Protocol detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a protocol detection method and device, electronic equipment and a storage medium. According to the specific scheme, a data processing device communicating based on a target protocol in a target network is determined, the target protocol is a protocol in preset protocols, and the preset protocols comprise one of an IEC 103 protocol, an IEC 104 protocol or an IEC 61850 protocol; acquiring data interaction information between the data processing equipment and equipment communicating with the data processing equipment, and analyzing and processing the data interaction information to obtain key field information corresponding to the data processing equipment; and generating an analog control instruction corresponding to the key field information, and sending the analog control instruction to the data processing equipment, so that the data processing equipment performs an equipment security test based on the analog control instruction. According to the invention, the security detection of the data processing equipment in the multi-protocol environment is realized, and the efficiency and accuracy of the security detection are improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a protocol detection method, device, electronic equipment and storage medium. Background Art

[0002] With the continuous development of power systems, in some power systems, devices communicate with each other through various industrial control protocols. For example, in the industrial control system of the substation, the communication and control between devices are realized through industrial control protocols such as IEC 61850, IEC 104, and IEC 103. With the widespread application of network technology, the above systems are also facing network security threats.

[0003] At present, the traditional protocol detection method can usually only detect devices based on a single protocol communication, which is difficult to meet the communication needs of substations under multiple industrial control protocol environments. In addition, the traditional method usually requires manual analysis of the security communication mechanism of the detection equipment one by one. The above method not only has low detection efficiency, but also easily causes inaccurate detection and high false alarm rate. Summary of the invention

[0004] The present invention provides a protocol detection method, device, electronic equipment and storage medium, which realizes the security detection of data processing equipment in a multi-protocol environment and improves the efficiency and accuracy of security detection.

[0005] According to one aspect of the present invention, a protocol detection method is provided, the method comprising:

[0006] Determine a data processing device that communicates based on a target protocol in a target network, wherein the target protocol is a protocol in a preset protocol, and the preset protocol includes one of IEC 103 protocol, IEC 104 protocol, or IEC 61850 protocol;

[0007] Acquire data interaction information between the data processing device and a device communicating with the data processing device, and parse and process the data interaction information to obtain key field information corresponding to the data processing device;

[0008] Generate a simulation control instruction corresponding to the key field information, and send the simulation control instruction to the data processing device, so that the data processing device performs a device security test based on the simulation control instruction.

[0009] According to another aspect of the present invention, a protocol detection device is provided, the device comprising:

[0010] A device determination module, used for determining a data processing device communicating based on a target protocol in a target network, wherein the target protocol is a protocol in a preset protocol, and the preset protocol includes one of IEC 103 protocol, IEC 104 protocol or IEC 61850 protocol;

[0011] An information acquisition module is used to acquire data interaction information between a data processing device and a device communicating with the data processing device, and parse and process the data interaction information to obtain key field information corresponding to the data processing device;

[0012] The device testing module is used to generate simulation control instructions corresponding to key field information and send the simulation control instructions to the data processing device so that the data processing device performs device security testing based on the simulation control instructions.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by at least one processor so that the at least one processor can execute the protocol detection method of any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the protocol detection method of any embodiment of the present invention when executed.

[0018] According to another aspect of the present invention, there is provided a computer program product, comprising a computer program, wherein the computer program implements the protocol detection method according to any embodiment of the present invention when executed by a processor.

