Industrial control network topology restoration method and device

Abstract

The invention provides an industrial control network topology restoration method and device, and the method comprises the steps: obtaining the target data information of a node in a detected industrial control network through passive sniffing and active detection, and directly determining the IP-level network topology of the detected industrial control network; subnet information and alias information are extracted from a message of a routing protocol of the tested industrial control network, alias relations between network addresses of the network topology of the IP level are obtained and aggregated, router nodes are restored, and the primary network topology of the tested industrial control network is determined; based on an identification method matched with the type of the anonymous router, the anonymous router in the primary network topology is identified, false nodes and false links caused by the anonymous router in the primary network topology are eliminated, and when a large number of nodes which cannot be identified appear in detection data, the false nodes and the false links in the primary network topology can be eliminated. And the network topology of the tested industrial control network can be restored more completely.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and device for restoring industrial control network topology. Background Art

[0002] The existing network topology restoration method is mainly based on Traceroute-like topology detection technology. It sends detection messages through Traceroute or related tools, and uses a mechanism to limit the TTL size so that the message is discarded when it reaches the target node and becomes unreachable. The target node returns a data packet, from which the network address information of the node under test is extracted. The network topology restoration is completed by analyzing and processing the network address information of the node under test.

[0003] There are two problems when restoring the industrial control network topology using the existing network topology restoration methods: First, since the open ports and communication protocols of most devices in the industrial control network are quite different from those of traditional Internet devices, sending probe messages directly through Traceroute or related tools may not get a response; Second, since most routers in the industrial control network are set not to respond to probe messages, or due to network congestion, network failures, router rate limitations, etc., the probe source may not be able to obtain information fed back by the measured nodes, resulting in a large number of unrecognizable nodes in the data, and the network topology restored based on this is not accurate. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a method and device for restoring the topology of an industrial control network, which can more accurately restore the network topology of the industrial control network under test when unrecognizable nodes appear in the data of the tested nodes.

[0005] An embodiment of the present application provides a method for restoring an industrial control network topology, the method comprising:

[0006] Obtain target data information of nodes in the industrial control network under test through passive sniffing and active detection, and determine the IP-level network topology of the industrial control network under test based on the target data information of the nodes in the target industrial control network;

[0007] Extract subnet information and alias information from the routing protocol message of the industrial control network under test, and obtain the alias relationship between network addresses of the IP-level network topology;

[0008] Based on the alias relationship between the network addresses of the IP-level network topology, the router nodes are restored to determine the primary network topology of the industrial control network under test;

[0009] Based on the identification method matching the type of anonymous routers, the anonymous routers in the primary network topology are identified, the false nodes and false links caused by the anonymous routers in the primary network topology are eliminated, and the target network topology of the industrial control network under test is restored.

[0010] In some embodiments, in the industrial control network topology restoration method, the types of the anonymous routers include single-hop anonymous routers and multi-hop anonymous routers; the identification method based on matching with the type of anonymous routers, identifying the anonymous routers in the primary network topology, includes:

[0011] Identify single-hop anonymous routers based on data reception delay analysis results;

[0012] Multi-hop anonymous routers are clustered by node link expansion, and the multi-hop anonymous routers are identified by using a network hierarchy analysis method.

[0013] In some embodiments, in the industrial control network topology restoration method, identifying a single-hop anonymous router based on a data reception delay analysis result includes:

[0014] Determine a first local topology structure of the primary network topology where only one anonymous router hop passes between known router nodes;

[0015] For the first local topology, a detection data packet is sent from a starting node to a destination node to obtain a time delay of each link between the starting node and the destination node;

[0016] Different links are distinguished based on different time delays, and anonymous routers belonging to the same link are merged;

[0017] and / or,

[0018] Clustering multi-hop anonymous routers by node link expansion and identifying the multi-hop anonymous routers by using a network hierarchy analysis method includes:

[0019] Determine a second local topology structure between the known router nodes and the known router nodes through a multi-hop anonymous router; the second local topology structure includes a multi-hop anonymous link;

[0020] Clustering multi-hop anonymous links to obtain a mesh structure, using the mutual connections between different tree topologies and clustered anonymous routers, inferring the overlapping links between topologies, determining the relationship between known nodes in the multi-hop anonymous links, and obtaining the pre-processed multi-hop anonymous links;

[0021] Based on a preset extension threshold, the preprocessed multi-hop anonymous link is extended to the head end and / or tail end, and the anonymous routers are clustered according to the mutual relationship between the extended nodes to obtain the tree topology structure of each multi-hop anonymous link and the relationship between different anonymous routers;

[0022] According to the tree topology of each multi-hop anonymous link and the relationship between different anonymous routers, the multi-hop anonymous routers are merged using the independent sharing criterion to complete the multi-hop anonymous router identification.

[0023] In some embodiments, in the industrial control network topology restoration method, different links are distinguished according to different time delays, and anonymous routers belonging to the same link are merged, including:

[0024] Determine the types of network structures of different links between the starting node and the destination node; the types of network structures include parallel network structure, star network structure, and staggered network structure;

[0025] For the parallel network structure, different links are distinguished based on the difference of different time delays between the starting node and the destination node, and the delay analysis result between the starting node and the destination node is determined; wherein, when the difference of the time delays of two links is less than the preset delay time threshold, the two links pass through the same anonymous router;

[0026] For the star network structure, based on the peak number and link number of the delay distribution diagram of the time delay between the starting node and the destination node, it is judged whether the link between the starting node and the destination node is real, and the delay analysis result between the starting node and the destination node is determined;

[0027] For the staggered network structure, the time delay from the starting node to different destination nodes is counted to construct the delay covariance matrix; the covariance value between two destination nodes represents the shared path information between the two destination nodes;

[0028] Based on the covariance value in the delay covariance matrix, determine whether different destination nodes share a link, and determine the delay analysis result between the starting node and the destination node;

[0029] Based on the delay analysis result between the starting node and the destination node, different links are distinguished and anonymous routers belonging to the same link are merged.

[0030] In some embodiments, in the industrial control network topology restoration method, based on a preset expansion threshold, expansion is performed toward the head end and / or tail end of the preprocessed multi-hop anonymous link, and anonymous routers are clustered according to the mutual relationship between the expansion nodes, and the tree topology structure of each multi-hop anonymous link and the relationship between different anonymous routers are obtained, including:

[0031] The preprocessed multi-hop anonymous link is expanded with its corresponding starting node and / or destination node, with first-order expansion as the initial goal, and further expanded when it does not exceed the preset expansion threshold and does not reach the clustering target, and all expanded nodes are marked as unclustered;

[0032] Traverse the extended nodes of the initial node in each multi-hop anonymous link, and compare them with the elements in the {extended node, initial node} set of other links one by one. If the same node is found, merge them into the same node; if no same node is found, perform the next node expansion within the preset expansion threshold until a new cluster is found or no clusterable node is found when the node expansion threshold is reached;

[0033] According to the clustering results, the unclustered extended nodes are pruned and the relevant data are saved.

