Stp protocol fault monitoring and positioning system, method and device for industrial control network

Abstract

The present disclosure belongs to the technical field of nuclear power and particularly relates to an STP protocol fault monitoring and positioning system, method and device for an industrial control network. The STP protocol fault monitoring and positioning system for the industrial control network captures traffic through a TAP switch mirroring architecture, adopts a depth-first search for a loop using topology information of a known switch network, determines and positions a fault loop range through a coefficient of variation. The structure of passive collection of traffic data is adopted, which does not cause interference to traffic in the designed network environment; analysis is performed according to real-time traffic, fault detection has high real-time performance; analysis is performed through original data traffic information, which does not depend on switch configuration reading; when an actual fault occurs, mirror traffic information can still be acquired for determination, which has strong robustness; a fault range is determined through a coefficient of variation, and traffic information that causes device load to increase in the network is provided, which facilitates operators to investigate and correct, and has high ease of use; the mirror traffic acquisition architecture is simple to deploy and has ease of implementation.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of computer network, and particularly relates to an STP protocol fault monitoring and positioning system, method and device for an industrial control network. BACKGROUND

[0002] As an important component of manufacturing control system, the industrial control network is large in scale and complex in structure. The STP (Spanning Tree Protocol) plays a vital role in the industrial control network. It is mainly used to eliminate loops in the network and provide link backup to improve the reliability and stability of the network. However, the STP protocol may also fail, which will cause abnormal events such as network congestion, network interruption, and network transmission quality degradation in the industrial control network. In addition, attacks on the industrial control network further increase the likelihood of network failure. These failures can cause certain critical services to be unable to operate normally for a short period of time, or even cause serious consequences such as shutdown.

[0003] In related technologies, network faults are mainly located and debugged by relying on the experience of administrators and device replacement. From the discovery of the fault to the recovery of the network, it often takes several hours or even dozens of hours. For special industries such as power and advanced manufacturing that have low tolerance for network faults, network interruption may cause unpredictable losses. Therefore, it is necessary to detect the fault as soon as possible and quickly recover the network communication to reduce the time and range of communication interruption. SUMMARY

[0004] In order to overcome the problems in the related art, an STP protocol fault monitoring and positioning system, method and device for an industrial control network are provided.

[0005] According to an aspect of an embodiment of the present disclosure, an STP protocol fault monitoring and positioning system for an industrial control network is provided, which includes a computer device and a mirror switch, and the computer device includes a traffic parser, a global topology data delta storage structure, and an STP fault monitoring and positioning device.

[0006] The traffic parser is used to parse the data packets captured by the mirror switch from the industrial control network, and to correspond the information of the data packets with the device and traffic information.

[0007] The global topology data increment storage structure is used to store the data volume and traffic information transmitted by each device in a detection period. In the global topology data increment storage structure, each device entry in the topology structure is used to represent a device, each device corresponds to a vlan-id in a data packet, and in each device entry, the total data volume and traffic information transmitted by the corresponding device in the detection period are recorded. The traffic information uses a five-tuple as a key value to represent the total data volume of each traffic passing through the device in the detection period. The five-tuple information includes: source IP address, destination IP address, source port number, destination port number, and protocol number.

[0008] The STP fault monitoring locator is used to determine whether an abnormal loop exists according to the data volume and traffic information transmitted by each device in a detection period. If it is found that an abnormal loop exists, the abnormal loop information and the maximum traffic source device information in the abnormal loop are provided.

[0009] According to another aspect of the embodiments of the present disclosure, a method for monitoring and locating an STP protocol fault of an industrial control network is provided. The method comprises:

[0010] Step 1: The traffic analyzer parses the traffic information captured by the TAP switch mirroring architecture in a detection period, extracts the information of each data packet, and maintains the information of each data packet to the global topology data increment storage structure. The information of each data packet includes the size of the data packet, a five-tuple, and the physical address of the mirroring source device.

[0011] Step 2: The global topology data increment storage structure increases the total data volume in the device entry corresponding to each received data packet by the size of the data packet. It is determined whether the five-tuple of the data packet exists in the device entry. If the five-tuple of the data packet does not exist in the device entry, the five-tuple of the data packet is created, and the traffic information of the device is increased. If the five-tuple of the data packet exists in the device entry, the traffic information of the device is increased.