[0019] The technical solution of the embodiment of the present invention facilitates the subsequent security detection of the data processing device by determining the data processing device that communicates based on the target protocol under the target network. The data interaction information between the data processing device and the device that communicates with the data processing device is obtained, and the data interaction information is parsed and processed to obtain the key field information corresponding to the data processing device. Based on this, the accurate acquisition of the key field information is achieved. The simulation control instruction corresponding to the key field information is generated, and the simulation control instruction is sent to the data processing device, so that the data processing device performs the device security test based on the simulation control instruction. By performing the security detection on the data processing device through the simulation control instruction, it can be determined whether the data device has potential communication anomalies and security threats. The present invention solves the problem that the prior art can only detect the device of a single protocol and it is difficult to meet the communication requirements under multiple industrial control protocol environments, and solves the problem of low test efficiency and test accuracy caused by manual detection one by one, and realizes the security detection of data processing devices under multiple protocol environments, and improves the efficiency and accuracy of security detection.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of a protocol detection method provided by an embodiment of the present invention;

[0023] Figure 2 is a flow chart of a protocol detection method provided by an embodiment of the present invention;

[0024] Figure 3 This is an example diagram of obtaining detailed device information through an IEC 61850 function provided by an embodiment of the present invention;

[0025] Figure 4 This is an example diagram of performing device security testing on a data processing device based on IEC 103 protocol communication provided by an embodiment of the present invention;

[0026] Figure 5 It is an example diagram of key field information of a data processing device for communication based on IEC 104 protocol provided by an embodiment of the present invention;

[0027] Figure 6 It is a structural schematic diagram of a protocol detection device provided by an embodiment of the present invention;

[0028] Figure 7 It is a structural schematic diagram of an electronic device for implementing the protocol detection method of an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 This is a flow chart of a protocol detection method provided in the first embodiment of the present invention. This embodiment is applicable to the case where security detection of data processing equipment is performed in a multi-protocol environment. The method can be executed by a protocol detection device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device such as a computer or server. Figure 1 As shown, the method includes:

[0033] S110, determining a data processing device that communicates based on a target protocol in a target network.

[0034] The target protocol is a protocol in the preset protocol, and the preset protocol includes one of the IEC 103 protocol, the IEC 104 protocol, or the IEC 61850 protocol. The following is an explanation using the power system as an application scenario. The target network can be understood as a network that supports communications using multiple protocols. The target network includes multiple data processing devices, and the data processing devices can be power devices that communicate based on different target protocols. The target protocol is a protocol in the preset protocol. The preset protocol can be the IEC 103 protocol, the IEC 104 protocol, or the IEC 61850 protocol. The IEC 103 protocol is mainly used for communication of data processing devices and supports various types of data transmission in power systems. The IEC 104 protocol is a remote control communication protocol based on TCP / IP, and is usually used for reliable and efficient data communication between automation equipment and monitoring systems in power systems. The IEC 61850 protocol is usually used for data communication between data processing devices in substations.

[0035] In a multi-protocol communication environment, in order to ensure the normal operation of each power device in the power system, the specifications and data formats corresponding to the preset protocol can be integrated into the protocol detection device so that the protocol detection device can perform safety detection on the data processing device. For example, the preset protocol to be integrated into the protocol detection device can be determined first. For example, the protocol detection device can be an IECScan tool. The preset protocol can be an IEC 103 protocol, an IEC 104 protocol, and an IEC 61850 protocol. Determine the detailed specifications and data formats corresponding to these preset protocols. Integrate the detailed specifications and data formats of the preset protocol into the IECScan tool so that the IECScan tool can identify and parse the communication data packets corresponding to the data processing device. It should be noted that the libiec61850python library file can be integrated to facilitate the operation of the data processing device.

[0036] Specifically, the operation status of the data processing device in the target network is detected according to the preset network request. If the data processing device is online and can respond to the preset network request, the data processing device in the target network is determined to be alive. The data processing device in the alive state is port scanned to determine the target protocol corresponding to the data processing device. Based on this, the data processing device communicating based on the target protocol in the target network is determined.

[0037] In an embodiment of the present invention, a method for determining a data processing device that communicates based on a target protocol under a target network may be: based on a preset network request, determining a data processing device whose operating status meets preset conditions under the target network, and performing port scanning processing on the data processing device to obtain a port scanning result corresponding to the data processing device; based on the port scanning result and a preset corresponding relationship, determining the target protocol corresponding to the data processing device, wherein the preset corresponding relationship is a corresponding relationship between the port scanning result and the preset protocol.

