Data processing method, device and electronic equipment

Abstract

The present disclosure discloses a data processing method, device, and electronic device, relating to the field of computer technology. The method includes: obtaining a data packet sent by an external device to an industrial control device, indicating a request from the external device to establish a data connection with a target operating component in the industrial control device; parsing communication parameters of the data packet; if the data packet is a suspicious data packet, controlling a virtual operating component constructed based on the operating function of the target operating component to establish a data connection with the external device, and obtaining interaction log information between the two; if the data packet is a non-suspicious data packet, controlling the target operating component to establish a data connection with the external device; if the interaction log information indicates that the suspicious data packet is an attack data packet, repairing the target operating component based on the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, controlling the target operating component to establish a data connection with the external device, thereby achieving security protection for the industrial control device.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a data processing method, a data processing device, an electronic device, and a storage medium. Background Art

[0002] In the field of industrial control, industrial control devices in industrial control systems usually establish data connections with external devices through their communication interfaces [such as network ports, serial ports, or USB (Universal Serial Bus) interfaces] and exchange data with external devices.

[0003] Similarly, external devices may also attack industrial control devices through their communication interfaces, threatening the data security of industrial control devices and even the entire industrial control system. To address this, it is urgent to propose a data processing method to protect industrial control devices and prevent external devices from attacking them. Summary of the Invention

[0004] The embodiments of the present disclosure provide a data processing method to solve the problem in related technologies that external devices are prone to attacking industrial control devices.

[0005] Accordingly, the embodiments of the present disclosure further provide a data processing device, an electronic device, and a storage medium to ensure the implementation and application of the above method.

[0006] In one aspect, an embodiment of the present disclosure provides a data processing method, the data processing method comprising:

[0007] Obtaining a data packet sent by an external device to an industrial control device, wherein the data packet is used to identify: a request by the external device to establish a data connection with a target operating component in the industrial control device;

[0008] Analyze the communication parameters of the data packet to determine whether the data packet is a suspicious data packet;

[0009] If the data packet is a suspicious data packet, control the virtual operation component to establish a data connection with the external device, and obtain the interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, control the target operation component to establish a data connection with the external device;

[0010] If the interaction log information indicates that the suspicious data packet is an attack data packet, the target running component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target running component is controlled to establish a data connection with the external device.

[0011] In another aspect, an embodiment of the present disclosure provides a data processing device, the data processing device comprising:

[0012] The data packet acquisition module is used to acquire the data packet sent by the external device to the industrial control device; wherein the data packet is used to identify: the external device requests to establish a data connection with the target operating component in the industrial control device;

[0013] A data packet analysis module is used to analyze the communication parameters of the data packet and determine whether the data packet is a suspicious data packet;

[0014] If the data packet is a suspicious data packet, control the virtual operation component to establish a data connection with the external device, and obtain the interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, control the target operation component to establish a data connection with the external device;

[0015] If the interaction log information indicates that the suspicious data packet is an attack data packet, the target running component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target running component is controlled to establish a data connection with the external device.

[0016] On the other hand, an embodiment of the present disclosure provides an electronic device, including a processor and a memory, wherein the processor and the memory are connected to each other;

[0017] The memory is used to store computer programs;

[0018] The above-mentioned processor is configured to execute the data processing method provided by the embodiment of the present disclosure when calling the above-mentioned computer program.

[0019] On the other hand, an embodiment of the present disclosure provides a computer-readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the data processing method provided by the embodiment of the present disclosure.

[0020] On the other hand, an embodiment of the present disclosure provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the data processing method provided by the embodiment of the present disclosure.

[0021] In an embodiment of the present disclosure, after obtaining a data packet sent by an external device to an industrial control device for requesting to establish a data connection with a target operating component in the industrial control device, the communication parameters of the data packet are parsed to determine whether the data packet is a suspicious data packet; in this way, it is possible to preliminarily determine whether the external device will attack the target operating component by establishing a data connection with the target operating component, thereby improving the operating security of the target operating component.

[0022] Furthermore, when the data packet is a non-suspicious data packet, the target operating component is controlled to establish a data connection with the external device; when the data packet is a suspicious data packet, the virtual operating component constructed based on the operating function of the target operating component is controlled to establish a data connection with the external device; in this way, it is possible to avoid directly establishing a data connection between the target operating component and an external device that may cause an attack on the target operating component, thereby improving the operating security of the target operating component.

[0023] Furthermore, after controlling the virtual operating component to establish a data connection with the external device, interaction log information between the virtual operating component and the external device is obtained. If the interaction log information indicates that the suspicious data packet is an attack data packet, the target operating component is repaired based on the interaction log information. If the interaction log information indicates that the suspicious data packet is not an attack data packet, the target operating component is controlled to establish a data connection with the external device. In this way, by further determining whether the suspicious data packet is an attack data packet based on the interaction log information between the virtual operating component and the external device, it is possible to further determine whether the external device will attack the target operating component by establishing a data connection with the target operating component. When it is determined that the external device will not attack the target operating component by establishing a data connection with the target operating component (i.e., the suspicious data packet is not an attack data packet), the target operating component is repaired based on the interaction log information. In this way, the repaired target operating component can resist attacks generated by the external device, improving the operational security of the repaired target operating component and preventing the external device from inflicting the same attack on the target operating component, thereby achieving security protection for the industrial control device at the granularity of the industrial control device's operating components. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings of the embodiments will be briefly described below. It should be noted that the drawings described below only relate to some embodiments of the present invention and are not intended to limit the present invention.

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0026] Figure 1 A schematic diagram showing a flow chart of a data processing method provided by an embodiment of the present disclosure is shown;

[0027] Figure 2A schematic diagram of an architecture for implementing a data processing method provided by an embodiment of the present disclosure is shown;

[0028] Figure 3 A schematic structural diagram of a data processing device provided by an embodiment of the present disclosure is shown;

[0029] Figure 4 A schematic structural diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0030] The following will be combined with the accompanying drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the embodiments described are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of the present disclosure.

[0031] In related technologies, information security threats to industrial control systems primarily include external network security threats and internal terminal security threats. External network security threats primarily involve attackers (e.g., external devices connected to the industrial control system) illegally accessing the control network and accessing system resources without system authorization. These threats can, for example, tamper with control instructions, spread viruses, and falsify status information, potentially disrupting normal communication on the control channel and causing system paralysis. Internal terminal security threats primarily involve malicious programs being embedded in software systems with open platform architectures. Traditional malicious code detection technology can only detect abnormalities that occur during software execution and cannot effectively verify the security of the software itself. Once malicious code hidden in the system firmware is remotely activated by an attacker, it can lead to the theft and deletion of confidential system information, or even system damage, leading to serious consequences.

[0032] Related technologies have developed a security protection technology system based on trusted computing, primarily focusing on secure boot, data encryption, integrity measurement, and software trust attribute verification. However, using trusted computing alone as a security protection measure cannot guarantee that programs remain secure and trustworthy during operation. As system applications increase, measuring multiple programs will also increase system performance overhead. To address this, the disclosed embodiments propose a data processing method to further improve the security of industrial control systems.

