STP protocol fault monitoring and positioning system, method and device of industrial control network

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to an STP protocol fault monitoring and positioning system, method and device of an industrial control network. According to the STP protocol fault monitoring and positioning system of the industrial control network, traffic is captured through a TAP switch mirror image architecture, a loop is searched by using topological information of a known switch network and adopting depth-first, and a fault loop range is judged and positioned through a variable coefficient. A structure of passively collecting traffic data is adopted, so that the traffic in a design network environment is not interfered; analysis is carried out according to the real-time flow, and fault detection has high real-time performance; according to the method, analysis is carried out through the native data flow information, reading is not dependent on switch configuration, when an actual fault occurs, mirror image flow information can still be obtained for judgment, and the robustness is very high; according to the method, the fault model is judged through the variable coefficient, and the flow information for increasing the load of the equipment in the network is provided, so that an operator can conveniently check and correct, and the method has relatively high usability; and the mirror image traffic acquisition architecture is simple to deploy and easy to implement.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer networks, and in particular relates to a STP protocol fault monitoring and positioning system, method and device for an industrial control network. Background Art

[0002] As an important part of the manufacturing control system, the industrial control network is large in scale and complex in structure. STP (Spanning Tree Protocol) plays a vital role in the industrial control network. It is mainly used to eliminate loops in the network and provide link backup to improve the reliability and stability of the network. However, the STP protocol may also fail, which will cause abnormal events such as network congestion, network interruption, and decreased network transmission quality in the industrial control network. In addition, attacks on industrial control networks also further increase the possibility of network failures. These failures can cause some key businesses to fail to operate normally for a short period of time, and even cause serious consequences such as downtime.

[0003] Related technologies mainly rely on administrator experience and equipment replacement to locate and troubleshoot network faults. It often takes several hours or even dozens of hours from fault discovery to network recovery. For special industries with low tolerance for network faults, such as power and advanced manufacturing, network interruption may bring unpredictable losses. Therefore, it is necessary to detect faults as quickly as possible and quickly restore network communications to reduce the time and scope of communication interruptions. Summary of the invention

[0004] In order to overcome the problems existing in the related art, a STP protocol fault monitoring and positioning system, method and device for an industrial control network are provided.

[0005] According to one aspect of an embodiment of the present disclosure, a STP protocol fault monitoring and locating system for an industrial control network is provided, the system comprising: a computer device and a mirror switch; the computer device comprises: a machine flow parser, a global topology data incremental storage structure and an STP fault monitoring locator;

[0006] The traffic parser is used to parse the data packets captured by the mirror switch from the industrial control network and match the information of the data packets with the equipment and traffic information;

[0007] The global topology data incremental storage structure is used to store the amount of data and flow information transmitted by each device in a detection cycle; in the global topology data incremental storage structure, each device entry in the topology structure is used to represent a device, and each device corresponds to a vlan-id in a data packet. In each device entry, the total amount of data and flow information transmitted by the corresponding device in the detection cycle are recorded. The flow information uses a five-tuple as a key value to represent the total amount of data that each flow passes through the device in the detection cycle. The five-tuple information includes: source IP address, destination IP address, source port number, destination port number, and protocol number;

[0008] The STP fault monitoring locator is used to determine whether there is an abnormal loop based on the amount of data and flow information transmitted by each device in a detection cycle. If an abnormal loop is found, it provides abnormal loop information and information about the device with the largest flow source in the abnormal loop.