[0034] In some embodiments, in the industrial control network topology restoration method, based on the tree topology structure of each multi-hop anonymous link and the relationship between different anonymous routers, the multi-hop anonymous routers are merged using an independent sharing criterion to complete the multi-hop anonymous router identification, including:

[0035] The tree topology of each multi-hop anonymous link and the relationship between different anonymous routers;

[0036] Establish the tree topology result of multi-hop anonymous links and the constraint relationship between anonymous routers after clustering, list the equations to solve, and determine the solution results;

[0037] The distribution of anonymous routers on the multi-hop anonymous link is deduced from the solution results, and the identification of multi-hop anonymous routers is completed.

[0038] In some embodiments, in the industrial control network topology restoration method, the step of acquiring target data information of nodes in the industrial control network under test by passive sniffing and active detection includes:

[0039] Deploy a sniffing tool in the industrial control network under test to obtain the data flow in the industrial control network under test;

[0040] Parsing the data flow in the industrial control network under test, analyzing the communication protocol adopted by the business data in the data flow, and preliminarily determining the software information, device information and bearer business information in the industrial control network under test;

[0041] Based on data sniffing and protocol analysis, a specific protocol data packet is constructed and sent to obtain the basic attribute information and business attribute information of the network nodes in the industrial control network under test through active detection;

[0042] Preprocessing software information, device information, bearer service information, basic attribute information and service attribute information in the industrial control network under test to obtain preprocessed node data information;

[0043] The pre-processed node data information is analyzed and compared with the industrial control equipment feature database to locate the target data information of the nodes in the industrial control network under test.

[0044] In some embodiments, in the industrial control network topology restoration method, determining the IP-level network topology of the industrial control network under test based on the target data information of the nodes in the target industrial control network includes:

[0045] Based on the target data information of the nodes in the target industrial control network, the IP-level network topology of the industrial control network under test is preliminarily restored; each node in the IP-level network topology represents an IP address.

[0046] In some embodiments, in the industrial control network topology restoration method, extracting subnet information and alias information from the message of the routing protocol of the industrial control network under test to obtain the alias relationship between network addresses of the IP-level network topology includes:

[0047] Extract the node's IP address, IP alias information and IP subnet from the routing protocol message of the industrial control network under test;

[0048] Performing a graph analysis on the IP-level network topology of the industrial control network under test and the IP addresses, IP alias information and IP subnets of the nodes to obtain the alias relationship between the IP addresses;

[0049] Accordingly, the alias relationship between the network addresses of the network topology at the IP level is aggregated to restore the router node, including:

[0050] Aggregate the IP addresses belonging to the same router and restore the router node.

[0051] In some embodiments, a method and device for restoring an industrial control network topology is also provided, the device comprising:

[0052] A determination module is used to obtain target data information of nodes in the industrial control network under test through passive sniffing and active detection, and determine the IP-level network topology of the industrial control network under test based on the target data information of the nodes in the target industrial control network;

[0053] An extraction module is used to extract subnet information and alias information from the message of the routing protocol of the industrial control network under test, and obtain the alias relationship between the network addresses of the network topology at the IP level;

[0054] A first restoration module is used to aggregate the alias relationship between the network addresses of the IP-level network topology, restore the router nodes, and determine the primary network topology of the industrial control network under test;

[0055] The second restoration module is used to identify the anonymous routers in the primary network topology based on the identification method matching the type of the anonymous router, eliminate the false nodes and false links caused by the anonymous routers in the primary network topology, and restore the target network topology of the industrial control network under test.

[0056] In an embodiment of the present application, a method and device for restoring an industrial control network topology are provided. The method obtains target data information of nodes in a tested industrial control network through passive sniffing and active detection, and determines the IP-level network topology of the tested industrial control network based on the target data information of the nodes in the target industrial control network; extracts subnet information and alias information from the message of the routing protocol of the tested industrial control network to obtain the alias relationship between the network addresses of the IP-level network topology; performs aggregation based on the alias relationship between the network addresses of the IP-level network topology, restores the router nodes, and determines the primary network topology of the tested industrial control network; identifies anonymous routers in the primary network topology based on an identification method matching the type of anonymous routers, eliminates false nodes and false links caused by anonymous routers in the primary network topology, and restores the target network topology of the tested industrial control network; the method can complete the clustering and identification of anonymous nodes through a multi-dimensional feature clustering method when encountering packet loss in industrial control network asset detection, and when a large number of unrecognizable nodes appear in the detection data due to failure to obtain a response message due to firewall rule restrictions or network bandwidth restrictions, thereby improving the accuracy of industrial control network topology restoration and restoring a more complete industrial control network topology. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A flowchart of the industrial control network topology restoration method described in an embodiment of the present application is shown;

[0059] Figure 2 A flow chart of a method for acquiring target data information of a node in a tested industrial control network through passive sniffing and active detection according to an embodiment of the present application is shown;

[0060] Figure 3A schematic diagram of a parallel network structure of a single-hop anonymous network according to an embodiment of the present application is shown;

[0061] Figure 4 Shows the simplified Figure 3 The schematic diagram of the ideal parallel network structure shown;

[0062] Figure 5 A schematic diagram of a star network structure of a single-hop anonymous network according to an embodiment of the present application is shown;

[0063] Figure 6 Shows the simplified Figure 5 The schematic diagram of the ideal star network structure shown;

[0064] Figure 7 A schematic diagram showing an interlaced network structure of a single-hop anonymous link according to an embodiment of the present application is shown;

[0065] Figure 8 Shows the simplified Figure 7 The schematic diagram of the ideal situation of the staggered network structure shown;

[0066] Figure 9-10 A schematic diagram of adjacency clustering based on start node link extension is shown;

[0067] Figure 11-Figure 12 A schematic diagram showing adjacency clustering of destination node link extensions;

[0068] Figure 13-Figure 14 A schematic diagram of adjacency clustering based on end node link extension is shown;

[0069] Fig.15 A schematic diagram of anonymous router topology obtained by network tomography according to an embodiment of the present application is shown;

[0070] Fig.16 A structural schematic diagram of an industrial control network topology restoration method and device described in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0071] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0072] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0073] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0074] The existing network topology restoration method is mainly based on Traceroute-like topology detection technology. It sends detection messages through Traceroute or related tools, and uses a mechanism to limit the TTL size so that the message is discarded when it reaches the target node and becomes unreachable. The target node returns a data packet, from which the network address information of the node under test is extracted. The network topology restoration is completed by analyzing and processing the network address information of the node under test.

[0075] There are two problems when restoring the industrial control network topology using the existing network topology restoration methods: First, since the open ports and communication protocols of most devices in the industrial control network are quite different from those of traditional Internet devices, sending probe messages directly through Traceroute or related tools may not get a response; Second, since most routers in the industrial control network are set not to respond to probe messages, or due to network congestion, network failures, router rate limitations, etc., the probe source may not be able to obtain information fed back by the measured nodes, resulting in a large number of unrecognizable nodes in the data, and the network topology restored based on this is not accurate.