[0012] Step 3: After obtaining the data of the global topology data increment storage structure, the STP fault monitoring locator determines all loops in the industrial control network according to the connection relationship of each device in the industrial control network topology information. For each loop, the following steps are performed:

[0013] Step 31: The device points in the topology of the industrial control network are divided into a set DEV in_circle and a set DEV out_circle , wherein DEV in_circle is a device set belonging to the loop, and DEV out_circle is a device set not belonging to the loop.

[0014] Step 32: DEV in_circlethe coefficient of variation C of the total data increment of each device in the preset period in_circle and comparing C in_circle with the coefficient of variation threshold C threshold ;

[0015] Step 33, determining the coefficient of variation C of the total data increment of each device in the preset period in_circle Step 33, determining the coefficient of variation C of the total data increment of each device in the preset period in_circle Step 33, determining the coefficient of variation C of the total data increment of each device in the preset period out_circle Step 33, determining the coefficient of variation C of the total data increment of each device in the preset period out_circle ;

[0016] Step 34, determining the ratio M of M in_circle and M out_circle , and comparing M rate with the ratio threshold M threshold ;

[0017] Step 35, if C in_circle does not exceed C threshold , and M rate exceeds M threshold , it is determined that the loop may have an STP fault, the data volume largest flow source IP address in the DEV in_circle of the loop is determined as the largest flow source device information, and then step 37 is executed;

[0018] Step 36, if C in_circle does not exceed C in_circle , and M rate does not exceed M threshold , step 37 is executed;

[0019] Step 37, clearing the global topology data increment storage structure, and waiting for the next detection period.

[0020] In a possible implementation, step 1 further includes:

[0021] Step 11, the traffic parser parses the traffic information captured by the TAP switch mirroring architecture, extracts the vlan-id information of each packet vlan layer, the packet size, and the five-tuple information in the traffic information, and each vlan-id information corresponds to a network port structure in the industrial control network topology;

[0022] Step 12, the traffic parser converts each packet vlan-id into a device physical address by querying the industrial control network topology configuration information, and determines the mirroring source device physical address of the packet;

[0023] Step 13, the flow resolver maintains the information of each data packet to the global topology data increment storage structure, and increases the total data amount of the device corresponding to each data packet by one, the information of the data packet including the size of the data packet, the quintuple information and the mirror source device physical address;

[0024] Step 14, for each data packet, it is judged whether the quintuple information associated with the device corresponding to the data packet exists, if the quintuple information exists, the total amount of the quintuple information is increased, if the quintuple information does not exist, the quintuple information is created, and then the total amount of the quintuple information is increased.

[0025] According to another aspect of the embodiments of the present disclosure, a device for monitoring and locating STP protocol faults of an industrial control network is provided, and the device comprises:

[0026] The analysis module is configured to analyze the flow information captured by the TAP switch mirror architecture in a detection period, extract the information of each data packet, and maintain the information of each data packet to the global topology data increment storage structure, the information of the data packet including the size of the data packet, the quintuple and the mirror source device physical address;

[0027] The accumulation module is configured to increase the total data amount in the device entry corresponding to each received data packet by the size of the data packet, judge whether the quintuple of the data packet exists in the device entry, if the quintuple of the data packet does not exist in the device entry, create the quintuple of the data packet, and increase the device flow information; if the quintuple of the data packet exists in the device entry, increase the device flow information;

[0028] The fault detection module is configured to, after obtaining the data of the global topology data increment storage structure, determine all loops in the industrial control network according to the connection relationship of each device in the industrial control network topology information, and execute the following modules for each loop:

[0029] The division module is configured to divide the device points in the topology in the industrial control network into a set DEV in_circle and a set DEV out_circle , wherein DEV in_circle is a device set belonging to the loop, and DEV out_circle is a device set not belonging to the loop.

[0030] The first comparison module is configured to determine the coefficient of variation C in_circle of the total data increment in the preset period of each device in DEV in_circle of the loop, and compare C in_circle with a coefficient of variation threshold C threshold .