[0009] According to another aspect of an embodiment of the present disclosure, a method for monitoring and locating STP protocol faults in an industrial control network is provided, the method comprising:

[0010] Step 1, the traffic parser parses the traffic information captured by the TAP switch mirroring architecture during the detection period, extracts the information of each data packet, and maintains the information of each data packet to the global topology data incremental storage structure. The information of the data packet includes the size of the data packet, the five-tuple, and the physical address of the mirroring source device;

[0011] Step 2: The global topology data incremental storage structure increases the total data volume in the device entry corresponding to each received data packet by the value of the data packet size; determines whether the device entry has a quintuple of the data packet; if the device entry does not have a quintuple of the data packet, creates a quintuple of the data packet and increases the device flow information; if the device entry has a quintuple of the data packet, increases the device flow information;

[0012] Step 3: After obtaining the data of the global topology data incremental storage structure, the STP fault monitoring locator determines all loops in the industrial control network according to the connection relationship of each device in the industrial control network topology information, and performs the following steps for each loop:

[0013] Step 31: divide the device points in the topology of the industrial control network into a set DEV in_circle and the set DEV out_circle , where DEV in_circle DEV is the set of all devices belonging to the loop. out_circle A collection of devices that do not belong to the loop;

[0014] Step 32, determine the DEV of the loop in_circleThe coefficient of variation C of the total data increment of each device in the preset period in_circle , and C in_circle The coefficient of variation threshold C threshold Make comparisons;

[0015] Step 33, determine DEV in_circle The mean value of the total amount of equipment in in_circle , determine DEV out_circle The mean value of the total amount of equipment in out_circle ;

[0016] Step 34, determine M in_circle With M out_circle The ratio M rate , and the ratio threshold M threshold Make comparisons;

[0017] Step 35, if C in_circle Not exceeding C threshold , and M rate Beyond M threshold , it is determined that the loop may have an STP fault and the DEV of the loop is determined. in_circle The traffic source IP address with the largest data volume is used as the maximum traffic source device information, and then step 37 is executed;

[0018] Step 36, if C in_circle Not exceeding C in_circle , and M rate Not exceeding M threshold , then execute step 37;

[0019] Step 37, clear the global topology data incremental storage structure and wait for the next detection cycle.

[0020] In a possible implementation, step 1 further includes:

[0021] Step 11, the traffic parser parses the traffic information captured by the TAP switch mirroring architecture, extracts the vlan-id information, data packet size, and five-tuple information of each data packet vlan layer in the traffic information, and each vlan-id information corresponds to a network port structure in the industrial control network topology;

[0022] Step 12, the traffic parser converts the vlan-id of each data packet into the physical address of the device by querying the industrial control network topology configuration information, and determines the physical address of the mirror source device of the data packet;

[0023] Step 13, the traffic parser maintains the information of each data packet to the global topology data incremental storage structure, and increases the total device data volume corresponding to each data packet by one. The information of the data packet includes the size of the data packet, the five-tuple information, and the physical address of the mirror source device;

[0024] Step 14, for each data packet, determine whether the quintuple information associated with the device corresponding to the data packet exists. If the quintuple information exists, increase the total amount of the quintuple information. If the quintuple information does not exist, create the quintuple information and increase the total amount of the quintuple information.

[0025] According to another aspect of an embodiment of the present disclosure, a device for monitoring and locating STP protocol faults in an industrial control network is provided, the device comprising:

[0026] A parsing module is used to parse the traffic information captured by the TAP switch mirroring architecture during the detection period, extract the information of each data packet, and maintain the information of each data packet to the global topology data incremental storage structure. The information of the data packet includes the size of the data packet, the five-tuple, and the physical address of the mirroring source device;

[0027] The accumulation module is used to increase the total amount of data in the device entry corresponding to each received data packet by the value of the data packet size; determine whether the device entry has a quintuple of the data packet, if the device entry does not have a quintuple of the data packet, create a quintuple of the data packet and increase the device flow information; if the device entry has a quintuple of the data packet, increase the device flow information;

[0028] The fault detection module is used to obtain the data of the incremental storage structure of the global topology data, and then determine all loops in the industrial control network according to the connection relationship of each device in the industrial control network topology information. For each loop, the following modules are executed:

[0029] The partitioning module is used to divide the device points in the topology of the industrial control network into sets DEV in_circle and the set DEV out_circle , where DEV in_circle DEV is the set of all devices belonging to the loop. out_circle A collection of devices that do not belong to the loop;

[0030] The first comparison module is used to determine the DEV of the loop in_circle The coefficient of variation C of the total data increment of each device in the preset period in_circle , and C in_circle The coefficient of variation threshold C threshold Make comparisons;

[0031] Determine module, used to determine DEV in_circleThe mean value of the total amount of equipment in in_circle , determine DEV out_circle The mean value of the total amount of equipment in out_circle ;

[0032] The second comparison module is used to determine M in_circle With M out_circle The ratio M rate , and the ratio threshold M threshold Make comparisons;

[0033] The first determination module is used to in_circle Not exceeding C in_circle , and M rate Beyond M threshold In the case of a possible STP failure in the loop, determine the DEV of the loop in_circle The traffic source IP address with the largest data volume is used as the device information of the largest traffic source, and then the end module is executed;

[0034] The second determination module is used to in_circle Beyond C in_circle , and M rate Not exceeding M threshold In the case of , the end module is executed;

[0035] The end module is used to clear the incremental storage structure of global topology data and wait for the next detection cycle.

[0036] According to another aspect of an embodiment of the present disclosure, a device for monitoring and locating STP protocol faults in an industrial control network is provided, the device comprising:

[0037] processor;

[0038] a memory for storing processor-executable instructions;

[0039] Wherein, the processor is configured to execute the above method.

[0040] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0041] The beneficial effects of the present disclosure are: the STP protocol fault monitoring and positioning system of the industrial control network of the present disclosure captures traffic through the TAP switch mirroring architecture, uses the topology information of the known switch network to find loops in depth first, and determines and locates the scope of the fault loop through the coefficient of variation. The structure of passively collecting traffic data is adopted, which will not interfere with the traffic in the designed network environment; the fault detection has high real-time performance based on the analysis of real-time traffic; the analysis is performed through the original data traffic information, which does not rely on the switch configuration reading, and when the actual fault occurs, the mirrored traffic information can still be obtained for judgment, which has strong robustness; the fault range is judged through the coefficient of variation, and the traffic information that increases the load of the equipment in the network is provided, which is convenient for the operator to check and correct, and has high ease of use; the mirrored traffic acquisition architecture is simple to deploy and easy to implement. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 The present invention is a block diagram of a STP protocol fault monitoring and locating system for an industrial control network according to an exemplary embodiment.

[0043] Figure 2 The present invention is a schematic diagram of a process of maintaining an incremental storage structure of global topology data according to an exemplary embodiment.

[0044] Figure 3 The present invention is a flowchart of a method for monitoring and locating STP protocol faults in an industrial control network according to an exemplary embodiment.

[0045] Figure 4 The figure is a diagram showing a structure of mirrored traffic capture according to an exemplary embodiment.

[0046] Figure 5 The present invention is a block diagram showing a device for monitoring and locating STP protocol faults in an industrial control network according to an exemplary embodiment. DETAILED DESCRIPTION

[0047] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0048] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0049] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0050] Figure 1 is a block diagram of an STP protocol fault monitoring and positioning system for an industrial control network according to an exemplary embodiment. Figure 1 As shown, the STP protocol fault monitoring and positioning system of the industrial control network includes: a flow parser, a global topology data incremental storage structure and an STP fault monitoring locator. The flow parser is used to parse the data packets captured from the industrial control network and correspond the information of the data packets with the equipment and flow information; the global topology data incremental storage structure is used to store the amount of data and flow information transmitted by each device in a detection cycle; the STP fault monitoring locator is used to determine whether there is an abnormal loop based on the amount of data and flow information transmitted by each device in a detection cycle. If an abnormal loop is found, it provides abnormal loop information and the maximum flow source device information in the abnormal loop.

