exist Figure 4 In the electronic device 400 shown, the network interface 404 can provide a network communication function; the object interface 403 is mainly used to provide an input interface for the object; and the processor 401 can be used to call the device control application stored in the memory 405 to implement the above method.

[0132] It should be understood that in some feasible implementations, the processor 401 may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0133] In some feasible implementations, bus 402 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 402 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0134] The memory 405 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), magnetic disk storage medium, other magnetic storage devices, or any other medium that can be used to carry or store computer programs and can be read by a computer, without limitation herein.

[0135] The memory 405 is used to store the computer program for executing the embodiment of the present disclosure, and the execution is controlled by the processor 401. The processor 401 is used to execute the computer program stored in the memory 403 to implement the steps shown in the above method embodiment.

[0136] Among them, electronic devices include but are not limited to: displays, image acquisition devices, cameras, antennas, etc.

[0137] In a specific implementation, the electronic device 400 can execute the above-mentioned functions through its built-in functional modules. Figure 1 For the implementation methods provided in each step, please refer to the implementation methods provided in the above steps for details, which will not be repeated here.

[0138] The embodiment of the present disclosure also provides a computer-readable storage medium, which stores a computer program and can implement the steps and corresponding contents of the aforementioned method embodiment when executed by a processor. For details, please refer to the implementation methods provided in the above steps, which will not be repeated here.

[0139] The computer-readable storage medium may be an internal storage unit of the device or electronic device provided in any of the aforementioned embodiments, such as a hard disk or memory of an electronic device. The computer-readable storage medium may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device. The computer-readable storage medium may also include a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc. Further, the computer-readable storage medium may also include both an internal storage unit of the electronic device and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the electronic device. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0140] The embodiments of the present disclosure also provide a computer program product, including a computer program, which can implement the steps and corresponding contents of the aforementioned method embodiments when executed by a processor.

[0141] The terms “first”, “second” and the like in the claims, the specification and the drawings of the present disclosure are used to distinguish different objects rather than to describe a specific order.

[0142] It should be understood that, although the flowchart of the embodiment of the present disclosure indicates each operation step by arrows, the implementation order of these steps is not limited to the order indicated by the arrows. Unless clearly stated herein, in some implementation scenarios of the embodiment of the present disclosure, the implementation steps in each flowchart can be executed in other orders according to demand. In addition, some or all of the steps in each flowchart may include multiple sub-steps or multiple stages based on the actual implementation scenario. Some or all of these sub-steps or stages can be executed at the same time, and each sub-step or stage in these sub-steps or stages can also be executed at different times. In scenarios with different execution times, the execution order of these sub-steps or stages can be flexibly configured according to demand, and the embodiment of the present disclosure does not limit this.

[0143] In addition, those skilled in the art will understand that, unless otherwise stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. The terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or electronic device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or electronic devices.

[0144] Reference to "embodiment" herein means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present disclosure. Displaying the phrase at various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments. The term "and / or" used in this disclosure and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0145] In the embodiments of the present disclosure, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0146] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0147] The above is only an optional implementation method for some implementation scenarios of the present disclosure. It should be pointed out that for ordinary technicians in this technical field, without departing from the technical concept of the scheme of the present disclosure, other similar implementation methods based on the technical ideas of the present disclosure are also within the protection scope of the embodiments of the present disclosure.

Claims

1. A data processing method, characterized in that: The data processing method includes: Acquire a data packet sent by an external device to an industrial control device; wherein the data packet is used to identify: the external device requests to establish a data connection with a target operating component in the industrial control device; parsing communication parameters of the data packet to determine whether the data packet is a suspicious data packet; If the data packet is a suspicious data packet, control the virtual operation component to establish a data connection with the external device, and obtain the interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, control the target operation component to establish a data connection with the external device; If the interaction log information indicates that the suspicious data packet is an attack data packet, the target running component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target running component is controlled to establish a data connection with the external device.

2. The data processing method according to claim 1, wherein: Determining whether the data packet is a suspicious data packet includes: If the communication parameters are not included in the preset reference communication parameters, determining that the data packet is a suspicious data packet; wherein the reference communication parameters are generated based on communication parameters of historical data packets interacting with the industrial control device; the communication parameters include at least one of a source Internet Protocol (IP) address, a destination IP address, a port number, a transport protocol, and a data payload; If the reference communication parameters include at least one of the communication parameters, it is determined that the data packet is not a suspicious data packet.

3. The data processing method according to claim 1 or 2, characterized in that: The controlling the virtual operation component to establish a data connection with the external device includes: Determining, based on the communication parameters, configuration information for interaction between the external device and the virtual operation component; wherein the configuration information includes at least one of a virtual topology structure and virtual configuration information; the virtual topology structure is constructed based on path information for establishing a data connection between the target operation component and the external device; and the virtual configuration information includes configuration information obtained by modifying network configuration information of the virtual operation component based on the communication parameters; The configuration information is run to control the virtual running component to establish a data connection with the external device.

4. The data processing method according to claim 1, wherein: The method further comprises: Determine the status information of the virtual operation component according to the interaction log information; wherein the status information includes any one of normal operation, stopped operation, or abnormal operation; If the status information indicates that the operation is stopped or the operation is abnormal, determining that the suspicious data packet is an attack data packet; If the status information indicates normal operation, it is determined that the suspicious data packet is not an attack data packet.

5. The data processing method according to claim 1 or 4, characterized in that: The repairing of the target running component according to the interaction log information includes: Determining attack information of the external device against the virtual running component according to the interaction log information; The attack information includes at least one of attack time information, attack trajectory information, attack location information, attack range, attack tool, information written by the external device to the virtual operation component, and information read by the external device from the virtual operation component; Repair the target running component according to the attack information.

6. The data processing method according to claim 5, characterized in that: Repairing the target running component includes at least one of the following: Updating or upgrading the operating program of the target operating component; Modifying the configuration parameters of the target running component; Adding a security layer for the target running component; wherein the security layer includes a firewall and an intrusion detection system; Modifying communication parameters of a data packet associated with the target operational component; encrypting or signing a data packet associated with the target execution component; A timestamp or sequence number is added to the data packet associated with the target running component.

7. The data processing method according to claim 1, characterized in that: The virtual operation component is constructed based on the operation function of the target operation component in at least one of the following ways: Simulating a traffic pattern of the target operating component; Simulating communication parameters of the target operating component; Simulate the operating parameter information of the target operating component.

8. A data processing device, characterized in that: The data processing device includes: A data packet acquisition module is used to acquire a data packet sent by an external device to an industrial control device; wherein the data packet is used to identify: the external device requests to establish a data connection with a target operating component in the industrial control device; a data packet parsing module, configured to parse communication parameters of the data packet to determine whether the data packet is a suspicious data packet; and If the data packet is a suspicious data packet, control the virtual operation component to establish a data connection with the external device, and obtain the interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, control the target operation component to establish a data connection with the external device; If the interaction log information indicates that the suspicious data packet is an attack data packet, the target running component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target running component is controlled to establish a data connection with the external device.

9. An electronic device, characterized in that: comprising a processor and a memory, wherein the processor and the memory are connected to each other; The memory is used to store computer programs; The processor is configured to execute the method according to any one of claims 1 to 7 when calling the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images