[0038] Among them, the preset network request can be understood as a preset request for accessing the data processing device under the target network. Optionally, the preset network request can be an Internet Control Message Protocol (ICMP) request, such as a Ping request. The running state is the running state of the data processing device. The preset condition is a preset state condition of the data processing device. If the data processing device is online and the data processing device can respond to the network request, it is determined that the running state of the data processing device meets the preset condition. Port scanning is used to identify the services running on the data processing device. The port scanning result can be understood as the port number information corresponding to the data processing device. The preset corresponding relationship is the corresponding relationship between the port scanning result and the preset protocol. For example, port number 102 corresponds to the IEC 61850 protocol, port number 2404 corresponds to the IEC 104 protocol, and port number 6000 corresponds to the IEC 103 protocol.

[0039] Specifically, the data processing device under the target network is detected using a preset network request. If the data processing device is online and can respond to the preset network request, it is determined that the operating state of the data processing device meets the preset conditions. Port scanning is performed on the data processing device whose operating state meets the preset conditions to determine the port scanning result corresponding to the data processing device, providing a data basis for the subsequent determination of the target protocol. According to the port scanning result corresponding to the data processing device and the preset corresponding relationship, the target protocol corresponding to the port scanning result is determined.

[0040] Exemplarily, a Ping request is used to detect whether the data processing device in the target network is online and can respond to the Ping request. If so, the data processing device whose operating state meets the preset conditions under the target network is determined, providing a detection object for subsequent security detection. Port scanning is performed on the data processing device whose operating state meets the preset conditions to obtain the port number corresponding to the data processing device. According to the port number corresponding to the data processing device, the target protocol corresponding to the data processing device is determined. For example, if the port number of the data processing device is 102, the target protocol of the data processing device is the IEC 61850 protocol.

[0041] It should be noted that the target protocol can be determined by capturing and analyzing the communication data packets of the data processing device.

[0042] S120: Acquire data interaction information between the data processing device and a device communicating with the data processing device, and parse the data interaction information to obtain key field information corresponding to the data processing device.

[0043] The data interaction information may be information in a communication data packet between a data processing device and a device communicating with the data processing device. The device communicating with the data processing device may be a device in a monitoring system for monitoring the data processing device. The key field information may be understood as key fields and data information used to control the data processing device.

[0044] For data processing equipment that communicates based on the IEC 103 protocol, the key field information includes the group number and entry number of the data processing equipment. The group number is used to identify the functional group of the data processing equipment and distinguish the different functions of the data processing equipment. The entry number is used to identify the specific measurement value or control instruction corresponding to the data processing equipment, which is convenient for locating operations or data related to the data processing equipment.

[0045] For data processing equipment based on IEC 104 protocol communication, key field information includes the public address of the data processing equipment, the remote control mode and the remote control address. Among them, the public address is used to identify the unique address of the data processing equipment. Under the target network, there may be multiple data processing equipment based on IEC 104 protocol communication, and each data processing equipment needs a public address to ensure that the data of the data processing equipment can be correctly routed and processed. Optionally, the data processing equipment based on IEC 104 protocol communication can be a remote terminal unit (RTU) device or a control device. The remote control mode can be a mode for remotely operating and controlling the data processing equipment. The remote control mode can be a single-point remote control mode or a dual-point remote control mode. In actual application, it may appear that a single-point remote signal corresponds to a dual-point remote control mode, a dual-point remote signal corresponds to a single-point remote control mode, a single-point remote signal corresponds to a single-point remote control mode, and a dual-point remote signal corresponds to a dual-point remote control mode. The remote control address is used to identify the specific component of the remote control instruction corresponding to the remote control mode. For example, the specific component can be a switch or circuit breaker of the data processing equipment.