[0031] The determination module is configured to determine DEV in_circledata mean M of the total amount of devices in the network in_circle , determine DEV out_circle data mean M of the total amount of devices in the network out_circle ;

[0032] a second comparison module, configured to determine the ratio M in_circle of M out_circle and M rate , and compare the ratio with a ratio threshold M threshold ;

[0033] a first determination module, configured to, in a case where C in_circle does not exceed C in_circle and M rate exceeds M threshold , determine that the ring network possibly has an STP fault, determine a largest traffic source IP address of the DEV in_circle in the network as the largest traffic source device information, and then execute an ending module;

[0034] a second determination module, configured to, in a case where C in_circle exceeds C in_circle and M rate does not exceed M threshold , execute the ending module;

[0035] the ending module, configured to empty a global topology data increment storage structure, and wait for a next detection period.

[0036] According to another aspect of the embodiments of the present disclosure, an STP protocol fault monitoring and positioning device for an industrial control network is provided, and the device comprises:

[0037] a processor;

[0038] a memory for storing processor-executable instructions;

[0039] The processor is configured to execute the method described above.

[0040] According to another aspect of the embodiments of the present disclosure, a nonvolatile computer readable storage medium is provided, and the medium stores computer program instructions, which are executed by a processor to implement the method described above.

[0041] The STP protocol fault monitoring and positioning system of the industrial control network has the advantages that the STP protocol fault monitoring and positioning system of the industrial control network captures traffic through a TAP switch mirroring architecture, adopts a depth-first loop search using topology information of a known switch network, determines a fault loop range through a coefficient of variation, and has the following advantages: the structure of passively collecting traffic data does not interfere with traffic in the designed network environment; the analysis is performed according to real-time traffic, and fault detection has high real-time performance; the analysis is performed through original data traffic information, and does not depend on switch configuration reading; when an actual fault occurs, mirror traffic information can still be acquired for determination, and has strong robustness; the coefficient of variation is used to determine a fault range, and traffic information that causes device load to increase in the network is provided, which facilitates an operator to troubleshoot and correct, and has high ease of use; the mirror traffic acquisition architecture is simple to deploy, and has high ease of implementation. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 FIG. 1 is a block diagram of an STP protocol fault monitoring and positioning system of an industrial control network according to an example embodiment.

[0043] Figure 2 FIG. 2 is a flowchart of maintaining a global topology data incremental storage structure according to an example embodiment.

[0044] Figure 3 FIG. 3 is a flowchart of an STP protocol fault monitoring and positioning method of an industrial control network according to an example embodiment.

[0045] Figure 4 FIG. 4 is a mirror captured traffic structure diagram according to an example embodiment.

[0046] Figure 5 FIG. 5 is a block diagram of an STP protocol fault monitoring and positioning device of an industrial control network according to an example embodiment. DETAILED DESCRIPTION

[0047] The application will be further described below in conjunction with the drawings and specific embodiments.

[0048] Unless otherwise defined, technical and scientific terms used in the present disclosure have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "comprising" and any variation thereof in the present disclosure is intended to cover non-exclusive inclusion. Obviously, the embodiments described in the present disclosure are only a part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by one of ordinary skill in the art without creative work belong to the scope of protection of the present disclosure.

[0049] Reference to an "embodiment" in this disclosure means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the disclosure. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. As will be apparent to those of ordinary skill in the art, embodiments described herein can be combined with other embodiments.

[0050] Figure 1 is a block diagram of an STP protocol fault monitoring and positioning system of an industrial control network according to an exemplary embodiment, as shown in Figure 1 The STP protocol fault monitoring and positioning system of the industrial control network includes a traffic parser, a global topology data delta storage structure, and an STP fault monitoring and locator, as shown in the figure. The traffic parser is used to parse the captured data packets from the industrial control network, and to correspond the information of the data packets with the device and traffic information. The global topology data delta storage structure is used to store the data volume and traffic information transmitted by each device in a detection period. The STP fault monitoring and locator is used to determine whether there is an abnormal loop according to the data volume and traffic information transmitted by each device in a detection period, and to provide the abnormal loop information and the information of the maximum traffic source device in the abnormal loop if an abnormal loop is found.

[0051] In the global topology data delta storage structure, each device entry in the topology structure is used to represent a device, and each device corresponds to a vlan-id in a data packet. In each device entry, the total data volume and traffic information transmitted by the corresponding device in a detection period are recorded. The traffic information uses a five-tuple as a key value to represent the total data volume of each traffic passing through the device in the detection period. The five-tuple information includes a source IP address, a destination IP address, a source port number, a destination port number, and a protocol number.