[0076] Based on this, in an embodiment of the present application, a method and device for restoring the topology of an industrial control network are provided. The method obtains target data information of nodes in the industrial control network under test through passive sniffing and active detection, and determines the IP-level network topology of the industrial control network under test based on the target data information of the nodes in the target industrial control network; extracts subnet information and alias information from the message of the routing protocol of the industrial control network under test, and obtains the alias relationship between the network addresses of the IP-level network topology; performs aggregation based on the alias relationship between the network addresses of the IP-level network topology, restores the router node, and determines the primary network topology of the industrial control network under test; identifies the anonymous routers in the primary network topology based on the identification method matching the type of anonymous routers, eliminates the false nodes and false links caused by the anonymous routers in the primary network topology, and restores the target network topology of the industrial control network under test; the method can complete the clustering and identification of anonymous nodes through a multi-dimensional feature clustering method when encountering packet loss in industrial control network asset detection, and the inability to obtain a response message due to firewall rule restrictions or network bandwidth restrictions, resulting in a large number of unrecognizable nodes in the detection data, thereby improving the accuracy of industrial control network topology restoration and restoring a more complete industrial control network topology.

[0077] Please refer to Figure 1 , Figure 1 A flowchart of the industrial control network topology restoration method described in an embodiment of the present application is shown; the industrial control network topology restoration method comprises the following steps S101-104:

[0078] S101, obtaining target data information of nodes in the industrial control network under test through passive sniffing and active detection, and determining the IP-level network topology of the industrial control network under test based on the target data information of the nodes in the target industrial control network;

[0079] S102, extracting subnet information and alias information from the message of the routing protocol of the industrial control network under test, and obtaining the alias relationship between the network addresses of the network topology at the IP level;

[0080] S103, performing aggregation based on the alias relationship between the network addresses of the IP-level network topology, restoring the router nodes, and determining the primary network topology of the industrial control network under test;

[0081] S104: Based on an identification method that matches the type of anonymous routers, identify anonymous routers in the primary network topology, eliminate false nodes and false links caused by anonymous routers in the primary network topology, and restore the target network topology of the industrial control network under test.

[0082] In the step S101, target data information of nodes in the industrial control network under test is obtained through passive sniffing and active detection, and the IP-level network topology of the industrial control network under test is determined based on the target data information of the nodes in the target industrial control network.

[0083] In this step, we first need to collect the target data information of the nodes in the industrial control network. Specifically, we obtain basic node information including network address, open ports, communication protocol, survival status, etc., as well as business attribute information such as device model, software version, and working status through passive sniffing and active detection. Then, we perform statistical analysis on the collected data, including data cleaning, outlier removal, feature extraction, etc., to ensure the quality and integrity of the data. The key to this step is to accurately obtain the data information of the industrial control network nodes and effectively process and analyze them.

[0084] For details, please refer to Figure 2 The method of acquiring target data information of nodes in the industrial control network under test by passive sniffing and active detection includes the following steps S201-S205:

[0085] S201, deploying a sniffing tool in the industrial control network under test to obtain data flow in the industrial control network under test;

[0086] S202, parsing the data flow in the industrial control network under test, analyzing the communication protocol used by the business data in the data flow, and preliminarily determining the software information, device information and bearer business information in the industrial control network under test;

[0087] S203, based on data sniffing and protocol analysis, construct and send a specific protocol data packet, and obtain basic attribute information and business attribute information of network nodes in the industrial control network under test by active detection;

[0088] S204, preprocessing software information, device information, bearer service information, basic attribute information and service attribute information in the industrial control network under test to obtain preprocessed node data information;

[0089] S205: Analyze and compare the pre-processed node data information with the industrial control equipment feature database to locate the target data information of the nodes in the industrial control network under test.

[0090] In steps S201 and S202, by deploying a sniffing tool in the industrial control network, the data flow in the network is acquired and parsed, and by analyzing the communication protocol adopted by the business data in the network, a preliminary judgment is made on the software and equipment that may exist in the network, as well as the main business carried by the entire network.

[0091] In the step S203, the basic attribute information of the network node includes basic information such as network address, open port, survival status, etc., and the service attribute information includes device model, software version, working status, etc.

[0092] In steps S204 and S205, the acquired node data of various types are cleaned and integrated to obtain target data information of the nodes in the industrial control network under test. Specifically, the collected node information data is statistically analyzed, including data cleaning, removal of outliers, feature extraction and other processing to ensure the quality and integrity of the data; on this basis, the node data is integrated by analyzing and comparing with the industrial control equipment feature database, and the device category, main function and other related information of the node are basically located.

[0093] In some embodiments, specifically, after the target data information of the node in the industrial control network under test is located, the target data information is stored and managed.

[0094] In the embodiment of the present application, a complete industrial control data storage and management system is constructed to store and manage the industrial control network node information data that has been screened and integrated, providing a basis for the next step of network topology restoration.

[0095] After processing and obtaining the target data information of the nodes in the industrial control network under test, the IP-level network topology of the industrial control network under test is determined based on the target data information of the nodes in the target industrial control network. Specifically, based on the target data information of the nodes in the target industrial control network, the IP-level network topology of the industrial control network under test is preliminarily restored; each node in the IP-level network topology represents an IP address.

[0096] The IP-level network topology can be directly obtained by using the target data information of the industrial control network node obtained. However, since each router has at least two or more interfaces, and each interface has a network address, a router will be represented by two or more nodes in the IP-level network topology, which is inconsistent with the actual situation. Therefore, the method described in the embodiment of the present application first performs IP-level network topology inference on the detected network node data information, and then extracts subnet information and alias information from the message of the routing protocol in the tested industrial control network, and finally obtains the alias relationship between the network addresses for aggregation to finally restore the router node.

[0097] In the step S102, subnet information and alias information are extracted from the message of the routing protocol of the industrial control network under test, and the alias relationship between the network addresses of the IP-level network topology is obtained.

[0098] Extract the node's IP address, IP alias information and IP subnet from the routing protocol message of the industrial control network under test;

[0099] Performing a graph analysis on the IP-level network topology of the industrial control network under test and the IP addresses, IP alias information and IP subnets of the nodes to obtain the alias relationship between the IP addresses;

[0100] Correspondingly, in the step S103, the alias relationship between the network addresses of the IP-level network topology is aggregated to restore the router node, including:

[0101] Aggregate the IP addresses belonging to the same router and restore the router node.

[0102] So far, through the first aggregation, the false router nodes caused by the subnet and alias of the router have been eliminated, and the router nodes in the primary network topology of the industrial control network under test have been preliminarily determined; after the router alias resolution of the obtained data, the number of nodes in the network topology diagram will be reduced accordingly, but there are still many false links caused by the large number of anonymous routers. It is necessary to further eliminate the false nodes and false links caused by anonymous routers based on the obtained primary network topology.

[0103] Based on this, in step S104, based on the identification method matching the type of anonymous routers, the anonymous routers in the primary network topology are identified, the false nodes and false links caused by the anonymous routers in the primary network topology are eliminated, and the target network topology of the industrial control network under test is restored.