[0051] In the global topology data incremental storage structure, each device entry in the topology structure is used to represent a device. Each device corresponds to a vlan-id in a data packet. In each device entry, the total amount of data and flow information transmitted by the corresponding device during the detection cycle are recorded. The flow information uses a five-tuple as the key value to represent the total amount of data of each flow passing through the device during the detection cycle. The five-tuple information includes: source IP address, destination IP address, source port number, destination port number, and protocol number.

[0052] The global topology data incremental storage structure receives data information from the traffic parser. The data information output by the traffic parser includes the size of the data packet, the five-tuple, and the vlan-id. Through the correspondence between the data packet vlan-id and the device, the source device of the data packet mirror can be obtained. When storing, find the corresponding device entry of the device, increase the total data volume in the device entry by the value of the data packet size; determine whether the device entry has the five-tuple of the data packet. If the device entry does not have the five-tuple of the data packet, create the five-tuple of the data packet and increase the device traffic information; if the device entry has the five-tuple of the data packet, increase the device traffic information.

[0053] Figure 3 is a flow chart of a method for monitoring and locating STP protocol faults in an industrial control network according to an exemplary embodiment. Figure 4 is a diagram showing a structure of image-captured traffic according to an exemplary embodiment. Figure 1 , Figure 3 , Figure 4 , the method comprising:

[0054] Step 1: The traffic parser parses the traffic information captured by the mirror switch during the detection cycle, extracts the information of each data packet, and maintains the information of each data packet to the global topology data incremental storage structure. The data packet information includes the size of the data packet, the five-tuple, and the physical address of the mirror source device.

[0055] Step 2: The global topology data incremental storage structure increases the total amount of data in the device entry corresponding to each received data packet by the value of the data packet size; determines whether the device entry has a quintuple for the data packet. If the device entry does not have a quintuple for the data packet, a quintuple for the data packet is created and the device traffic information is increased; if the device entry has a quintuple for the data packet, the device traffic information is increased.

[0056] Step 3: After obtaining the data of the global topology data incremental storage structure, the STP fault monitoring locator determines all loops in the industrial control network according to the connection relationship of each device in the industrial control network topology information, and performs the following steps for each loop:

[0057] Step 31: divide the device points in the topology of the industrial control network into a set DEV in_circle and the set DEV out_circle , where DEV in_circle DEV is the set of all devices belonging to the loop. out_circle A collection of devices that do not belong to the loop.

[0058] Step 32, determine the DEV of the loop in_circle The coefficient of variation C of the total data increment of each device in the preset period in_circle , and C in_circle The coefficient of variation threshold C threshold Make a comparison.

[0059] Step 33, determine DEV in_circle The mean value of the total amount of equipment in in_circle , determine DEV out_circle The mean value of the total amount of equipment in out_circle ;

[0060] Step 34, determine M in_circle With M out_circle The ratio M rate , and the ratio threshold M threshold Make a comparison.

[0061] Step 35, if C in_circle Not exceeding C in_circle , and M rate Beyond M threshold , it is determined that the loop may have an STP fault and the DEV of the loop is determined. in_circle The traffic source IP address with the largest data volume is used as the maximum traffic source device information, and then step 37 is executed.

[0062] Step 36, if C in_circle Beyond C in_circle , and M rate Not exceeding M threshold , then execute step 37.

[0063] Step 37, clear the global topology data incremental storage structure and wait for the next detection cycle.

[0064] In one possible implementation, see Figure 2 , step 1 may include the following steps.

[0065] Step 11, the traffic parser parses the traffic information captured by the TAP switch mirroring architecture, extracts the vlan-id information, packet size, and five-tuple information of each data packet vlan layer in the traffic information, and each vlan-id information corresponds to a network port structure in the industrial control network topology.

[0066] Step 12: The traffic parser converts the vlan-id of each data packet into a device physical address by querying the industrial control network topology configuration information, and determines the physical address of the mirror source device of the data packet.