[0033] Figure 1 A flow chart of a data processing method provided by an embodiment of the present disclosure is shown. Figure 1 , the data processing method includes:

[0034] Step S10: obtaining a data packet sent by the external device to the industrial control device; wherein the data packet is used to identify: the external device requests to establish a data connection with a target operating component in the industrial control device.

[0035] Optionally, the data processing method provided in the embodiments of the present disclosure may be implemented by a data processing device. Optionally, the data processing device may be a device in an industrial control system.

[0036] Optionally, the data processing device may be a terminal or server with data control capabilities, or a processor, which is not limited in the present embodiment. When the data processing device is a processor, the data processing method can be implemented by the processor calling computer-readable instructions stored in a memory.

[0037] When the data processing device is a terminal, the terminal (also referred to as a user terminal or user equipment (UE)) can be a smart sensor, PLC, RTU, industrial computer, smart phone, tablet computer, laptop computer, desktop computer, etc.

[0038] When the data processing device is a server, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server or server cluster that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. For example, an independent physical server can be an industrial server.

[0039] Those skilled in the art should understand that the above-mentioned terminals and servers are only examples, and other existing or future terminals or servers that are applicable to the present disclosure should also be included in the scope of protection of the present disclosure and are incorporated herein by reference.

[0040] Since the operation security of the target operation component is improved when the data processing method provided by the embodiment of the present disclosure is executed by the data processing device, attacks on the target operation component by external devices are avoided, and security protection of the industrial control equipment is achieved at the granularity of the operation components of the industrial control equipment, in the embodiment of the present disclosure, the data processing device can also be called a security protection device.

[0041] Optionally, the industrial control system may also include industrial control equipment (also referred to as industrial control terminals, the embodiment of the present disclosure does not limit the name of the equipment). Specifically, the industrial control equipment can be any device in the industrial control system that can perform control operations to drive industrial equipment to perform operations.

[0042] The embodiments of the present disclosure do not limit the specific implementation method of the industrial control equipment. For example, the industrial control equipment may include but is not limited to at least one of the following: a CNC machine tool, a programmable logic controller (PLC), an industrial control host, a measuring device for performing any industrial control operation, a simulation device for performing any industrial control operation, and an intelligent sensor for performing any industrial control operation.

[0043] Optionally, the industrial control device may include one or more operating components, wherein the target operating component may be one or more of the operating components included in the industrial control device.

[0044] For each running component, the communication parameters of the running component may include parameters related to communication with the running component, for example, may include but are not limited to at least one of the IP (Internet Protocol) address information of the running component, MAC (Medium / Media Access Control, media access control address, an address used to confirm the location of a network device) address information, the port number of the communication interface / communication port, the communication protocol adopted by the running component, etc.

[0045] Optionally, the external device may be a device that exchanges data with any device in the industrial control system, and this disclosure is not limited in this regard. For example, the external device may be a switch (specifically, an industrial switch) or other information exchange device. Optionally, there may be one or more external devices. This disclosure uses the example of one external device for illustration.

[0046] Alternatively, a device may be referred to as an internal device or an external device based on its relationship to the industrial control system. For example, if a device is located inside an industrial control system, the device is referred to as an internal device; or if a device is located outside an industrial control system, the device is referred to as an external device.

[0047] In a specific implementation, the industrial control equipment and the data processing device are devices installed inside the industrial control system, and the external device is a device installed outside the industrial control system. Among them, the external device can be a device that needs to establish a connection with the industrial control terminal.

[0048] Optionally, the industrial control equipment can be monitored through probes pre-set in the data processing device to determine whether an external device sends a data packet to the industrial control equipment. If an external device is detected sending a data packet to the industrial control equipment, the data packet is saved for further parsing.

[0049] Optionally, a traffic redirection component in the data processing device may be controlled to send the data packet to the data processing control, and the data packet may be parsed by the data processing control.

[0050] Step S20, analyzing the communication parameters of the data packet to determine whether the data packet is a suspicious data packet;

[0051] If the data packet is a suspicious data packet, control the virtual operation component to establish a data connection with the external device, and obtain the interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, control the target operation component to establish a data connection with the external device;

[0052] If the interaction log information indicates that the suspicious data packet is an attack data packet, the target running component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target running component is controlled to establish a data connection with the external device.

[0053] Optionally, the communication parameters of the data packet may include at least one of a source IP address, a destination IP address, a port number, a transmission protocol, and a data load.

[0054] Optionally, suspicious data packets, that is, data packets that may cause attacks to target running components.

[0055] Optionally, the communication parameters associated with the destination end in the communication parameters of the data packet can be compared with the communication parameters of the target running component. If the two are consistent, the data packet is determined to be a non-suspicious data packet; if the two are inconsistent, the data packet is determined to be a suspicious data packet.

[0056] For example, if the destination IP address of the data packet is the same as the IP address of the target operating component, the port number of the data packet is the same as the port number of the communication interface / communication port of the target operating component, and the transmission protocol of the data packet is the same as the communication protocol used by the target operating component, the data packet is determined to be a non-suspicious data packet. If the destination IP address of the data packet is different from the IP address of the target operating component, or the port number of the data packet is different from the port number of the communication interface / communication port of the target operating component, or the transmission protocol of the data packet is different from the communication protocol used by the target operating component, the data packet is determined to be a suspicious data packet.

[0057] Alternatively, a virtual operating component corresponding to the operating function of each operating component in the industrial control device can be pre-built based on the operating functions of each operating component. That is, the virtual operating component can implement the operating function of the corresponding operating component. Optionally, the device composed of the virtual operating components can also be called a virtual industrial control device.

[0058] Optionally, by analyzing the interaction log information, the information sent by the external device to the virtual operation component can be obtained, and then it can be determined whether the external device attacks the virtual operation component, and the specific attack content of the external device on the virtual operation component (for example, attack method, attack range, attack time, etc.).

[0059] It is understandable that, when it is determined that the external device attacks the virtual operation component, that is, the suspicious data packet is an attack data packet, the names of the suspicious data packet and the attack data packet can be interchangeable.

[0060] When it is determined that the external device has attacked the virtual running component, it can be determined that the external device has established a data connection with the target running component to further attack the target running component, that is, the above-mentioned data packet is an attack data packet; when it is determined that the external device has not attacked the virtual running component, it can be determined that the external device has established a data connection with the target running component to conduct normal data exchange with the target running component, that is, the above-mentioned data packet is not an attack data packet.

[0061] When it is determined that the above data packet is an attack data packet, the target operation component can be repaired according to the attack content of the external device on the virtual operation component, so that the repaired target operation component can resist the attack generated by the external device.

[0062] In the embodiment of the present disclosure, by parsing the communication parameters of the data packet to determine whether the data packet is a suspicious data packet, it is possible to preliminarily determine whether the external device will attack the target running component by establishing a data connection with the target running component, thereby improving the operating security of the target running component.

[0063] Furthermore, in the case that the data packet is a suspicious data packet, the virtual operating component constructed based on the operating function of the target operating component is controlled to establish a data connection with the external device, thereby avoiding directly establishing a data connection between the target operating component and the external device that may cause an attack on the target operating component, thereby improving the operating security of the target operating component.