[0104] The types of anonymous routers include single-hop anonymous routers and multi-hop anonymous routers; single-hop anonymous routers are identified based on data reception delay analysis results, multi-hop anonymous routers are clustered based on node link expansion, and multi-hop anonymous routers are identified using a network hierarchy analysis method.

[0105] Identify single-hop anonymous routers based on data reception delay analysis results, including:

[0106] Determine a first local topology structure of the primary network topology where only one anonymous router hop passes between known router nodes;

[0107] For the first local topology, a detection data packet is sent from a starting node to a destination node to obtain a time delay of each link between the starting node and the destination node;

[0108] Different links are distinguished according to different time delays, and anonymous routers belonging to the same link are merged.

[0109] After the anonymous routers belonging to the same link are merged, the false nodes and false links caused by the anonymous routers in the primary network topology are eliminated.

[0110] Clustering multi-hop anonymous routers by node link expansion and identifying the multi-hop anonymous routers by using a network hierarchy analysis method includes:

[0111] Determine a second local topology structure between the known router nodes and the known router nodes through a multi-hop anonymous router; the second local topology structure includes a multi-hop anonymous link;

[0112] Clustering multi-hop anonymous links to obtain a mesh structure, using the mutual connections between different tree topologies and clustered anonymous routers, inferring the overlapping links between topologies, determining the relationship between known nodes in the multi-hop anonymous links, and obtaining the pre-processed multi-hop anonymous links;

[0113] Based on a preset extension threshold, the preprocessed multi-hop anonymous link is extended to the head end and / or tail end, and the anonymous routers are clustered according to the mutual relationship between the extended nodes to obtain the tree topology structure of each multi-hop anonymous link and the relationship between different anonymous routers;

[0114] According to the tree topology of each multi-hop anonymous link and the relationship between different anonymous routers, the multi-hop anonymous routers are merged using the independent sharing criterion to complete the multi-hop anonymous router identification.

[0115] After the multi-hop anonymous router identification is completed, the false nodes and false links caused by the anonymous routers in the primary network topology can be eliminated, and the target network topology of the industrial control network to be tested can be restored.

[0116] That is to say, for the local topology structure where only one hop of anonymous router passes between known nodes, a large number of detection data packets are sent from the starting node to the destination node and the time delay is counted. Different links are distinguished according to different time delays, so that the anonymous routers belonging to the same link are merged.

[0117] For the local topological structure between known nodes through multi-hop anonymous routers, first cluster the multi-hop anonymous links to obtain a mesh structure. Using the mutual connections between different tree topologies and clustered anonymous routers, infer the overlapping links between topologies, and make relationship judgments on the known nodes in the anonymous links. On this basis, set a threshold and expand the relationship judgment to the entire link. The link is extended to a certain length from the beginning to the end according to the threshold, and the anonymous routers are clustered according to the mutual relationship between the extended nodes. After the anonymous routers are clustered, the tree topological structure of each multi-hop anonymous router link and the relationship between different anonymous routers can be obtained. On this basis, constraints are established between the two, equations are listed for solution, and the multi-hop anonymous routers are merged using the independent sharing criterion. The multi-hop anonymous router identification can be completed, and a more accurate network topology can be restored in the end.

[0118] It can be seen that in the embodiment of the present application, based on the characteristics of the anonymous router, features of different dimensions are obtained for clustering, thereby completing efficient identification of the anonymous router.

[0119] Therefore, in the present application, the industrial control network topology restoration method based on multidimensional feature clustering can improve the accuracy of industrial control network topology restoration by accurately detecting node information in the industrial control network and efficiently identifying anonymous routers.

[0120] Different links are distinguished based on different time delays, and anonymous routers belonging to the same link are merged, including:

[0121] Determine the types of network structures of different links between the starting node and the destination node; the types of network structures include parallel network structure, star network structure, and staggered network structure;

[0122] For the parallel network structure, different links are distinguished based on the difference of different time delays between the starting node and the destination node, and the delay analysis result between the starting node and the destination node is determined; wherein, when the difference of the time delays of two links is less than the preset delay time threshold, the two links pass through the same anonymous router;

[0123] For the star network structure, based on the peak number and link number of the delay distribution diagram of the time delay between the starting node and the destination node, it is judged whether the link between the starting node and the destination node is real, and the delay analysis result between the starting node and the destination node is determined;

[0124] For the staggered network structure, the time delay from the starting node to different destination nodes is counted to construct the delay covariance matrix; the covariance value between two destination nodes represents the shared path information between the two destination nodes;

[0125] Based on the covariance value in the delay covariance matrix, determine whether different destination nodes share a link, and determine the delay analysis result between the starting node and the destination node;

[0126] Based on the delay analysis result between the starting node and the destination node, different links are distinguished and anonymous routers belonging to the same link are merged.

[0127] Specifically, a detection data packet is sent and a delay analysis is performed: a starting node and a destination node are selected, a certain number of data packets are sent from the starting node to the destination node, and the delay result of the data packets reaching the destination node is counted.

[0128] For different types of network structures in a single-hop anonymous network, different delay analysis methods are used to analyze and cluster delay results. In other words, further, for single-hop anonymous routers in different types of network structures, different delay analysis methods are used to analyze and cluster delay results to identify the single-hop anonymous routers.

[0129] The following describes the delay result analysis and clustering for the parallel network structure, star network structure, and staggered network structure respectively.

[0130] Latency analysis and clustering for parallel network structures: Please refer to Figure 3 , Figure 3 The schematic diagram of the parallel network structure of the single-hop anonymous network described in the embodiment of the present application is shown; for the parallel network structure shown in the following figure, that is, device A and device B are connected through multiple links, each link has and only has one anonymous router, and the two end nodes of the anonymous router are exactly the same, both are device A and device B. Among them, device A can also be called node A, and device B can also be called node B.

[0131] Count the delay of the data packet sent from node A to node B. If the transmission delays are the same or very similar, the two links should pass through the same anonymous router. On the contrary, if the transmission delays differ greatly, then the two links should not pass through the same anonymous router. Figure 3 The ideal parallel network structure shown is as follows Figure 4 shown.

[0132] Delay analysis and clustering for star network structure: please refer to Figure 5 , Figure 5 The star network structure diagram of the single-hop anonymous network described in the embodiment of the present application is shown; Figure 5The star network structure shown in the figure includes four known nodes (known routers) A, B, C, and D, which can communicate with each other. If the anonymous routers in the figure are regarded as part of the connecting line, the figure composed of these four known routers is a "completely connected graph". Node A can communicate with the other three known nodes, and the communication process passes through an anonymous router node; similarly, node B can also communicate with the other three known nodes, and the communication process also needs to pass through an anonymous router node. All known nodes can communicate with each other, and the communication process passes through one or more anonymous routers. Both ends of each anonymous router are connected to known routers.