[0052] The global topology data delta storage structure receives the data information from the traffic parser. The data information output by the traffic parser includes the size of a data packet, a five-tuple, and a vlan-id. Through the corresponding relationship between the vlan-id of the data packet and the device, the mirror source device of the data packet can be obtained. When storing, the corresponding device entry of the device is found, and the total data volume in the device entry is increased by the size of the data packet. It is determined whether the five-tuple of the data packet exists in the device entry. If the five-tuple of the data packet does not exist in the device entry, the five-tuple of the data packet is created, and the traffic information of the device is increased. If the five-tuple of the data packet exists in the device entry, the traffic information of the device is increased.

[0053] Figure 3 is a flow chart of an STP protocol fault monitoring and positioning method of an industrial control network according to an exemplary embodiment,Figure 4 is shown according to an exemplary embodiment, referring to Figure 1 , Figure 3 , Figure 4 , the method comprises:

[0054] Step 1, the traffic parser parses the traffic information captured by the mirror switch in the detection period, extracts the information of each data packet, and maintains the information of each data packet to the global topology data incremental storage structure, the information of each data packet including the size of the data packet, the five-tuple and the mirror source device physical address.

[0055] Step 2, the global topology data incremental storage structure increases the total data amount in the device entry corresponding to each data packet received by a value of the size of the data packet; judges whether the device entry exists the five-tuple of the data packet, if the device entry does not exist the five-tuple of the data packet, creates the five-tuple of the data packet, and makes the device traffic information increase; if the device entry exists the five-tuple of the data packet, makes the device traffic information increase.

[0056] Step 3, the STP fault monitoring locator determines all loops in the industrial control network according to the connection relationship of each device in the industrial control network topology information after obtaining the data of the global topology data incremental storage structure, and executes the following steps for each loop:

[0057] Step 31, the device points in the topology in the industrial control network are divided into a set DEV in_circle and a set DEV out_circle , wherein DEV in_circle is a device set belonging to the loop, and DEV out_circle is a device set not belonging to the loop.

[0058] Step 32, the coefficient of variation C in_circle of the total data increment of each device in DEV in_circle of the loop in the preset period is determined, and C in_circle is compared with the coefficient of variation threshold C threshold .

[0059] Step 33, the data mean M in_circle of the total amount of devices in DEV in_circle is determined, and the data mean M out_circle of the total amount of devices in DEV out_circle is determined.

[0060] Step 34, the ratio M rate of M in_circle to M out_circle is determined, and is compared with the ratio threshold M threshold .

[0061] Step 35, if C in_circle is not exceeded in_circle , and M rate is exceeded threshold , it is determined that the loop may have an STP failure, the DEV in_circle with the largest amount of data in the loop is determined as the largest traffic source device information, and then step 37 is performed.

[0062] Step 36, if C in_circle is exceeded in_circle , and M rate is not exceeded threshold , step 37 is performed.

[0063] Step 37, the global topology data increment storage structure is emptied, and the next detection period is waited for.

[0064] In a possible implementation, referring to Figure 2 , step 1 can include the following steps.

[0065] Step 11, the traffic parser parses the traffic information captured through the TAP switch mirroring architecture, extracts the vlan-id information of each packet vlan layer, the packet size, and the five-tuple information in the traffic information, and each vlan-id information corresponds to a network port structure in the industrial control network topology.

[0066] Step 12, the traffic parser converts each packet vlan-id into a device physical address by querying the industrial control network topology configuration information, and determines the mirroring source device physical address of the packet.

[0067] Step 13, the traffic parser maintains the information of each packet to the global topology data increment storage structure, and adds one to the total data amount of the device corresponding to each packet, and the information of the packet includes the size of the packet, the five-tuple information, and the mirroring source device physical address.

[0068] Step 14, for each packet, it is determined whether the five-tuple information associated with the device corresponding to the packet exists, if the five-tuple information exists, the total amount of the five-tuple information is increased, if the five-tuple information does not exist, the five-tuple information is created, and then the total amount of the five-tuple information is increased.