[0064] Furthermore, by further determining whether a suspicious data packet is an attack data packet based on the interaction log information between the virtual operating component and the external device, it is possible to further determine whether the external device will attack the target operating component by establishing a data connection with the target operating component, and to confirm that the external device will not attack the target operating component by establishing a data connection with the target operating component (i.e., the suspicious data packet is not an attack data packet). Furthermore, by repairing the target operating component based on the interaction log information, the repaired target operating component can resist attacks initiated by the external device, improving the operational security of the repaired target operating component and preventing external devices from inflicting the same attack on the target operating component, thus achieving security protection for industrial control devices at the granularity of their operating components.

[0065] In one possible implementation, determining whether the data packet is a suspicious data packet includes:

[0066] If the preset reference communication parameters do not include the communication parameters, determining the data packet as a suspicious data packet; wherein the reference communication parameters are generated based on communication parameters of historical data packets interacting with the industrial control device; the communication parameters include at least one of a source Internet Protocol (IP) address, a destination IP address, a port number, a transport protocol, and a data payload;

[0067] If the reference communication parameters include at least one of the communication parameters, it is determined that the data packet is not a suspicious data packet.

[0068] Optionally, the communication parameters of the data packet may further include traffic volume and behavior.

[0069] Optionally, data packets of external devices that have interacted with industrial control devices (i.e., historical data packets) can be parsed to determine the normal network behavior baseline (including normal data traffic, access patterns, user behavior, etc.), and by analyzing historical data packets and network audit records, the communication parameters of the historical data packets can be obtained. After deduplication of the communication parameters of the historical data packets, reference communication parameters can be obtained.

[0070] Optionally, the communication parameters of the data packet can be compared with reference communication parameters through machine learning or pattern recognition algorithms to determine whether the data packet is a suspicious data packet and distinguish normal behavior from potential attack behavior. The embodiments of the present disclosure do not limit this.

[0071] Optionally, known threat intelligence information, such as the attacker's IP address range, attack tools and methods, can be integrated to identify possible attack behaviors. When the communication parameters of a data packet are consistent with the communication parameters in the threat intelligence information, the data packet is determined to be a suspicious data packet.

[0072] Optionally, a trust model can be established based on the historical behavior of users, devices, and networks. Based on the trust model, the communication parameters of the data packets are given a trust score. Data packets with lower scores are more likely to be initiated by attackers, that is, the data packets are suspicious data packets.

[0073] In the embodiment of the present disclosure, by comparing the communication parameters of the data packet with the reference communication parameters, it can be determined whether the data packet is a suspicious data packet, which paves the way for preliminarily determining whether the external device will attack the target running component by establishing a data connection with the target running component.

[0074] In a possible implementation, the controlling virtual operation component to establish a data connection with the external device includes:

[0075] Determining, based on the communication parameters, configuration information for interaction between the external device and the virtual operation component; wherein the configuration information includes at least one of a virtual topology and virtual configuration information; the virtual topology is constructed based on path information for establishing a data connection between the target operation component and the external device; and the virtual configuration information includes configuration information obtained by modifying network configuration information of the virtual operation component based on the communication parameters.

[0076] Run the above configuration information to control the above virtual operation component to establish a data connection with the above external device.

[0077] Optionally, when the target running component establishes a data connection with the external device, it can establish a data connection with the external device directly, or it can establish a data connection with the external device through one or more other running components. The specific method can be determined based on actual conditions, and the embodiments of the present disclosure do not limit this.

[0078] Optionally, the path information for establishing a data connection between the target running component and the external device may include but is not limited to at least one of component information of other running components in the path for establishing a data connection between the target running component and the external device, the connection order between the running components in the path, etc.

[0079] Optionally, the virtual topology structure may include a component topology structure formed by connecting the above-mentioned virtual running component (for the sake of ease of distinction, it may also be referred to as the first virtual running component hereinafter) and the second virtual running component corresponding to other running components in the above-mentioned path in accordance with the connection order between the various running components in the above-mentioned path.

[0080] During the actual processing process, the virtual topology structure may also include a third virtual operation component associated with the data exchange operation during the process of data exchange between the virtual operation component and the external device, and a path for the third virtual operation component to exchange data with the first virtual operation component and the second virtual operation component.

[0081] Optionally, virtual configuration information, i.e., forged data, vulnerabilities, or resources that appear to be valuable to external devices, can be used to modify the network configuration information of the virtual operation component based on the communication parameters of the data packet so that the virtual operation component can establish a connection with the external device.

[0082] During the actual processing process, the virtual configuration information may also include but is not limited to modifying the network configuration information of the second virtual operation component and the third virtual operation component according to the communication parameters of the data packet, so that the virtual operation component can establish a connection with the external device. The embodiment of the present disclosure does not make specific limitations on this.

[0083] In the embodiment of the present disclosure, by determining configuration information for interaction between the external device and the virtual operation component according to the communication parameters of the data packet and executing the configuration information, the virtual operation component can be controlled to establish a data connection with the external device.

[0084] In a possible implementation, the method further includes:

[0085] Determine the status information of the virtual operation component according to the interaction log information; wherein the status information includes any one of normal operation, stopped operation, or abnormal operation;

[0086] If the status information indicates that the operation is stopped or the operation is abnormal, the suspicious data packet is determined to be an attack data packet;

[0087] If the above status information indicates normal operation, it is determined that the above suspicious data packet is not an attack data packet.

[0088] In an embodiment of the present disclosure, when the status information of the virtual running component is that it has stopped running or is running abnormally, it can be determined that the virtual running component itself may have a vulnerability or that the virtual running component has been attacked by an external device. In this case, the suspicious data packet is determined to be an attack data packet, and the target running component is further repaired based on the interaction log information. For example, when it is determined through the interaction log information that the virtual running component itself has a vulnerability, the vulnerability of the target running component itself is repaired; when it is determined through the interaction log information that the virtual running component has been attacked by an external device, further security protection measures are taken for the target running component, so that the repaired target running component can avoid attacks initiated by external devices that are similar to the attack behaviors caused to the virtual running component.

[0089] Optionally, the above data processing method can also be applied to the test process of the target running component. Correspondingly, the status information of the virtual running component can include any one of normal completion of the test command, cessation of operation, or abnormal operation.

[0090] The specific method for determining whether a suspicious data packet initiated by an external device during the test is an attack packet can be found above. Specifically, if the status information of the virtual operation component indicates that the suspicious data packet is stopped or operating abnormally, the suspicious data packet is determined to be an attack data packet; if the status information of the virtual operation component indicates that the test command has been completed normally, the suspicious data packet is determined to be an attack data packet. If the suspicious data packet is determined to be an attack data packet, the operating function of the target operation component can be improved based on the specific interaction log information.

[0091] In a possible implementation, repairing the target running component according to the interaction log information includes:

[0092] Determining attack information of the external device against the virtual running component based on the interaction log information;

[0093] The attack information includes at least one of attack time information, attack trajectory information, attack location information, attack range, attack tool, information written to the virtual operation component by the external device, and information read from the virtual operation component by the external device;

[0094] Based on the above attack information, the above target running components are repaired.