[0133] Statistics are collected on the delay of data packets sent from node A to nodes B, C, and D. The delay value from the source node to the destination node is monitored to obtain a delay distribution graph. Based on the distribution of the peak value of the delay distribution graph, specific analysis can be performed:

[0134] ① The delay distribution diagram from node A to destination node B has 5 peaks (this situation is abnormal and may occur when some links are in congestion), which means that the detection message reaches the destination node B through 5 different paths. There are indeed 5 ways to reach node B from node A, so it can be determined that all the links in the above figure are real links.

[0135] ② The delay distribution diagram from the source node to the destination node B has three peaks. Considering the routing selection problem during actual message transmission, the actual message will give priority to the path with a shorter path length during transmission. It can be basically determined that all links in the star structure are real.

[0136] ③ The delay distribution graph from the source node to the destination node has two peaks, which means that among the three paths A-*-C-*-B, A-*-D-*-B, and A-*-B, one of them is a virtual path.

[0137] ④ The delay distribution graph from the source node to the destination node has only one peak, which means that there is only one link from node A to destination node B, that is, all the anonymous routers marked in the star topology are the same anonymous router.

[0138] Simplified Figure 5 The ideal situation of the star structure network is shown as Figure 6 shown.

[0139] Latency analysis and clustering for interleaved network structures: Please refer to Figure 7 , Figure 7 A schematic diagram showing the interlaced network structure of the single-hop anonymous link according to the embodiment of the present application is shown; Figure 7The interlaced network structure shown, that is, the number of source nodes and destination nodes on both sides of the anonymous router is not less than 2, and the communication between these known nodes must pass through at least one anonymous router.

[0140] Statistics are collected on the delay of data packets sent from node A to nodes C, D, and E, and the delay information in the data packets is extracted to construct a delay covariance matrix. The covariance value between nodes represents the shared path information between the two nodes. Determine whether the destination nodes C, D, and E share a link. If δ(CD)>0, δ(CD) represents the covariance between nodes C and D; this indicates that there is a one-hop shared link between nodes C and D. The same method can be used to determine the shared link between nodes D and E, nodes C and E, and nodes C, D, and E. The same method is used to perform statistical analysis on the delay of the detection data packets sent from node B to nodes C, D, and E. The ultimate ideal situation is that all anonymous routers passed through during the communication between all source nodes and destination nodes are the same anonymous router, such as Figure 8 shown.

[0141] Based on the preset extension threshold, the preprocessed multi-hop anonymous link is extended to the head end and / or tail end, and the anonymous routers are clustered according to the mutual relationship between the extended nodes, so as to obtain the tree topology structure of each multi-hop anonymous link and the relationship between different anonymous routers, including:

[0142] The preprocessed multi-hop anonymous link is expanded with its corresponding starting node and / or destination node, with first-order expansion as the initial goal, and further expanded when it does not exceed the preset expansion threshold and does not reach the clustering target, and all expanded nodes are marked as unclustered;

[0143] Traverse the extended nodes of the initial node in each multi-hop anonymous link, and compare them with the elements in the {extended node, initial node} set of other links one by one. If the same node is found, merge them into the same node; if no same node is found, perform the next node expansion within the preset expansion threshold until a new cluster is found or no clusterable node is found when the node expansion threshold is reached;

[0144] According to the clustering results, the unclustered extended nodes are pruned and the relevant data are saved.

[0145] The following specifically explains the three types of adjacency clustering: "adjacency clustering based on start node link extension", "adjacency clustering based on destination node link extension", and "adjacency clustering based on end node link extension".

[0146] The adjacency clustering based on the extension of the start node link specifically includes the following steps A1-A4:

[0147] A1. Expand the preprocessed links with their corresponding starting nodes, with first-order expansion as the initial target. Further expansion is performed when the expansion threshold is not exceeded and the clustering target is not reached, and all expanded nodes are marked as unclustered.

[0148] A2, traverse the extended nodes of the initial node in each link, and compare them with the elements in the {extended node, initial node} set of other links one by one. If the same node is found, merge them into the same node and jump directly to step A4. If no same node is found, return to step A1 to perform the next node expansion within the expansion threshold;

[0149] A3, repeating steps A1 and A2 until a new cluster is found or no clusterable nodes are found when the node expansion threshold is reached;

[0150] A4. According to the clustering results, the unclustered extended nodes are pruned and the relevant data is saved.

[0151] Please refer to Fig. 9 and Fig.10 , Figure 9-10 A schematic diagram of adjacency clustering based on start node link extension is shown; wherein, Fig. 9 These are two pre-processed links with A and B as the starting nodes. The links with the same starting nodes have been clustered together. Based on the pre-processing results, it can be found that the two links have no direct connection. The right figure expands the two links outward from their starting nodes in the first order. The first-order expansion node A1 of node A and the first-order expansion node B1 of node B are the same node. Based on this, the two links can be further clustered, and the expansion nodes A1 and B1 in the two links are merged into the same node as the new source node. In order to reduce the complexity of processing the expanded links, they also need to be "pruned", that is, the remaining expansion nodes outside the merger are deleted.

[0152] Adjacency clustering based on destination node link extension specifically includes the following steps B1-B4:

[0153] B1, expand the preprocessed links with their corresponding destination nodes, with first-order expansion as the initial goal, and further expand when it does not exceed the expansion threshold and does not reach the clustering target, and mark all expanded nodes as unclustered;

[0154] B2, traverse the extended nodes of the destination node in each link, and compare them with the elements in the {extended node, destination node} set of other links one by one. If the same node is found, merge them into the same node and jump directly to step B4. If no same node is found, return to step B1 to perform the next node expansion within the expansion threshold;

[0155] B3, repeating steps B1 and B2 until a new cluster is found or no clusterable nodes are found when the node expansion threshold is reached;

[0156] B4. According to the clustering results, prune the non-clustered extended nodes and save the relevant data.

[0157] Please refer to Figure 11-Figure 12 , Figure 11-Figure 12 A schematic diagram showing adjacency clustering of destination node link extensions; Fig.11 There are two pre-processed links with A and B as the starting nodes. The destination nodes of node A are C, D, and E, and the destination nodes of node B are F and G. No further clustering relationship can be found from these two pre-processed links. Fig.12 The first-order expansion of the two links for the destination nodes is performed, where the expansion node of destination node C is C1, the expansion nodes of destination node D are D1 and D2, the expansion node of destination node E is E1, the expansion node of destination node F is F1, and no first-order expansion node is found for destination node G. After one-to-one comparison, it is found that the destination node E and the expansion node F1 of destination node F are the same node. Based on this, the two links are further clustered, and the remaining nodes are "pruned". According to the clustering results, the non-clustered expansion nodes are pruned and the relevant data is saved.

[0158] Adjacency clustering based on end node link extension specifically includes the following steps C1-C4:

[0159] C1, expand the end nodes corresponding to the preprocessed links outward, with the first-order expansion as the initial goal, and further expand when it does not exceed the expansion threshold and does not reach the clustering target, and mark all expanded nodes as unclustered;

[0160] C2, traverse the extended nodes of the end nodes of each link, and compare them with the elements in the set of {extended node, initial node, destination node} of other links one by one. If the same node is found, merge them into the same node and jump directly to step C4. If no same node is found, return to step C1 to perform the next node expansion within the expansion threshold;

[0161] C3, repeat steps C1 and C2 until a new cluster is found or no clusterable nodes are found when the node expansion threshold is reached;

[0162] C4. According to the clustering results, prune the non-clustered extended nodes and save the relevant data.