[0069] The structure for passively collecting flow data does not interfere with the flow in the designed network environment; the analysis based on real-time flow has high real-time performance for fault detection; the analysis based on original data flow information does not depend on the reading of switch configuration, and when an actual fault occurs, mirror flow information can still be acquired for judgment, and has strong robustness; the fault range is determined by the coefficient of variation, and the flow information that causes the load of the device in the network to increase is provided, which facilitates the operator to investigate and correct, and has high ease of use; the mirror flow acquisition architecture is simple to deploy and has high ease of implementation.

[0070] Figure 5 is a block diagram of an STP protocol fault monitoring and positioning device of an industrial control network according to an exemplary embodiment. For example, the device 1900 can be provided as a server. Referring to Figure 5 , the device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932, for storing instructions, such as an application program, executable by the processing component 1922. The application program stored in the memory 1932 can include one or more than one module each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above method.

[0071] The device 1900 can also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 can operate based on an operating system stored in the memory 1932, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM or the like.

[0072] In an exemplary embodiment, a non-volatile computer readable storage medium, such as the memory 1932 including computer program instructions executable by the processing component 1922 of the device 1900 to perform the above method, is also provided.

[0073] The present disclosure can be a system, a method, and / or a computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present disclosure.

[0074] Computer readable storage media can be tangible storage media which can retain and store instructions for use by an instruction execution device. Computer readable storage media can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer readable storage media include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

[0075] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0076] Computer readable program instructions for carrying out operations of the present disclosure can be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate array (FPGA), or programmable logic array (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0077] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0078] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can include random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other data storage device. When the computer readable program instructions are loaded into the computer and other programmable data processing apparatus, a series of operational steps are implemented that provide processes such that the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0079] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0080] The flow diagrams and the block diagrams in the drawings are presented to illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flow diagrams and the block diagrams can represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logic functions. In some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks can sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flow diagrams, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and

[0081] Embodiments of the present disclosure have been described above, and the description is intended to be illustrative of the embodiments and not restrictive. Many modifications and variations of the described embodiments are possible and are within the scope of the disclosure. The selection of terms is intended to best describe the principles of the embodiments, practical application, or improvement over the technology in the art, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. An STP protocol fault monitoring and positioning system for industrial control networks, characterized in that: The system includes: computer equipment and mirror switches; the computer equipment includes: machine flow parser, global topology data incremental storage structure and STP fault monitoring locator; The traffic parser is used to parse the data packets captured by the mirror switch from the industrial control network and match the data packet information with the device and traffic information; The global topology data incremental storage structure is used to store the amount of data and traffic information transmitted by each device in a detection cycle. In the global topology data incremental storage structure, each device entry in the topology structure is used to represent a device. Each device corresponds to a vlan-id in a data packet. Each device entry records the total amount of data and traffic information transmitted by the corresponding device in the detection cycle. The traffic information uses a five-tuple as a key value to represent the total amount of data for each flow passing through the device in the detection cycle. The five-tuple information includes: source IP address, destination IP address, source port number, destination port number, and protocol number. The STP fault monitoring locator is used to determine whether an abnormal loop exists based on the amount of data and traffic information transmitted by each device during a detection cycle. If an abnormal loop is found, it provides abnormal loop information and information about the device with the highest traffic in the abnormal loop.

2. A method for monitoring and locating STP protocol faults in an industrial control network, characterized in that: The method comprises: Step 1: The traffic parser parses the traffic information captured by the TAP switch mirroring architecture during the detection cycle, extracts the information of each data packet, and maintains the information of each data packet in the global topology data incremental storage structure. The data packet information includes the size of the data packet, the five-tuple, and the physical address of the mirroring source device; Step 2: The global topology data incremental storage structure increases the total data volume in the device entry corresponding to each received data packet by the value of the data packet size; determines whether the device entry has a quintuple for the data packet; if the device entry does not have a quintuple for the data packet, creates a quintuple for the data packet and increases the device traffic information; if the device entry does have a quintuple for the data packet, increases the device traffic information; Step 3: After obtaining the data from the incremental storage structure of the global topology data, the STP fault monitoring locator determines all loops in the industrial control network based on the connection relationships between the various devices in the industrial control network topology information. For each loop, the following steps are performed: Step 31: divide the device points in the topology of the industrial control network into a set DEV in_circle and the collection DEV out_circle , among which, DEV in_circle DEV is the set of all devices belonging to the loop. out_circle A collection of devices that do not belong to the loop; Step 32, determine the DEV of the loop in_circle The coefficient of variation C of the total data increment of each device in the preset period in_circle , and C in_circle and the coefficient of variation threshold C threshold Make comparisons; Step 33, determine DEV in_circle The mean value of the total number of devices in the in_circle , determine DEV out_circle The mean value of the total number of devices in the out_circle ; Step 34, determine M in_circle With M out_circle The ratio M rate and the ratio threshold M threshold Make comparisons; Step 35, if C in_circle Not exceeding C threshold , and M rate Beyond M threshold , it is determined that the loop may have an STP fault and the DEV of the loop is determined. in_circle The traffic source IP address with the largest data volume is used as the maximum traffic source device information, and then step 37 is executed; Step 36, if C in_circle Beyond C threshold , and M rate Not exceeding M threshold , then execute step 37; Step 37: Clear the global topology data incremental storage structure and wait for the next detection cycle.