[0046] For data processing equipment that communicates based on the IEC 61850 protocol, key field information includes the logical device name, logical node name, and circuit breaker position of the data processing equipment. Among them, the logical device name can be understood as a virtual device for aggregating multiple logical nodes and data. A data processing device can correspond to one or more logical devices. The logical node name is the name of the logical node. The logical node is the basic unit for implementing functions in the IEC 61850 protocol and represents a specific functional module or functional block in the device. Each logical node performs specific operations such as measurement, control, or protection. The circuit breaker position is used to identify the state of the circuit breaker. For example, the circuit breaker position can indicate whether the circuit breaker in the data processing device is in the open state or the closed state.

[0047] Specifically, the communication data packets between the data processing device and the device communicating with the data processing device are captured. The data exchange information is obtained by parsing the communication data packets. The data exchange information is parsed and processed to obtain the key field information corresponding to the target protocol of the data processing device. By determining the key field information, the control logic and specific execution operations corresponding to the data processing device can be accurately determined, providing data basis for subsequent security testing.

[0048] S130, generating a simulation control instruction corresponding to the key field information, and sending the simulation control instruction to the data processing device, so that the data processing device performs a device security test based on the simulation control instruction.

[0049] Among them, the simulated control instruction may be an instruction for controlling a data processing device. The device security test may be a test for evaluating the security of a data processing device. It should be noted that for security testing, the simulated control instruction is usually an instruction for simulating the control of a data processing device. Optionally, the simulated control instruction may simulate a legitimate control instruction or a specific attack behavior. For example, the simulated control instruction may be an operation for controlling a switch of a data processing device to close or open the switch, or an operation for controlling a data processing device to flip a state, etc. The simulated control instruction may also be an instruction for replaying an attack.

[0050] Specifically, the simulation control instruction corresponding to the key field information is determined according to the key field information. The simulation control instruction is sent to the data processing device to determine the security of the data processing device according to the feedback of the data processing device. Based on this, it is convenient to repair the potential security vulnerabilities of the data processing device in a timely manner and improve the overall security level.

[0051] In an embodiment of the present invention, the process of performing security testing also includes: receiving a test log corresponding to the security test, wherein the test log includes an instruction response method and an instruction response result of the data processing device; and determining a security verification result of the data processing device based on the test log and a standard log corresponding to the data processing device.

[0052] Among them, the test log may be the log information fed back by the data processing device. The test log may include the instruction response mode and instruction response result of the data processing device. The instruction response mode is the mode in which the data processing device responds to the simulated control instruction. The instruction response result can be understood as the result of the data processing device responding to the simulated control instruction. The standard log may be the standard log information of the data processing device based on the target protocol communication. The standard log may include a preset response mode and a preset response result. The preset response mode can be understood as a preset reference mode in which the data processing device responds to the simulated control instruction. The preset response result can be understood as a preset reference result in which the data processing device responds to the simulated control instruction. The security verification result can be understood as the test result of whether the data processing device has potential security vulnerabilities.

[0053] Specifically, after sending a simulated control instruction to the data processing device, the data processing device will perform corresponding operations based on the simulated control instruction and feedback a test log corresponding to the device security test. The instruction response method and instruction response result in the test log are compared with the preset response method and preset response result in the standard log to determine the security verification result of the data processing device. Based on this, the security verification result can be used to confirm the possible security vulnerabilities in the data processing device and determine the security of the data processing device.

[0054] In an embodiment of the present invention, the method for determining the security verification result can be: if the instruction response method and instruction response result of the test log are consistent with the preset response method and preset response result in the standard log, it is determined that the data processing device lacks a security authentication mechanism, and the security verification result of the data processing device is verification failure.