[0095] Optionally, the attack time information may include but is not limited to: the attack start time (i.e., the moment when the data packet is received), the attack end time (i.e., the moment when the data packet stops being received, the moment when the virtual running component stops running), and the attack duration (i.e., the duration from the attack start time to the attack end time).

[0096] The attack trajectory information may include, but is not limited to: a path consisting of virtual operation components that perform data exchange operations within the virtual industrial operation equipment during the attack duration.

[0097] In the embodiment of the present disclosure, by analyzing the interaction log information, different types of attack information of external devices against virtual running components are obtained, a profile of the attack information is achieved, and the target running components are repaired in a targeted manner according to different types of attack information. This can improve the efficiency of repairing the target running components and simplify the repair process of the target running components.

[0098] Alternatively, in some embodiments, the target operating component itself may have a defect (e.g., a vulnerability in the target operating component). During the interaction between the external device and the virtual operating component, even if the external device does not attack the virtual operating component, the virtual operating component may stop operating or operate abnormally. By further parsing the interaction log information, it is possible to further determine the cause of the virtual operating component stopping or operating abnormally, whether it is an attack by the external device on the virtual operating component or a defect in the target operating component itself. In the embodiments of the present application, regardless of the cause, the parsed result of the interaction log information can be determined as attack information.

[0099] In one possible implementation, repairing the target running component includes at least one of the following:

[0100] Update or upgrade the operating procedures of the above-mentioned target operating components;

[0101] Modify the configuration parameters of the above target running components;

[0102] Adding a security layer for the above-mentioned target operating components; wherein the above-mentioned security layer includes a firewall and an intrusion detection system;

[0103] Modifying communication parameters of a data packet associated with the target operating component;

[0104] Encrypt or sign data packets associated with the target running component;

[0105] Add a timestamp or sequence number to the data packets associated with the target running component.

[0106] Optionally, when the attack information indicates that a vulnerability exists in the virtual operation component, the target operation component is updated or upgraded according to parameter information of the vulnerability.

[0107] Optionally, when the attack information indicates that there is an error in the configuration parameters of the virtual running component, the configuration parameters of the target running component may be modified.

[0108] Optionally, if the attack information indicates that the virtual operating component is unable to protect against attacks from external devices, a security layer can be added to the target operating component, the communication parameters of the data packets associated with the target operating component can be modified, the data packets associated with the target operating component can be encrypted or signed, or a timestamp or sequence number can be added to the data packets associated with the target operating component. By modifying the communication parameters of the data packets associated with the target operating component (to mark the data packets as monitored or forged), encrypting or signing the data packets associated with the target operating component (to ensure data integrity and authentication), or adding a timestamp or sequence number to the data packets associated with the target operating component (to track the transmission path and time of the data packets), it is possible to determine whether the data packets associated with the target operating component will cause an attack on the target operating component by parsing the data packets associated with the target operating component.

[0109] Optionally, when modifying the communication parameters of a data packet associated with a target running component, it may include but is not limited to at least one of the following: modifying the target IP address of the data packet; modifying the port number of the data packet; expanding the fields in the communication protocol used by the data packet (to accommodate additional information, such as a traceability identifier or an attack inducement tag).

[0110] Optionally, before a data packet associated with the target execution component is sent through the target execution component, the data packet may be encrypted or signed, or a timestamp or a serial number may be added to the data packet.

[0111] As an example, taking the S7 protocol used by the target runtime component as an example, the repair process is as follows:

[0112] Rule 1: All S7 packets passing through a monitoring point (such as a gateway or switch) need to have a specific tag field added to identify the packet as being monitored and analyzed.

[0113] Rule 2: If an abnormal S7 data packet is detected, the system will automatically modify the destination address of the data packet and redirect it to a disguised S7 server in order to collect further information about the attacker's behavior.

[0114] Rule 3: During a specific tracing and analysis phase, the system will tamper with certain information in the data packet, such as returning incorrect device status or configuration parameters, to lure the attacker into further interaction.

[0115] Rule 4: All S7 data packets processed by the system need to be digitally signed to ensure the integrity of the data packets and that they have not been tampered with.

[0116] In the embodiment of the present disclosure, by repairing the target running component in a targeted manner according to different types of attack information, the efficiency of repairing the target running component can be improved.

[0117] In a possible implementation, the virtual running component is constructed based on the running function of the target running component by at least one of the following methods:

[0118] Simulate the traffic patterns of the above target operating components;

[0119] Simulate the communication parameters of the above target operating components;

[0120] Simulate the operating parameter information of the above target running components.

[0121] Optionally, the traffic pattern of the target running component may include, but is not limited to, at least one of: regularly sending data packets, regularly sending data requests, and performing traffic transmission delay.

[0122] Optionally, the communication parameters of the simulation target running component may include, but are not limited to, at least one of an IP address, a port number, and a transmission protocol of the simulation target running component.

[0123] As an example, the invalid IP address of the target running component is used as the IP address of the virtual running component, and an IP address similar to the valid IP address of the target running component is used as the IP address of the virtual running component to prevent external devices from obtaining the real IP address of the target running component.

[0124] Optionally, the operating parameter information of the simulated target operating component may include, but is not limited to: delaying response to data packets sent by external devices, exposing vulnerabilities of virtual operating components, weakening the encryption algorithm for data packets sent by virtual operating components, and providing authorization information to external devices, so as to further induce the external device to interact with the virtual operating component.

[0125] It should be noted that the above construction method is only an example, but the embodiments of the present disclosure may also cover other methods of constructing virtual running components based on the running functions of the target running components, which will not be elaborated here.

[0126] Optionally, when building a virtual runtime component based on the runtime functionality of the target runtime component, the following characteristics need to be considered:

[0127] Controllability: This means ensuring that these false vulnerabilities can be fully controlled and managed to ensure they do not become real security threats.

[0128] Monitoring and recording: This means being able to monitor and record the interactions of virtual running components in detail, so as to conduct traceability analysis after an attack occurs.

[0129] Regular updates: As attack techniques evolve, the vulnerabilities in the disguised components need to be regularly updated and adjusted to maintain their effectiveness.

[0130] Coordination with other security measures: that is, by building virtual operating components, it may be part of the security strategy of the industrial control system. It needs to be closely combined with other security measures (such as firewalls (specifically industrial firewalls), intrusion detection systems (specifically industrial control intrusion detection systems), etc.) to form a powerful defense system.

[0131] In the embodiment of the present disclosure, a virtual operating component is constructed based on the operating function of the target operating component, and vulnerabilities in the virtual operating component are set in a targeted manner. In this way, the deception of the virtual operating component to potential attackers can be enhanced during the interaction between the virtual operating component and the external device, and the external device can be lured to have a deeper data interaction with the virtual operating component, thereby obtaining more information about the external device, paving the way for subsequent repairs to the target operating component, and thereby improving the efficiency and accuracy of the traceability processing.

[0132] In order to illustrate the data processing method provided by the embodiment of the present disclosure, the following Figure 2 The data processing device shown here illustrates the process of implementing the data processing method by combining different modules of the data processing device:

[0133] See also Figure 2 The data processing device may include three parts: a probe 21 (wherein the number of the probe 21 may include one or more), a camouflage component 22 and a management center 23.