[0067] Step 13, the traffic parser maintains the information of each data packet to the global topology data incremental storage structure, and increases the total device data volume corresponding to each data packet by one. The information of the data packet includes the size of the data packet, five-tuple information, and the physical address of the mirror source device.

[0068] Step 14, for each data packet, determine whether the quintuple information associated with the device corresponding to the data packet exists. If the quintuple information exists, increase the total amount of the quintuple information. If the quintuple information does not exist, create the quintuple information and increase the total amount of the quintuple information.

[0069] The structure of passively collecting traffic data is adopted, which will not interfere with the traffic in the designed network environment. The fault detection is highly real-time based on the analysis of real-time traffic. The analysis is based on native data traffic information, which does not rely on the switch configuration reading. When an actual fault occurs, the mirrored traffic information can still be obtained for judgment, which has strong robustness. The fault range is judged by the coefficient of variation, and the traffic information that increases the equipment load in the network is provided, which is convenient for operators to check and correct, and has high ease of use. The mirrored traffic acquisition architecture is simple to deploy and easy to implement.

[0070] Figure 5 1900 is a block diagram of an STP protocol fault monitoring and locating device for an industrial control network according to an exemplary embodiment. For example, the device 1900 may be provided as a server. Figure 5 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0071] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0072] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0073] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0074] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0075] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0076] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0077] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0078] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0079] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0080] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0081] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A STP protocol fault monitoring and positioning system for industrial control networks, characterized in that: The system includes: computer equipment and mirror switches; the computer equipment includes: machine flow parser, global topology data incremental storage structure and STP fault monitoring locator; The traffic parser is used to parse the data packets captured by the mirror switch from the industrial control network and match the information of the data packets with the equipment and traffic information; The global topology data incremental storage structure is used to store the amount of data and flow information transmitted by each device in a detection cycle; in the global topology data incremental storage structure, each device entry in the topology structure is used to represent a device, and each device corresponds to a vlan-id in a data packet. In each device entry, the total amount of data and flow information transmitted by the corresponding device in the detection cycle are recorded. The flow information uses a five-tuple as a key value to represent the total amount of data that each flow passes through the device in the detection cycle. The five-tuple information includes: source IP address, destination IP address, source port number, destination port number, and protocol number; The STP fault monitoring locator is used to determine whether there is an abnormal loop based on the amount of data and flow information transmitted by each device in a detection cycle. If an abnormal loop is found, it provides abnormal loop information and information about the device with the largest flow source in the abnormal loop.

2. A method for monitoring and locating STP protocol faults in an industrial control network, characterized in that: The method comprises: Step 1, the traffic parser parses the traffic information captured by the TAP switch mirroring architecture during the detection period, extracts the information of each data packet, and maintains the information of each data packet to the global topology data incremental storage structure. The information of the data packet includes the size of the data packet, the five-tuple, and the physical address of the mirroring source device; Step 2: The global topology data incremental storage structure increases the total data volume in the device entry corresponding to each received data packet by the value of the data packet size; determines whether the device entry has a quintuple of the data packet; if the device entry does not have a quintuple of the data packet, creates a quintuple of the data packet and increases the device flow information; if the device entry has a quintuple of the data packet, increases the device flow information; Step 3: After obtaining the data of the global topology data incremental storage structure, the STP fault monitoring locator determines all loops in the industrial control network according to the connection relationship of each device in the industrial control network topology information, and performs the following steps for each loop: Step 31: divide the device points in the topology of the industrial control network into a set DEV in_circle and the set DEV out_circle , where DEV in_circle DEV is the set of all devices belonging to the loop. out_circle A collection of devices that do not belong to the loop; Step 32, determine the DEV of the loop in_circle The coefficient of variation C of the total data increment of each device in the preset period in_circle , and C in_circle The coefficient of variation threshold C threshold Make comparisons; Step 33, determine DEV in_circle The mean value of the total amount of equipment in in_circle , determine DEV out_circle The mean value of the total amount of equipment in out_circle ; Step 34, determine M in_circle With M out_circle The ratio M rate , and the ratio threshold M threshold Make comparisons; Step 35, if C in_circle Not exceeding C threshold , and M rate Beyond M threshold , it is determined that the loop may have an STP fault and the DEV of the loop is determined. in_circle The traffic source IP address with the largest data volume is used as the maximum traffic source device information, and then step 37 is executed; Step 36, if C in_circle Beyond C threshold , and M rate Not exceeding M threshold , then execute step 37; Step 37, clear the global topology data incremental storage structure and wait for the next detection cycle.