[0055] Among them, the security authentication mechanism can be used to ensure the safe operation of the data processing device. Optionally, the security authentication mechanism may include at least one of a plain text transmission information mechanism, an identity authentication mechanism and an authorization mechanism. The plain text transmission information mechanism can be understood as a method of directly transmitting data between a data processing device and a device communicating with the data processing device without any encryption processing. Plain text is data that has not been encrypted. The identity authentication mechanism can be a certain means to complete the determination and verification of the device that sends the control instruction to the data processing device. The authorization mechanism is used to set the authority of the device that sends the control instruction to the data processing device to achieve access control to the device.

[0056] Specifically, if the instruction response method in the test log is consistent with the preset response method in the standard log, and the instruction response result in the test log is consistent with the preset response result in the standard log, it means that the data processing device can respond normally to the simulated control instruction, and it is possible that the data processing device responds to any device that sends a control instruction to it, that is, the data processing device lacks a security authentication mechanism, and the security verification result of the data processing device is verification failure. Correspondingly, if the instruction response method and instruction response result in the test log are different from those in the standard log, or the data processing device does not respond to the simulated control instruction, it means that the data processing device is secure, and the security verification result is verification passed.

[0057] The technical solution of this embodiment facilitates the subsequent security detection of the data processing device by determining the data processing device that communicates based on the target protocol under the target network. The data interaction information between the data processing device and the device that communicates with the data processing device is obtained, and the data interaction information is parsed and processed to obtain the key field information corresponding to the data processing device. Based on this, the accurate acquisition of the key field information is achieved. A simulation control instruction corresponding to the key field information is generated, and the simulation control instruction is sent to the data processing device, so that the data processing device performs a device security test based on the simulation control instruction. By performing a device security test on the data processing device through the simulation control instruction, it can be determined whether the data device has potential communication anomalies and security threats. The present invention solves the problem that the prior art can only detect devices with a single protocol and is difficult to meet the communication requirements under multiple industrial control protocol environments, and solves the problem of low test efficiency and test accuracy caused by manual detection one by one, and realizes the security detection of data processing devices under multiple protocol environments, and improves the efficiency and accuracy of security detection.

[0058] Embodiment 2

[0059] Figure 2 This is a flowchart of a protocol detection method provided by the second embodiment of the present invention. This embodiment is based on the above embodiment and refines the step of "obtaining data interaction information between a data processing device and a device communicating with the data processing device, and parsing and processing the data interaction information to obtain key field information corresponding to the data processing device". The specific implementation method can be found in the technical solution of this embodiment. Among them, the technical terms that are the same as or corresponding to the above embodiment are not repeated here. Figure 2 As shown, the method includes:

[0060] S210, determining a data processing device that communicates based on a target protocol in a target network.

[0061] The target protocol is a protocol in the preset protocol, and the preset protocol includes one of the IEC 103 protocol, the IEC 104 protocol or the IEC 61850 protocol.

[0062] S220, capturing at least one communication data packet between the data processing device and a device communicating with the data processing device based on the target protocol communication.

[0063] The communication data packet may be understood as a data packet for data exchange between a data processing device and a device communicating with the data processing device.

[0064] Specifically, at least one communication data packet based on the target protocol between the data processing device and a device communicating with the data processing device is captured to determine key field information of the target protocol corresponding to the data processing device based on the at least one communication data packet.

[0065] Exemplarily, for a data processing device that communicates based on the IEC 103 protocol, a network sniffer tool is used to capture at least one communication data packet based on the IEC 103 protocol between the data processing device and the device in the monitoring system according to the specification corresponding to the IEC 103 protocol. For a data processing device that communicates based on the IEC 104 protocol, a network sniffer tool is used to capture at least one communication data packet based on the IEC 104 protocol between the data processing device and the device in the monitoring system according to the specification corresponding to the IEC 104 protocol. Correspondingly, for a data processing device that communicates based on the IEC 61850 protocol, a network sniffer tool is used to capture at least one communication data packet based on the IEC 61850 protocol between the data processing device and the device in the monitoring system according to the specification corresponding to the IEC 61850 protocol.