[0134] Among them, the probe 21 is used to collect data and traffic, parse the communication parameters of the data packet, determine whether the data packet is a suspicious data packet, and redirect the suspicious data packet, that is, the above-mentioned data packet sent by the external device to the industrial control device is obtained, the communication parameters of the data packet are parsed, and the data packet is determined whether it is a suspicious data packet.

[0135] The disguise component 22 is used to construct a virtual bait to lure the external device to interact with the virtual operation component, that is, to control the virtual operation component to establish a data connection with the external device and obtain the interaction log information between the virtual operation component and the external device.

[0136] The management center 23 is used to direct suspicious data packets to specific virtual operation components, check the intrusion status of external devices, and take processing measures. That is, if the interaction log information indicates that the suspicious data packet is an attack data packet, the target operation component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target operation component is controlled to establish a data connection with the external device.

[0137] Specifically, the probe 21 may include a network monitoring module 211 and a traffic redirection module 212. The masquerade component 22 may include a traffic receiving component 221, a traffic analysis component 222, a traffic redirection component 223, a logging component 224, and a response simulation component 225. The management center 23 may include an event monitoring module 231, an event analysis module 232, a source tracing module 233, an emergency response module 234, a threat log module 235, a virtual management module 236, a probe management module 237, a user management module 238, a network management module 239, a system configuration module 240, and a system information module 241.

[0138] Specifically, in the probe 21, the network monitoring module 211 is used to collect data and traffic, and the traffic redirection module 212 is used to parse the communication parameters of the data packet, determine whether the data packet is a suspicious data packet, and direct the data packet to a specific virtual operation component.

[0139] In the camouflage component 22, the traffic receiving component 221 is used to receive attack traffic directed from the network monitoring probe 21, namely, suspicious data packets, and perform preliminary filtering and parsing of the traffic (suspicious data packets) to identify attack traffic targeting industrial control devices. The traffic analysis component 222 is used to conduct in-depth analysis of the received attack traffic, extracting the attacker's characteristics and behavioral patterns, and identifying information such as the attack type, attack tools, and attack source, providing key clues for tracing the source. Based on the analysis results of the traffic analysis component 222, the traffic redirection component 223 is used to redirect the attack traffic to the virtual environment provided by the virtual management module 236. By simulating the responses of industrial control devices, it simulates the factory environment. By deploying device and protocol simulation modules to virtually disguise industrial field PLC devices, and by deploying configuration software simulation modules to virtually disguise the host computer system, it deceives external devices and tricks them into continuing to interact, simulating real business scenarios and confusing attackers from detecting virtual traps. Specifically, based on the communication parameters, the configuration information for the interaction between the external devices and the virtual operation components is determined to collect more attack information. The logging component 224 records all received, analyzed, and redirected traffic, including traffic content, timestamps, source, and destination. It also provides log query and export capabilities to facilitate subsequent analysis and forensics. The response simulation component 225 simulates normal and abnormal responses from industrial control devices to confuse attackers and increase the complexity of the tracing process. For example, different device models, versions, and configurations can be simulated as needed to increase the success rate of luring.

[0140] In the management center 23, the event monitoring module 231 monitors various activities within industrial control equipment in real time, including traffic flow, device status, and user behavior, to identify any abnormal or suspicious behavior. The event analysis module 232 (also known as the statistical analysis module) receives abnormal data from the event monitoring module 231 and conducts in-depth analysis, including traffic analysis, behavioral analysis, and pattern recognition, to ultimately determine whether an attack packet (i.e., a network attack) exists. The source tracing module 233, after confirming the presence of an attack packet in the event analysis module 232, tracks the attack information, including the attacker's IP address, attack path, and attack tools, providing a basis for subsequent defense and response. The emergency response module 234, based on the results of the source tracing module 233, rapidly responds and takes measures, such as isolating the attack source, restoring the system, and notifying relevant personnel, to minimize losses. The threat logging module 235 records and manages all logs related to network attacks and source tracing, supporting subsequent auditing and analysis. The virtual management module 236 is used to create, configure, and manage virtual environments (such as the aforementioned virtual operating devices and virtual operating components), maintain the status of virtual resources, including virtual devices, networks, and storage, and provide a camouflage component 22 within the virtual environment to simulate real industrial control equipment and attract attack traffic. The probe management module 237 is used to manage probes 21, ensuring that probes 21 can monitor and analyze network traffic in real time. It also collects data captured by probes 21 and performs preliminary analysis to identify suspicious traffic (i.e., suspicious packets) and directs suspicious traffic to the camouflage component 22 for further analysis and processing. The user management module 238 is used to manage user accounts, including permission allocation and authentication, record user activity to ensure the security and compliance of the traceability process, and provide a user interface that allows users to interactively monitor and manage traceability tasks. The network management module 239 is used to monitor the status and performance of the network to ensure network stability and security, configure network devices and parameters to support the needs of the traceability process, and coordinate the allocation of network resources to ensure the efficiency and accuracy of the traceability process. System Configuration Module 240 is responsible for configuration management of the entire traceability processing system. For example, it sets and manages system parameters, including hardware and software configuration, ensuring that the system configuration adheres to security best practices to improve the system's resilience and recovery capabilities. System Information Module 241 is responsible for collecting and managing system logs and monitoring data, providing information on system status and performance to support decision-making during the traceability process, as well as troubleshooting and system optimization to improve the efficiency and accuracy of the traceability process.

[0141] In the data processing device, through the collaborative work of the above modules and components, a complete industrial control network attack event tracing and processing system can be formed, which can quickly and accurately discover and respond to network attacks, and realize comprehensive tracing and processing of industrial control network attack events, thereby effectively responding to and preventing network attacks and ensuring the security and stable operation of industrial control networks.

[0142] Taking the industrial control system as the TXP system, and the communication protocol adopted by the TXP system as S7, the data processing method provided by the embodiment of the present disclosure is used to simulate an external device to attack the target running component in the TXP system. For example, the S7 protocol service can be deployed in the virtual running component. After running the S7 protocol service, the attacker (external device) is controlled to run the attack script. When the attacker accesses the virtual running component, the internal network traffic of the virtual running component is obtained through the probe 21. Combined with the attacker's interaction log information with the virtual running component, the communication protocol content of the TXP system is modified using predetermined rules. Specifically,

[0143] (1) Configure and deploy S7 services in the simulated TXP system;

[0144] (2) Identify the S7 test tool, trigger the S7 test tool to run, and obtain the interaction log of the attacker accessing the simulated TXP system:

[0145] ① Prepare a test environment;

[0146] ②Install dependencies associated with the S7 service;

[0147] ③Execute the test script;

[0148] The specific process of executing the test script is as follows:

[0149] 1. Network monitoring phase

[0150] First, the system deploys a listening component (e.g., Probe 21) on the network to monitor S7 communication protocol data connections in real time. The listening component can be deployed at key network nodes, such as gateways or switches, to capture all passing S7 communication traffic.