[0163] Please refer to Figure 13-Figure 14 , Figure 13-Figure 14A schematic diagram of adjacency clustering based on end node link extension is shown; Fig.13 There are two pre-processed links with A and B as the starting nodes, among which the nodes of program A are C and D, and the destination nodes of node B are E, F, and G. Currently, these two links cannot be clustered. Fig.14 It is an adjacency clustering based on the extension of end node links. The extended nodes of the starting node A are A1, A2, and A3, and the extended nodes of the starting node B are B1 and B2; the extended node of the destination node C is C1, the extended nodes of the destination node D are D1 and D2, the extended node of the destination node F is F1, and the extended nodes of the destination node G are G1 and G2. The destination node E has no first-order extended nodes. The extended node D1 of the destination node D is the same node as the extended node B1 of the starting node B. Clustering and pruning are performed based on this. According to the clustering results, the unclustered extended nodes are pruned and the relevant data is saved.

[0164] In the embodiment of the present application, after the anonymous routers are clustered, the tree topology of each multi-hop anonymous router link and the relationship between different anonymous routers can be obtained. On this basis, constraints are established between the two, equations are listed for solving, and the multi-hop anonymous routers are merged using the independent sharing criterion. The multi-hop anonymous routers can be identified and a more accurate network topology can be restored.

[0165] Specifically, according to the tree topology of each multi-hop anonymous link and the relationship between different anonymous routers, the multi-hop anonymous routers are merged using the independent sharing criterion to complete the multi-hop anonymous router identification, including:

[0166] The tree topology of each multi-hop anonymous link and the relationship between different anonymous routers;

[0167] Establish the tree topology result of multi-hop anonymous links and the constraint relationship between anonymous routers after clustering, list the equations to solve, and determine the solution results;

[0168] The distribution of anonymous routers on the multi-hop anonymous link is deduced from the solution results, and the identification of multi-hop anonymous routers is completed.

[0169] Please refer to Fig.15 , Fig.15 The anonymous router topology obtained by the network tomography described in the embodiment of the present application is shown, including the tree topology structure of each multi-hop anonymous link obtained above and the relationship between different anonymous routers; Fig.15 The topology shown includes two initial nodes S1 and S2, and five destination nodes D1-D5. Each initial node corresponds to multiple destination nodes and has the same parts; the destination nodes of S1 are D1, D2, and D3, and the destination nodes of S2 are D2, D3, D4, and D5.

[0170] Label the links in the figure with numbers, assuming that the number of ARs (anonymous routers) on each link is x i , 1≤i≤10; In addition, there are 3 paths from the initial node S1 to the destination node, and 4 paths from S2 to the destination node. The total number of ARs for each path is W j , 1≤j≤7,W j The AR identified by network tomography is not included in the equation. Based on this, the constraint equation shown in the following formula can be obtained.

[0171]

[0172] The number of unknowns in this system of equations is greater than the number of equations, and there are multiple solutions. At this time, we should continue to use the characteristics of the original data. The anonymous routers on the overlapping links after clustering are the same for all paths passing through them. Therefore, we only need to bring a few special solutions into the above equation to get the solution of the entire equation, that is, the distribution of anonymous routers on the link.

[0173] With the development and progress of technology, the intelligence level of communication infrastructure such as computers, routers, and firewalls has been continuously improved, and the security protection capabilities have been continuously strengthened, especially for industrial control networks, where protection is often more stringent. In order to more effectively realize the deep correlation analysis and hierarchical mapping construction of industrial control network assets and restore the industrial control network topology, it is necessary to minimize the number of anonymous nodes when the industrial control network asset detection encounters packet loss, or when the response message cannot be obtained due to firewall rule restrictions and network bandwidth restrictions, so that the restored industrial control network topology can be closer to reality.

[0174] The industrial control network topology restoration method described in the embodiment of the present application first uses a technology that integrates routing information and Traceroute information to extract subnet information and alias information from the message of the routing protocol in the measured network, and analyzes it in combination with the Traceroute information, and finally obtains the alias relationship between the IP addresses and aggregates the router nodes. On this basis, the single-hop anonymous router is identified in combination with the business data flow and data reception delay analysis results, and multi-hop anonymous routers are clustered through node link expansion. The multi-hop anonymous routers are identified using the network hierarchy analysis method, and finally the routing structure probability distribution diagram of different network nodes is statistically calculated to restore the original industrial control network topology to the greatest extent.

[0175] Based on the same inventive concept, an industrial control network topology restoration device corresponding to the industrial control network topology restoration method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned industrial control network topology restoration method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0176] Please refer to Fig.16 , Fig.16 A schematic diagram of the structure of an industrial control network topology restoration method device according to an embodiment of the present application is shown, and the device includes:

[0177] The determination module 1601 is used to obtain target data information of nodes in the industrial control network under test through passive sniffing and active detection, and determine the IP-level network topology of the industrial control network under test based on the target data information of the nodes in the target industrial control network;

[0178] Extraction module 1602, used to extract subnet information and alias information from the message of the routing protocol of the industrial control network under test, and obtain the alias relationship between the network addresses of the network topology at the IP level;

[0179] A first restoration module 1603 is used to aggregate the alias relationship between the network addresses of the IP-level network topology, restore the router nodes, and determine the primary network topology 1604 of the industrial control network under test;

[0180] The second restoration module 1604 is used to identify the anonymous routers in the primary network topology based on the identification method matching the type of the anonymous routers, eliminate the false nodes and false links caused by the anonymous routers in the primary network topology, and restore the target network topology of the industrial control network under test.

[0181] In some embodiments, in the industrial control network topology restoration method and device, the types of the anonymous routers include single-hop anonymous routers and multi-hop anonymous routers; the second restoration module, when identifying the anonymous routers in the primary network topology based on the identification method matching the type of the anonymous router, is specifically used to:

[0182] Identify single-hop anonymous routers based on data reception delay analysis results;

[0183] Multi-hop anonymous routers are clustered by node link expansion, and the multi-hop anonymous routers are identified by using a network hierarchy analysis method.