3. The method according to claim 1, characterized in that Step 1 also includes: Step 11, the traffic parser parses the traffic information captured by the TAP switch mirroring architecture, extracts the vlan-id information, data packet size, and five-tuple information of each data packet vlan layer in the traffic information, and each vlan-id information corresponds to a network port structure in the industrial control network topology; Step 12, the traffic parser converts the vlan-id of each data packet into the physical address of the device by querying the industrial control network topology configuration information, and determines the physical address of the mirror source device of the data packet; Step 13, the traffic parser maintains the information of each data packet to the global topology data incremental storage structure, and increases the total device data volume corresponding to each data packet by one. The information of the data packet includes the size of the data packet, the five-tuple information, and the physical address of the mirror source device; Step 14, for each data packet, determine whether the quintuple information associated with the device corresponding to the data packet exists. If the quintuple information exists, increase the total amount of the quintuple information. If the quintuple information does not exist, create the quintuple information and increase the total amount of the quintuple information.

4. A STP protocol fault monitoring and locating device for an industrial control network, characterized in that: The device comprises: A parsing module is used to parse the traffic information captured by the TAP switch mirroring architecture during the detection period, extract the information of each data packet, and maintain the information of each data packet to the global topology data incremental storage structure. The information of the data packet includes the size of the data packet, the five-tuple, and the physical address of the mirroring source device; The accumulation module is used to increase the total amount of data in the device entry corresponding to each received data packet by the value of the data packet size; determine whether the device entry has a quintuple of the data packet, if the device entry does not have a quintuple of the data packet, create a quintuple of the data packet and increase the device flow information; if the device entry has a quintuple of the data packet, increase the device flow information; The fault detection module is used to obtain the data of the incremental storage structure of the global topology data, and then determine all loops in the industrial control network according to the connection relationship of each device in the industrial control network topology information. For each loop, the following modules are executed: The partitioning module is used to divide the device points in the topology of the industrial control network into sets DEV in_circle and the set DEV out_circle , where DEV in_circle DEV is the set of all devices belonging to the loop. out_circle A collection of devices that do not belong to the loop; The first comparison module is used to determine the DEV of the loop in_circle The coefficient of variation C of the total data increment of each device in the preset period in_circle , and C in_circle The coefficient of variation threshold C threshold Make comparisons; Determine module, used to determine DEV in_circle The mean value of the total amount of equipment in in_circle , determine DEV out_circle The mean value of the total amount of equipment in out_circle ; The second comparison module is used to determine M in_circle With M out_circle The ratio M rate , and the ratio threshold M threshold Make comparisons; The first determination module is used to in_circle Not exceeding C threshold , and M rate Beyond M threshold In the case of a possible STP failure in the loop, determine the DEV of the loop in_circle The traffic source IP address with the largest data volume is used as the device information of the largest traffic source, and then the end module is executed; The second determination module is used to in_circle Beyond C threshold , and M rate Not exceeding M threshold In the case of , the end module is executed; The end module is used to clear the incremental storage structure of global topology data and wait for the next detection cycle.

5. A STP protocol fault monitoring and locating device for an industrial control network, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to execute the method of claim 2 or 3.

6. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to claim 2 or 3 is implemented.

Images