[0151] 2. Attract attack traffic

[0152] When the monitoring component detects a suspicious data connection (for example, unusual packet size, frequency, or content), it triggers the decoy mechanism. The decoy mechanism can be implemented in one of the following ways:

[0153] Packet tampering: The listening component can modify the destination address or port of a packet to direct it to a disguised component 22 (i.e., a virtual running component) that masquerades as a real S7 device. The disguised component 22 can be a virtual device that simulates the responses of an S7 device but is actually controlled by the system.

[0154] Introducing delays: The snooping component can introduce delays in the transmission of data packets, making the attacker think that they are establishing a connection with the target device, but in fact the connection has been redirected to the masquerading component22.

[0155] 3. Traffic redirection

[0156] When attack traffic is lured to the masquerade component 22, it begins to receive and process the traffic. The masquerade component 22 can simulate the response of the S7 device, such as sending a confirmation message or returning a preset error code, to further lure the attacker into interacting.

[0157] 4. Analyze the luring results

[0158] The system also conducts a detailed analysis of the traffic captured during the luring process (i.e., interaction logs). This analysis can include packet content, communication patterns, and abnormal behavior. Through this analysis, the system can identify the attacker's behavior patterns, tools and methods used, and possible targets.

[0159] 5. Repairing real devices

[0160] Based on the analysis of the lured results, the system can determine possible security vulnerabilities or configuration errors in the real device. Based on this information, the system can take one of the following actions to remediate the real device:

[0161] Update or upgrade device software: If analysis reveals vulnerabilities in the device software, the system can download and install the latest software version to fix known security issues.

[0162] Adjust device configuration: If the issue is due to a device misconfiguration, the system can modify the device's configuration parameters to ensure it complies with security best practices.

[0163] Added security measures: The system can add additional security layers on the device, such as firewall rules, intrusion detection systems, etc., to enhance the security of the device.

[0164] 6. Records and Reports

[0165] Finally, the system records the entire tracing process, including details of the induced attack traffic, analysis results, and remediation measures taken. This information can serve as evidence and reporting for security incidents, facilitating subsequent security audits and incident response.

[0166] When an attacker accesses the simulated TXP system, the simulated TXP system may have the following three operating results: (1) the S7 service runs normally; (2) the test command execution is completed normally; (3) abnormal access logs are captured, including S7Comm events.

[0167] Among them, "S7 services are operating normally" means that the service functions of the S7 communication protocol in the industrial control network are normal and are not affected or interfered with in any way. This generally means: (1) The S7 server and client can communicate correctly, including sending and receiving data. (2) All functions of the S7 protocol can work as expected, such as reading and writing device data, controlling device operations, etc. (3) There are no communication failures, errors, or timeouts.

[0168] "Normal completion of test command execution" means that when executing a specific test command, the system is able to execute the command as expected and return the correct result. This usually involves: (1) Accuracy and integrity of the test command: ensuring that the test command is correctly sent to the target device and is not tampered with or interrupted during execution. (2) Validity of command execution: After the test command is executed on the target device, it should be able to return the expected result or perform the expected operation. (3) Verification of results: Verify the results after the test command is executed to ensure that they are correct and valid.

[0169] During the source tracing process, the successful execution of test commands is typically used to verify the status and functionality of a network or device to determine whether it has been affected by an attack. By executing test commands and verifying their results, analysts can understand the actual state of the network or device during the attack, enabling more accurate source tracing.

[0170] Probe 21 is used to monitor the traffic of the industrial control network in real time, capture the data packets of the S7 communication protocol, and extract key information such as source IP address, destination IP address, port number, communication parameters, etc.

[0171] (3) Check the interaction logs of the attacker accessing the simulated TXP system.

[0172] Specifically, the management center 23 can analyze collected S7 communication protocol data packets and compare them with normal communication behavior patterns to identify abnormal behavior or deviations from expected communication patterns. In the event of abnormal behavior or deviations from expected communication patterns, known threat intelligence information is integrated, such as the attacker's IP address range, attack tools, and methods, particularly threat information related to the S7 communication protocol. Based on the data analysis results and threat intelligence information, the potential attacker is identified and the data connection initiated by the attacker is traced. If an attacker is identified, a specific decoy strategy can be developed, selecting an appropriate disguise component 22 (such as a disguised S7 server or client) and decoy to simulate a real industrial control environment to attract further interaction from the attacker. The attacker's behavior on the disguise component 22 is monitored, and all logs related to the attack event are recorded, including network traffic, attacker behavior, and the execution of the decoy strategy. A detailed report is then generated for subsequent analysis and investigation.

[0173] Optionally, when it is determined that an abnormal access log has been captured, the user can log in to the virtual management interface provided by the management center 23 to view the warning log information and capture the abnormal communication establishment. By tracing the information of the simulated TXP system, the entire process of establishing a connection and writing and reading data by the external device can be restored, and the timeline record of the attack on the simulated TXP system can be recorded, so as to deceive and accurately capture the attacker through the virtual running component and complete the tracing and alarm work.

[0174] In this example, attack traffic can be lured to the camouflage component 22, the luring results can be analyzed, and the real device can be repaired, helping the real device to respond quickly when an attack occurs, reducing losses and improving the overall security of the network.

[0175] Based on the same principle as the data processing method provided in the embodiment of the present disclosure, a data processing device is also provided in the embodiment of the present disclosure, see Figure 3 , the data processing device 300 includes:

[0176] The data packet acquisition module 310 is used to acquire a data packet sent by an external device to the industrial control device; wherein the data packet is used to identify: the external device requests to establish a data connection with the target operating component in the industrial control device;

[0177] The data packet analysis module 320 is used to analyze the communication parameters of the data packet and determine whether the data packet is a suspicious data packet;

[0178] Data interaction module 330, for controlling the virtual operation component to establish a data connection with an external device if the data packet is a suspicious data packet, and obtaining interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, controlling the target operation component to establish a data connection with the external device;

[0179] If the interaction log information indicates that the suspicious data packet is an attack data packet, the target running component is repaired according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, the target running component is controlled to establish a data connection with the external device.

[0180] In one possible implementation, the data packet parsing module 320 determines whether the data packet is a suspicious data packet by:

[0181] If the preset reference communication parameters do not include the communication parameters, determining the data packet as a suspicious data packet; wherein the reference communication parameters are generated based on communication parameters of historical data packets interacting with the industrial control device; the communication parameters include at least one of a source Internet Protocol (IP) address, a destination IP address, a port number, a transport protocol, and a data payload;

[0182] If the reference communication parameters include at least one of the communication parameters, it is determined that the data packet is not a suspicious data packet.

[0183] In a possible implementation, the data interaction module 330 controls the virtual operation component to establish a data connection with the external device, including:

[0184] Determining, based on the communication parameters, configuration information for interaction between the external device and the virtual operation component; wherein the configuration information includes at least one of a virtual topology and virtual configuration information; the virtual topology is constructed based on path information for establishing a data connection between the target operation component and the external device; and the virtual configuration information includes configuration information obtained by modifying network configuration information of the virtual operation component based on the communication parameters.

[0185] Run the above configuration information to control the above virtual operation component to establish a data connection with the above external device.

[0186] In a possible implementation, the data interaction module 330 is further configured to:

[0187] Determine the status information of the virtual operation component according to the interaction log information; wherein the status information includes any one of normal operation, stopped operation, or abnormal operation;

[0188] If the status information indicates that the operation is stopped or abnormal, the suspicious data packet is determined to be an attack data packet;

[0189] If the above status information indicates normal operation, it is determined that the above suspicious data packet is not an attack data packet.