[0066] S230, parse and process at least one communication data packet to obtain data interaction information corresponding to the data processing device, and parse and process the data interaction information to obtain key field information corresponding to the data processing device.

[0067] Specifically, according to the specification corresponding to the target protocol, at least one communication data packet corresponding to the data processing device is parsed and processed to determine the data interaction information. The data interaction information is parsed and processed to obtain key field information for controlling the data processing device.

[0068] In an embodiment of the present invention, when the data processing device is a data processing device that communicates based on the IEC 61850 protocol, the key field information may also be determined by: establishing a connection with the data processing device based on the configuration parameters corresponding to the IEC 61850 protocol, calling a preset function to generate a data acquisition request, and sending the data acquisition request to the data processing device; parsing and processing the device data information fed back by the data processing device to obtain the key field information of the data processing device.

[0069] The configuration parameters may be parameters for establishing a communication connection for a data processing device based on the IEC 61850 protocol. The preset function may be a function for generating a data acquisition request to obtain device data information. Optionally, the preset function may be an IEC 61850 function. For example, the method for obtaining device data information of a data processing device through an IEC 61850 function may be as follows: Figure 3 The data acquisition request is used to obtain device data information of a data processing device based on IEC 61850 protocol communication. The device data information can be understood as detailed device information corresponding to the data processing device based on IEC 61850 protocol communication.

[0070] Specifically, for a data processing device that communicates based on the IEC 61850 protocol, a connection can also be established with the data processing device through the configuration parameters corresponding to the IEC 61850 protocol. A preset function is called to generate a data acquisition request to obtain device data information fed back by the data processing device based on the data acquisition request. The device data information is parsed and processed to obtain key field information of the data processing device. Based on this, it is convenient to generate analog control instructions for controlling the data processing device according to the key information.

[0071] S240: Generate a simulation control instruction corresponding to the key field information, and send the simulation control instruction to the data processing device, so that the data processing device performs a device security test based on the simulation control instruction.

[0072] For example, see Figure 4 For a data processing device that communicates based on the IEC 103 protocol, the group number in the key field information can be determined to be 7d and the entry number to be 03 through a communication data packet based on the IEC 103 protocol. According to the group number 7d and the entry number 03, the simulated control instruction is replayed to determine whether there is a replay attack on the IEC 103 protocol based on the simulated control instruction, avoid attacks on plaintext information leakage, and realize the detection of the plaintext transmission information mechanism of the data processing device.

[0073] See also Figure 5 , Figure 5An example diagram for obtaining the public address and remote control method of a data processing device based on IEC 104 protocol communication. For a data processing device based on IEC 104 protocol communication, the public address and remote control method of the data processing device based on IEC 104 protocol communication can be determined first. A simulation control instruction is constructed through the public address, remote control method and remote control address. A simulation control instruction is sent to the data processing device to control the opening, closing, state flipping and other behaviors of the data processing device. Thus, the identity authentication mechanism and authorization mechanism of the data processing device based on IEC 104 protocol communication are detected.

[0074] For data processing equipment based on IEC 61850 protocol communication, a simulation detection instruction is constructed through the logical device name, logical node name, and circuit breaker position. The simulation control instruction is sent to the data processing equipment to control the opening, closing, state flipping and other behaviors of the data processing equipment. Thus, the identity authentication mechanism and authorization mechanism of the data processing equipment based on IEC 61850 protocol communication are detected.