[0184] In some embodiments, in the industrial control network topology restoration method and device, the second restoration module, when identifying a single-hop anonymous router based on the data reception delay analysis result, is specifically used to:

[0185] Determine a first local topology structure of the primary network topology where only one anonymous router hop passes between known router nodes;

[0186] For the first local topology, a detection data packet is sent from a starting node to a destination node to obtain a time delay of each link between the starting node and the destination node;

[0187] Different links are distinguished based on different time delays, and anonymous routers belonging to the same link are merged;

[0188] and / or,

[0189] The second restoration module, when clustering the multi-hop anonymous routers through node link expansion and identifying the multi-hop anonymous routers using a network hierarchy analysis method, is specifically used to:

[0190] Determine a second local topology structure between the known router nodes and the known router nodes through a multi-hop anonymous router; the second local topology structure includes a multi-hop anonymous link;

[0191] Clustering multi-hop anonymous links to obtain a mesh structure, using the mutual connections between different tree topologies and clustered anonymous routers, inferring the overlapping links between topologies, determining the relationship between known nodes in the multi-hop anonymous links, and obtaining the pre-processed multi-hop anonymous links;

[0192] Based on a preset extension threshold, the preprocessed multi-hop anonymous link is extended to the head end and / or tail end, and the anonymous routers are clustered according to the mutual relationship between the extended nodes to obtain the tree topology structure of each multi-hop anonymous link and the relationship between different anonymous routers;

[0193] According to the tree topology of each multi-hop anonymous link and the relationship between different anonymous routers, the multi-hop anonymous routers are merged using the independent sharing criterion to complete the multi-hop anonymous router identification.

[0194] In some embodiments, in the industrial control network topology restoration method and device, the second restoration module, when distinguishing different links according to different time delays and merging anonymous routers belonging to the same link, is specifically used to:

[0195] Determine the types of network structures of different links between the starting node and the destination node; the types of network structures include parallel network structure, star network structure, and staggered network structure;

[0196] For the parallel network structure, different links are distinguished based on the difference of different time delays between the starting node and the destination node, and the delay analysis result between the starting node and the destination node is determined; wherein, when the difference of the time delays of two links is less than the preset delay time threshold, the two links pass through the same anonymous router;

[0197] For the star network structure, based on the peak number and link number of the delay distribution diagram of the time delay between the starting node and the destination node, it is judged whether the link between the starting node and the destination node is real, and the delay analysis result between the starting node and the destination node is determined;

[0198] For the staggered network structure, the time delay from the starting node to different destination nodes is counted to construct the delay covariance matrix; the covariance value between two destination nodes represents the shared path information between the two destination nodes;

[0199] Based on the covariance value in the delay covariance matrix, determine whether different destination nodes share a link, and determine the delay analysis result between the starting node and the destination node;

[0200] Based on the delay analysis result between the starting node and the destination node, different links are distinguished and anonymous routers belonging to the same link are merged.

[0201] In some embodiments, in the industrial control network topology restoration method and device, the second restoration module, when expanding to the head end and / or tail end of the preprocessed multi-hop anonymous link based on a preset expansion threshold, clustering the anonymous routers according to the mutual relationship between the expansion nodes, and obtaining the tree topology structure of each multi-hop anonymous link and the relationship between different anonymous routers, is specifically used to:

[0202] The preprocessed multi-hop anonymous link is expanded with its corresponding starting node and / or destination node, with first-order expansion as the initial goal, and further expanded when it does not exceed the preset expansion threshold and does not reach the clustering target, and all expanded nodes are marked as unclustered;

[0203] Traverse the extended nodes of the initial node in each multi-hop anonymous link, and compare them with the elements in the {extended node, initial node} set of other links one by one. If the same node is found, merge them into the same node; if no same node is found, perform the next node expansion within the preset expansion threshold until a new cluster is found or no clusterable node is found when the node expansion threshold is reached;

[0204] According to the clustering results, the unclustered extended nodes are pruned and the relevant data are saved.

[0205] In some embodiments, in the industrial control network topology restoration method and device, the second restoration module, when merging multi-hop anonymous routers using an independent sharing criterion according to the tree topology structure of each multi-hop anonymous link and the relationship between different anonymous routers to complete the multi-hop anonymous router identification, is specifically used to:

[0206] The tree topology of each multi-hop anonymous link and the relationship between different anonymous routers;

[0207] Establish the tree topology result of multi-hop anonymous links and the constraint relationship between anonymous routers after clustering, list the equations to solve, and determine the solution results;

[0208] The distribution of anonymous routers on the multi-hop anonymous link is deduced from the solution results, and the identification of multi-hop anonymous routers is completed.

[0209] In some embodiments, in the industrial control network topology restoration method and device, the determination module, when acquiring target data information of nodes in the industrial control network under test through passive sniffing and active detection, is specifically used to:

[0210] Deploy a sniffing tool in the industrial control network under test to obtain the data flow in the industrial control network under test;

[0211] Parsing the data flow in the industrial control network under test, analyzing the communication protocol adopted by the business data in the data flow, and preliminarily determining the software information, device information and bearer business information in the industrial control network under test;

[0212] Based on data sniffing and protocol analysis, a specific protocol data packet is constructed and sent to obtain the basic attribute information and business attribute information of the network nodes in the industrial control network under test through active detection;

[0213] Preprocessing software information, device information, bearer service information, basic attribute information and service attribute information in the industrial control network under test to obtain preprocessed node data information;

[0214] The pre-processed node data information is analyzed and compared with the industrial control equipment feature database to locate the target data information of the nodes in the industrial control network under test.

[0215] In some embodiments, in the industrial control network topology restoration method device, the determination module, when determining the IP-level network topology of the industrial control network under test based on the target data information of the nodes in the target industrial control network, is specifically used to:

[0216] Based on the target data information of the nodes in the target industrial control network, the IP-level network topology of the industrial control network under test is preliminarily restored; each node in the IP-level network topology represents an IP address.

[0217] In some embodiments, in the industrial control network topology restoration method device, the extraction module, when extracting subnet information and alias information from the message of the routing protocol of the industrial control network under test to obtain the alias relationship between network addresses of the IP-level network topology, is specifically used to:

[0218] Extract the node's IP address, IP alias information and IP subnet from the routing protocol message of the industrial control network under test;

[0219] Performing a graph analysis on the IP-level network topology of the industrial control network under test and the IP addresses, IP alias information and IP subnets of the nodes to obtain the alias relationship between the IP addresses;

[0220] Correspondingly, the first restoration module, when aggregating the alias relationship between the network addresses based on the IP-level network topology to restore the router node, is specifically used to:

[0221] Aggregate the IP addresses belonging to the same router and restore the router node.

[0222] In some embodiments, an electronic device is also provided, including: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the industrial control network topology restoration method are performed.

[0223] In some embodiments, a computer-readable storage medium is further provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the industrial control network topology restoration method are executed.

[0224] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0225] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0226] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0227] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a platform server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0228] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for restoring industrial control network topology, characterized in that: The method comprises: Obtain target data information of nodes in the industrial control network under test through passive sniffing and active detection, and determine the IP-level network topology of the industrial control network under test based on the target data information of the nodes in the target industrial control network; Extract subnet information and alias information from the routing protocol message of the industrial control network under test, and obtain the alias relationship between network addresses of the IP-level network topology; Based on the alias relationship between the network addresses of the IP-level network topology, the router nodes are restored to determine the primary network topology of the industrial control network under test; Based on the identification method matching the type of anonymous routers, the anonymous routers in the primary network topology are identified, the false nodes and false links caused by the anonymous routers in the primary network topology are eliminated, and the target network topology of the industrial control network under test is restored.