[0190] In a possible implementation, the data interaction module 330 repairs the target running component according to the interaction log information, including:

[0191] Determining attack information of the external device against the virtual running component based on the interaction log information;

[0192] The attack information includes at least one of attack time information, attack trajectory information, attack location information, attack range, attack tool, information written to the virtual operation component by the external device, and information read from the virtual operation component by the external device;

[0193] Based on the above attack information, the above target running components are repaired.

[0194] In one possible implementation, the data interaction module 330 repairs the target running component, including at least one of the following:

[0195] Update or upgrade the operating procedures of the above-mentioned target operating components;

[0196] Modify the configuration parameters of the above target running components;

[0197] Adding a security layer for the above-mentioned target operating components; wherein the above-mentioned security layer includes a firewall and an intrusion detection system;

[0198] Modifying communication parameters of a data packet associated with the target operating component;

[0199] Encrypt or sign data packets associated with the target running component;

[0200] Add a timestamp or sequence number to the data packets associated with the target running component.

[0201] In a possible implementation, the virtual running component is constructed based on the running function of the target running component by at least one of the following methods:

[0202] Simulate the traffic patterns of the above target operating components;

[0203] Simulate the communication parameters of the above target operating components;

[0204] Simulate the operating parameter information of the above target running components.

[0205] The device of the embodiment of the present disclosure can execute the method provided by the embodiment of the present disclosure, and its implementation principle is similar. The actions performed by each module in the device of each embodiment of the present disclosure correspond to the steps in the method of each embodiment of the present disclosure. For the detailed functional description of each module of the device, please refer to the description in the corresponding method shown in the previous text, and will not be repeated here.

[0206] Based on the same principles as the data processing method and data processing device provided in the embodiments of the present disclosure, an electronic device (such as a server) is also provided in the embodiments of the present disclosure. The electronic device may include a memory, a processor and a computer program stored in the memory, and the processor executes the above computer program to implement the above method.

[0207] See also Figure 4 , Figure 4 FIG. 1 shows a schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Figure 4 As shown, the electronic device 400 in this embodiment may include: a processor 401, a network interface 404 and a memory 405. In addition, the above-mentioned electronic device 400 may also include: an object interface 403, and at least one bus 402. The bus 402 is used to realize the connection and communication between these components. The object interface 403 may include a display screen (Display), a keyboard (Keyboard), and the object interface 403 may optionally include a standard wired interface and a wireless interface. The network interface 404 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 405 may be a high-speed RAM memory or a non-volatile memory (NVM), such as at least one disk storage. The memory 405 may optionally also be at least one storage device located away from the aforementioned processor 401. As Figure 4 As shown, the memory 405 as a computer-readable storage medium may include an operating system, a network communication module, an object interface module, and a device control application program.

[0208] exist Figure 4 In the electronic device 400 shown, the network interface 404 can provide network communication functions; the object interface 403 is mainly used to provide an input interface for the object; and the processor 401 can be used to call the device control application stored in the memory 405 to implement the above method.

[0209] It should be understood that in some feasible implementations, the processor 401 may be a central processing unit (CPU). The processor may also be another general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor, or the processor may be any conventional processor. The memory may include read-only memory and random access memory, and provides instructions and data to the processor. A portion of the memory may also include non-volatile random access memory. For example, the memory may also store device type information.

[0210] In some feasible implementations, bus 402 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. Bus 402 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0211] The memory 405 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium that can be used to carry or store computer programs and can be read by a computer, without limitation herein.

[0212] The memory 405 is used to store the computer program for executing the embodiments of the present disclosure, and the execution is controlled by the processor 401. The processor 401 is used to execute the computer program stored in the memory 403 to implement the steps shown in the above method embodiments.

[0213] Among them, electronic equipment includes but is not limited to: displays, image acquisition equipment, cameras, antennas, etc.

[0214] In a specific implementation, the electronic device 400 can execute the above-mentioned functions through its built-in functional modules. Figure 1 For the implementation methods provided in each step, please refer to the implementation methods provided in the above steps for details, which will not be repeated here.

[0215] The embodiment of the present disclosure also provides a computer-readable storage medium, which stores a computer program and can implement the steps and corresponding contents of the aforementioned method embodiment when executed by a processor. For details, please refer to the implementation methods provided in the above steps, which will not be repeated here.

[0216] The computer-readable storage medium may be an internal storage unit of the device or electronic device provided in any of the aforementioned embodiments, such as a hard disk or memory of the electronic device. The computer-readable storage medium may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the electronic device. The computer-readable storage medium may also include a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM). Furthermore, the computer-readable storage medium may include both an internal storage unit of the electronic device and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the electronic device. The computer-readable storage medium may also be used to temporarily store data that has been output or is about to be output.

[0217] The embodiments of the present disclosure further provide a computer program product, including a computer program, which can implement the steps and corresponding contents of the aforementioned method embodiments when executed by a processor.

[0218] The terms “first”, “second” and the like in the claims, the specification and the drawings of the present disclosure are used to distinguish different objects rather than to describe a specific order.

[0219] It should be understood that, although the flowcharts of the embodiments of the present disclosure indicate the various operation steps by arrows, the order of implementation of these steps is not limited to the order indicated by the arrows. Unless otherwise clearly stated herein, in some implementation scenarios of the embodiments of the present disclosure, the implementation steps in each flowchart can be performed in other orders as required. In addition, some or all of the steps in each flowchart may include multiple sub-steps or multiple stages based on the actual implementation scenario. Some or all of these sub-steps or stages can be executed at the same time, and each sub-step or stage in these sub-steps or stages can also be executed at different times. In scenarios where the execution times are different, the order of execution of these sub-steps or stages can be flexibly configured as required, and the embodiments of the present disclosure do not limit this.

[0220] Furthermore, those skilled in the art will appreciate that, unless otherwise specified, the singular forms "a," "an," "the," and "the" as used herein may include the plural forms. The terms "including," "having," and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or electronic device comprising a series of steps or elements is not limited to the listed steps or elements, but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, product, or electronic device.

[0221] Reference to "embodiments" herein means that the specific features, structures, or characteristics described in conjunction with the embodiments may be included in at least one embodiment of the present disclosure. The presentation of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is understood explicitly and implicitly by those skilled in the art that the embodiments described herein may be combined with other embodiments. The term "and / or" as used in this disclosure and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0222] In the embodiments of the present disclosure, the term "module" or "unit" refers to a computer program or portion of a computer program that has a predetermined function and works together with other related components to achieve a predetermined goal. The ... that can be implemented in whole or in part using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0223] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented using electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the above description generally describes the components and steps of each example according to their functions. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this disclosure.

[0224] The above description is only an optional implementation method for some implementation scenarios of the present disclosure. It should be pointed out that for ordinary technicians in this technical field, without departing from the technical concept of the solution of the present disclosure, other similar implementation methods based on the technical ideas of the present disclosure also fall within the protection scope of the embodiments of the present disclosure.