[0075] The technical solution of this embodiment facilitates the subsequent security detection of the data processing device by determining the data processing device that communicates based on the target protocol under the target network. At least one communication data packet based on the target protocol communication between the data processing device and the device that communicates with the data processing device is captured. At least one communication data packet is parsed and processed to obtain data interaction information corresponding to the data processing device, and the data interaction information is parsed and processed to obtain key field information corresponding to the data processing device. Based on this, accurate acquisition of key field information is achieved. A simulation control instruction corresponding to the key field information is generated, and the simulation control instruction is sent to the data processing device, so that the data processing device performs a device security test based on the simulation control instruction. By performing a security detection on the data processing device through the simulation control instruction, it can be determined whether the data device has potential communication anomalies and security threats. The present invention solves the problem that the prior art can only detect devices with a single protocol and is difficult to meet the communication requirements under multiple industrial control protocol environments, and solves the problem of low test efficiency and test accuracy caused by manual detection one by one, and realizes the security detection of data processing devices under multiple protocol environments, and improves the efficiency and accuracy of security detection.

[0076] Embodiment 3

[0077] Figure 6 Schematic diagram of the structure of a protocol detection device provided by the third embodiment of the present invention. Figure 6 As shown, the apparatus includes: a device determination module 310 , an information acquisition module 320 and a device testing module 330 .

[0078] The device determination module 310 is used to determine the data processing device that communicates based on the target protocol under the target network, wherein the target protocol is a protocol in the preset protocol, and the preset protocol includes one of the IEC 103 protocol, the IEC 104 protocol or the IEC 61850 protocol; the information acquisition module 320 is used to obtain data interaction information between the data processing device and the device that communicates with the data processing device, and parse the data interaction information to obtain key field information corresponding to the data processing device; the device testing module 330 is used to generate a simulation control instruction corresponding to the key field information, and send the simulation control instruction to the data processing device, so that the data processing device performs a device security test based on the simulation control instruction.

[0079] The technical solution of this embodiment facilitates the subsequent security detection of the data processing device by determining the data processing device that communicates based on the target protocol under the target network. The data interaction information between the data processing device and the device that communicates with the data processing device is obtained, and the data interaction information is parsed and processed to obtain the key field information corresponding to the data processing device. Based on this, the accurate acquisition of the key field information is achieved. A simulation control instruction corresponding to the key field information is generated, and the simulation control instruction is sent to the data processing device, so that the data processing device performs a device security test based on the simulation control instruction. By performing a security detection on the data processing device through the simulation control instruction, it can be determined whether the data device has potential communication anomalies and security threats. The present invention solves the problem that the prior art can only detect devices with a single protocol and is difficult to meet the communication requirements under multiple industrial control protocol environments, and solves the problem of low test efficiency and test accuracy caused by manual detection one by one, and realizes the security detection of data processing devices under multiple protocol environments, and improves the efficiency and accuracy of security detection.

[0080] On the basis of the above embodiment, optionally, the device determination module includes: a device port scanning unit, which is used to determine, based on a preset network request, a data processing device whose operating status meets preset conditions under the target network, and perform port scanning processing on the data processing device to obtain a port scanning result corresponding to the data processing device; a target protocol determination unit, which is used to determine the target protocol corresponding to the data processing device based on the port scanning result and a preset corresponding relationship, wherein the preset corresponding relationship is the corresponding relationship between the port scanning result and the preset protocol.

[0081] Optionally, the information acquisition module includes: a data packet capture unit, used to capture at least one communication data packet based on the target protocol communication between the data processing device and a device communicating with the data processing device; an interaction information determination unit, used to parse and process at least one communication data packet to obtain data interaction information corresponding to the data processing device.

[0082] Optionally, in the case where the data processing device is a data processing device that communicates based on the IEC 61850 protocol, the information acquisition module also includes: a device connection unit, used to establish a connection with the data processing device based on the configuration parameters corresponding to the IEC 61850 protocol, and call a preset function to generate a data acquisition request, and send the data acquisition request to the data processing device; an information parsing unit, used to parse and process the device data information received from the data processing device to obtain key field information of the data processing device.