3. The method according to claim 2, characterized in that Step 1 also includes: Step 11: The traffic parser parses the traffic information captured by the TAP switch mirroring architecture and extracts the VLAN ID information, packet size, and quintuple information of each packet VLAN layer in the traffic information. Each VLAN ID corresponds to a network port structure in the industrial control network topology. Step 12: The traffic analyzer converts the VLAN ID of each data packet into a device physical address by querying the industrial control network topology configuration information, and determines the physical address of the mirror source device of the data packet; Step 13: The traffic parser maintains the information of each data packet in the global topology data incremental storage structure, and increases the total device data volume corresponding to each data packet by one. The data packet information includes the size of the data packet, the five-tuple information, and the physical address of the mirror source device; Step 14, for each data packet, determine whether the quintuple information associated with the device corresponding to the data packet exists. If the quintuple information exists, increase the total amount of the quintuple information. If the quintuple information does not exist, create the quintuple information and increase the total amount of the quintuple information.

4. A STP protocol fault monitoring and locating device for an industrial control network, characterized in that: The device comprises: A parsing module is used to parse the traffic information captured by the TAP switch mirroring architecture during the detection cycle, extract the information of each data packet, and maintain the information of each data packet in the global topology data incremental storage structure. The data packet information includes the size of the data packet, the five-tuple, and the physical address of the mirroring source device; an accumulation module, configured to increase the total amount of data in the device entry corresponding to each received data packet by the value of the data packet size; determine whether the device entry has a quintuple for the data packet; if the device entry does not have a quintuple for the data packet, create a quintuple for the data packet and increase the device flow information; if the device entry does have a quintuple for the data packet, increase the device flow information; The fault detection module is used to obtain the data of the global topology data incremental storage structure, and then determine all loops in the industrial control network based on the connection relationship between each device in the industrial control network topology information. For each loop, the following modules are executed: The partitioning module is used to divide the device points in the topology of the industrial control network into sets DEV in_circle and the collection DEV out_circle , among which, DEV in_circle DEV is the set of all devices belonging to the loop. out_circle A collection of devices that do not belong to the loop; The first comparison module is used to determine the DEV of the loop in_circle The coefficient of variation C of the total data increment of each device in the preset period in_circle , and C in_circle and the coefficient of variation threshold C threshold Make comparisons; Determination module, used to determine DEV in_circle The mean value of the total number of devices in the in_circle , determine DEV out_circle The mean value of the total number of devices in the out_circle ; The second comparison module is used to determine M in_circle With M out_circle The ratio M rate and the ratio threshold M threshold Make comparisons; The first determination module is used to in_circle Not exceeding C threshold , and M rate Beyond M threshold In the case of a STP failure, the loop may be judged to have an STP failure, and the DEV of the loop is determined. in_circle The traffic source IP address with the largest data volume is used as the device information of the largest traffic source, and then the end module is executed; The second determination module is used to in_circle Beyond C threshold , and M rate Not exceeding M threshold In the case of , the end module is executed; The end module is used to clear the global topology data incremental storage structure and wait for the next detection cycle.

5. A STP protocol fault monitoring and locating device for an industrial control network, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to claim 2 or 3.

6. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to claim 2 or 3 is implemented.

Images