Claims

1. A data processing method, characterized in that: The data processing method includes: Acquire a data packet sent by an external device to an industrial control device; wherein the data packet is used to identify: the external device requests to establish a data connection with a target operating component in the industrial control device; parsing communication parameters of the data packet to determine whether the data packet is a suspicious data packet; If the data packet is a suspicious data packet, control the virtual operation component to establish a data connection with the external device, and obtain interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, control the target operation component to establish a data connection with the external device, specifically: Determining, based on the interaction log information, status information of the virtual operating component; wherein the status information includes any one of normal operation, stopped operation, or abnormal operation, and constructing, in advance based on the operating functions of each operating component in the industrial control device, a virtual operating component corresponding to the operating function of each operating component; If the status information indicates that the operation is stopped or the operation is abnormal, determining that the suspicious data packet is an attack data packet; If the status information indicates normal operation, determining that the suspicious data packet is not an attack data packet; If the interaction log information indicates that the suspicious data packet is an attack data packet, repair the target running component according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, control the target running component to establish a data connection with the external device, specifically: The repairing of the target running component according to the interaction log information includes: Determining attack information of the external device against the virtual running component according to the interaction log information; The attack information includes at least one of attack time information, attack trajectory information, attack location information, attack range, attack tool, information written by the external device to the virtual operation component, and information read by the external device from the virtual operation component; Repairing the target running component according to the attack information; During the interaction between the external device and the virtual operation component, if the external device does not attack the virtual operation component, the cause of the virtual operation component's cessation or abnormal operation is determined by parsing the interaction log information, namely, whether the external device attacked the virtual operation component or the target operation component itself has a defect; The controlling the virtual operation component to establish a data connection with the external device includes: Determining, based on the communication parameters, configuration information for interaction between the external device and the virtual operation component; wherein the configuration information includes a virtual topology structure and virtual configuration information; the virtual topology structure is constructed based on path information for establishing a data connection between the target operation component and the external device; and the virtual configuration information includes configuration information obtained by modifying network configuration information of the virtual operation component based on the communication parameters; Among them, the path information for establishing a data connection between the target operating component and the external device includes component information of other operating components in the path for establishing a data connection between the target operating component and the external device, and the connection order between the operating components in the path; the virtual topology structure includes a component topology structure formed after connecting the virtual operating component and the second virtual operating component corresponding to the other operating components in the path according to the connection order between the operating components in the path; the virtual topology structure also includes a third virtual operating component associated with the data exchange operation during the data exchange between the virtual operating component and the external device, and the path for data exchange between the third virtual operating component and the virtual operating component and the second virtual operating component; Execute the configuration information to control the virtual operation component to establish a data connection with the external device; The repair of the target running component includes: updating or upgrading the running program of the target running component; modifying the configuration parameters of the target running component; adding a security layer for the target running component; wherein the security layer includes a firewall and an intrusion detection system; modifying the communication parameters of the data packets associated with the target running component; encrypting or signing the data packets associated with the target running component; and adding a timestamp or serial number to the data packets associated with the target running component.

2. The data processing method according to claim 1, wherein: Determining whether the data packet is a suspicious data packet includes: If the communication parameters are not included in the preset reference communication parameters, determining that the data packet is a suspicious data packet; wherein the reference communication parameters are generated based on communication parameters of historical data packets interacting with the industrial control device; the communication parameters include at least one of a source Internet Protocol (IP) address, a destination IP address, a port number, a transport protocol, and a data payload; If the reference communication parameters include at least one of the communication parameters, it is determined that the data packet is not a suspicious data packet.

3. The data processing method according to claim 1, wherein: The virtual operation component is constructed based on the operation function of the target operation component in at least one of the following ways: Simulating a traffic pattern of the target operating component; Simulating communication parameters of the target operating component; Simulate the operating parameter information of the target operating component.

4. A data processing device, characterized in that: The data processing device includes: A data packet acquisition module is used to acquire a data packet sent by an external device to an industrial control device; wherein the data packet is used to identify: the external device requests to establish a data connection with a target operating component in the industrial control device; a data packet parsing module, configured to parse communication parameters of the data packet to determine whether the data packet is a suspicious data packet; and A data interaction module is configured to: if the data packet is a suspicious data packet, control the virtual operation component to establish a data connection with the external device, and obtain interaction log information between the virtual operation component and the external device; wherein the virtual operation component is constructed based on the operation function of the target operation component; if the data packet is a non-suspicious data packet, control the target operation component to establish a data connection with the external device, specifically: Determine the status information of the virtual operation component according to the interaction log information; wherein the status information includes any one of normal operation, stopped operation, or abnormal operation; If the status information indicates that the operation is stopped or the operation is abnormal, determining that the suspicious data packet is an attack data packet; If the status information indicates normal operation, determining that the suspicious data packet is not an attack data packet; If the interaction log information indicates that the suspicious data packet is an attack data packet, repair the target running component according to the interaction log information; if the interaction log information indicates that the suspicious data packet is not an attack data packet, control the target running component to establish a data connection with the external device, specifically: The repairing of the target running component according to the interaction log information includes: Determining attack information of the external device against the virtual running component according to the interaction log information; The attack information includes at least one of attack time information, attack trajectory information, attack location information, attack range, attack tool, information written by the external device to the virtual operation component, and information read by the external device from the virtual operation component; Repairing the target running component according to the attack information; During the interaction between the external device and the virtual operation component, if the external device does not attack the virtual operation component, further analysis of the interaction log information is performed to determine the cause of the virtual operation component's cessation or abnormal operation, whether it is an attack by the external device on the virtual operation component or a defect in the target operation component itself; The data interaction module is used to: determine, based on the communication parameters, configuration information for interaction between the external device and the virtual operation component; wherein the configuration information includes a virtual topology structure and virtual configuration information; the virtual topology structure is constructed based on the path information for establishing a data connection between the target operation component and the external device; the virtual configuration information includes configuration information obtained by modifying the network configuration information of the virtual operation component based on the communication parameters; wherein the path information for establishing a data connection between the target operation component and the external device includes component information of other operation components in the path for establishing a data connection between the target operation component and the external device, and a connection sequence between each operation component in the path; the virtual topology structure includes a component topology structure formed after connecting the virtual operation component and the second virtual operation component corresponding to the other operation components in the path according to the connection sequence between each operation component in the path; the virtual topology structure also includes a third virtual operation component associated with the data exchange operation during the data exchange between the virtual operation component and the external device, and a path for data exchange between the third virtual operation component, the virtual operation component, and the second virtual operation component; Execute the configuration information to control the virtual operation component to establish a data connection with the external device; The repair of the target running component includes: updating or upgrading the running program of the target running component; modifying the configuration parameters of the target running component; adding a security layer for the target running component; wherein the security layer includes a firewall and an intrusion detection system; modifying the communication parameters of the data packets associated with the target running component; encrypting or signing the data packets associated with the target running component; and adding a timestamp or serial number to the data packets associated with the target running component.

5. An electronic device, characterized in that: comprising a processor and a memory, wherein the processor and the memory are connected to each other; The memory is used to store computer programs; The processor is configured to execute the method according to any one of claims 1 to 3 when calling the computer program.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.

Images