2. The method according to claim 1, characterized in that The types of the anonymous routers include single-hop anonymous routers and multi-hop anonymous routers; Based on an identification method matching the type of the anonymous router, identifying the anonymous router in the primary network topology includes: Identify single-hop anonymous routers based on data reception delay analysis results; Multi-hop anonymous routers are clustered by node link expansion, and the multi-hop anonymous routers are identified by using a network hierarchy analysis method.

3. The method according to claim 2, characterized in that Identify single-hop anonymous routers based on data reception delay analysis results, including: Determine a first local topology structure of the primary network topology where only one anonymous router hop passes between known router nodes; For the first local topology, a detection data packet is sent from a starting node to a destination node to obtain a time delay of each link between the starting node and the destination node; Different links are distinguished based on different time delays, and anonymous routers belonging to the same link are merged; and / or, Clustering multi-hop anonymous routers by node link expansion and identifying the multi-hop anonymous routers by using a network hierarchy analysis method includes: Determine a second local topology structure between the known router nodes and the known router nodes through a multi-hop anonymous router; the second local topology structure includes a multi-hop anonymous link; Clustering multi-hop anonymous links to obtain a mesh structure, using the mutual connections between different tree topologies and clustered anonymous routers, inferring the overlapping links between topologies, determining the relationship between known nodes in the multi-hop anonymous links, and obtaining the pre-processed multi-hop anonymous links; Based on a preset extension threshold, the preprocessed multi-hop anonymous link is extended to the head end and / or tail end, and the anonymous routers are clustered according to the mutual relationship between the extended nodes to obtain the tree topology structure of each multi-hop anonymous link and the relationship between different anonymous routers; According to the tree topology of each multi-hop anonymous link and the relationship between different anonymous routers, the multi-hop anonymous routers are merged using the independent sharing criterion to complete the multi-hop anonymous router identification.

4. The method according to claim 3, characterized in that Different links are distinguished based on different time delays, and anonymous routers belonging to the same link are merged, including: Determine the types of network structures of different links between the starting node and the destination node; the types of network structures include parallel network structure, star network structure, and staggered network structure; For the parallel network structure, different links are distinguished based on the difference of different time delays between the starting node and the destination node, and the delay analysis result between the starting node and the destination node is determined; wherein, when the difference of the time delays of two links is less than the preset delay time threshold, the two links pass through the same anonymous router; For the star network structure, based on the peak number and link number of the delay distribution diagram of the time delay between the starting node and the destination node, it is judged whether the link between the starting node and the destination node is real, and the delay analysis result between the starting node and the destination node is determined; For the staggered network structure, the time delay from the starting node to different destination nodes is counted to construct the delay covariance matrix; the covariance value between two destination nodes represents the shared path information between the two destination nodes; Based on the covariance value in the delay covariance matrix, determine whether different destination nodes share a link, and determine the delay analysis result between the starting node and the destination node; Based on the delay analysis result between the starting node and the destination node, different links are distinguished and anonymous routers belonging to the same link are merged.

5. The method according to claim 3, characterized in that: Based on the preset extension threshold, the preprocessed multi-hop anonymous link is extended to the head end and / or tail end, and the anonymous routers are clustered according to the mutual relationship between the extended nodes, so as to obtain the tree topology structure of each multi-hop anonymous link and the relationship between different anonymous routers, including: The preprocessed multi-hop anonymous link is expanded with its corresponding starting node and / or destination node, with first-order expansion as the initial goal, and further expanded when it does not exceed the preset expansion threshold and does not reach the clustering target, and all expanded nodes are marked as unclustered; Traverse the extended nodes of the initial node in each multi-hop anonymous link, and compare them with the elements in the {extended node, initial node} set of other links one by one. If the same node is found, merge them into the same node; if no same node is found, perform the next node expansion within the preset expansion threshold until a new cluster is found or no clusterable node is found when the node expansion threshold is reached; According to the clustering results, the unclustered extended nodes are pruned and the relevant data are saved.

6. The method according to claim 3, characterized in that According to the tree topology of each multi-hop anonymous link and the relationship between different anonymous routers, the multi-hop anonymous routers are merged using the independent sharing criterion to complete the multi-hop anonymous router identification, including: The tree topology of each multi-hop anonymous link and the relationship between different anonymous routers; Establish the tree topology result of multi-hop anonymous links and the constraint relationship between anonymous routers after clustering, list the equations to solve, and determine the solution results; The distribution of anonymous routers on the multi-hop anonymous link is deduced from the solution results, and the identification of multi-hop anonymous routers is completed.

7. The method according to claim 1, characterized in that The method of obtaining target data information of nodes in the industrial control network under test by passive sniffing and active detection includes: Deploy a sniffing tool in the industrial control network under test to obtain the data flow in the industrial control network under test; Parsing the data flow in the industrial control network under test, analyzing the communication protocol adopted by the business data in the data flow, and preliminarily determining the software information, device information and bearer business information in the industrial control network under test; Based on data sniffing and protocol analysis, a specific protocol data packet is constructed and sent to obtain the basic attribute information and business attribute information of the network nodes in the industrial control network under test through active detection; Preprocessing software information, device information, bearer service information, basic attribute information and service attribute information in the industrial control network under test to obtain preprocessed node data information; The pre-processed node data information is analyzed and compared with the industrial control equipment feature database to locate the target data information of the nodes in the industrial control network under test.

8. The method according to claim 1, characterized in that Determining the IP-level network topology of the industrial control network under test based on the target data information of the nodes in the target industrial control network includes: Based on the target data information of the nodes in the target industrial control network, the IP-level network topology of the industrial control network under test is preliminarily restored; each node in the IP-level network topology represents an IP address.

9. The method according to claim 1, characterized in that: The extracting of subnet information and alias information from the message of the routing protocol of the tested industrial control network to obtain the alias relationship between the network addresses of the IP-level network topology includes: Extract the node's IP address, IP alias information and IP subnet from the routing protocol message of the industrial control network under test; Performing a graph analysis on the IP-level network topology of the industrial control network under test and the IP addresses, IP alias information and IP subnets of the nodes to obtain the alias relationship between the IP addresses; Accordingly, the alias relationship between the network addresses of the network topology at the IP level is aggregated to restore the router node, including: Aggregate the IP addresses belonging to the same router and restore the router node.

10. A method and device for restoring industrial control network topology, characterized in that: The device comprises: A determination module is used to obtain target data information of nodes in the industrial control network under test through passive sniffing and active detection, and determine the IP-level network topology of the industrial control network under test based on the target data information of the nodes in the target industrial control network; An extraction module is used to extract subnet information and alias information from the message of the routing protocol of the industrial control network under test, and obtain the alias relationship between the network addresses of the network topology at the IP level; A first restoration module is used to aggregate the alias relationship between the network addresses of the IP-level network topology, restore the router nodes, and determine the primary network topology of the industrial control network under test; The second restoration module is used to identify the anonymous routers in the primary network topology based on the identification method matching the type of the anonymous router, eliminate the false nodes and false links caused by the anonymous routers in the primary network topology, and restore the target network topology of the industrial control network under test.

Images