[0083] Optionally, for data processing equipment based on IEC 103 protocol communication, the key field information includes the group number and entry number of the data processing equipment; for data processing equipment based on IEC 104 protocol communication, the key field information includes the public address, remote control mode and remote control address of the data processing equipment; for data processing equipment based on IEC 61850 protocol communication, the key field information includes the logical device name, logical node name and circuit breaker position of the data processing equipment.

[0084] Optionally, the device also includes: a verification result determination module, including: a log receiving unit, used to receive a test log corresponding to the security test, wherein the test log includes an instruction response method and an instruction response result of the data processing device; a result determination unit, used to determine the security verification result of the data processing device based on the test log and a standard log corresponding to the data processing device.

[0085] Optionally, a result determination unit is used to determine that the data processing device lacks a security authentication mechanism and the security verification result of the data processing device is verification failure if the instruction response method and instruction response result of the test log are consistent with the preset response method and preset response result in the standard log.

[0086] The protocol detection device provided in the embodiment of the present invention can execute the protocol detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0087] Embodiment 4

[0088] Figure 71 is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0089] like Figure 7 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0090] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0091] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the protocol detection method.

[0092] In some embodiments, the protocol detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the protocol detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the protocol detection method in any other appropriate manner (e.g., by means of firmware).

[0093] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0094] The computer program for implementing the protocol detection method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0095] Embodiment 5

[0096] Embodiment 5 of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a processor to execute a protocol detection method, the method comprising:

[0097] Determine a data processing device that communicates based on a target protocol under a target network, wherein the target protocol is a protocol in a preset protocol, and the preset protocol includes one of IEC 103 protocol, IEC 104 protocol, or IEC 61850 protocol; obtain data interaction information between the data processing device and a device that communicates with the data processing device, and parse and process the data interaction information to obtain key field information corresponding to the data processing device; generate a simulation control instruction corresponding to the key field information, and send the simulation control instruction to the data processing device, so that the data processing device performs a device security test based on the simulation control instruction.

[0098] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0099] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0100] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0101] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0102] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0103] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A protocol detection method, characterized in that: include: Determine a data processing device that communicates based on a target protocol in a target network, wherein the target protocol is a protocol in a preset protocol, and the preset protocol includes one of an IEC 103 protocol, an IEC 104 protocol, or an IEC 61850 protocol; Acquire data interaction information between the data processing device and a device communicating with the data processing device, and parse and process the data interaction information to obtain key field information corresponding to the data processing device; Generate a simulation control instruction corresponding to the key field information, and send the simulation control instruction to the data processing device, so that the data processing device performs a device safety test based on the simulation control instruction.

2. The method according to claim 1, characterized in that: The data processing device for determining target network based on target protocol communication includes: Based on the preset network request, determine the data processing device whose operating status meets the preset conditions under the target network, and perform port scanning processing on the data processing device to obtain the port scanning result corresponding to the data processing device; Based on the port scanning result and a preset corresponding relationship, a target protocol corresponding to the data processing device is determined, wherein the preset corresponding relationship is a corresponding relationship between the port scanning result and the preset protocol.

3. The method according to claim 1, characterized in that: The acquiring of data interaction information between the data processing device and a device communicating with the data processing device includes: capturing at least one communication data packet between the data processing device and a device communicating with the data processing device based on the target protocol; Parse and process at least one of the communication data packets to obtain data interaction information corresponding to the data processing device.

4. The method according to claim 1, characterized in that In the case where the data processing device is a data processing device based on the IEC61850 protocol communication, determining the key field information further includes: Based on the configuration parameters corresponding to the IEC 61850 protocol, a connection is established with the data processing device, and a preset function is called to generate a data acquisition request, and the data acquisition request is sent to the data processing device; The device data information fed back by the data processing device is parsed and processed to obtain key field information of the data processing device.

5. The method according to claim 1, characterized in that For a data processing device that communicates based on the IEC 103 protocol, the key field information includes the group number and entry number of the data processing device; for a data processing device that communicates based on the IEC 104 protocol, the key field information includes the public address, remote control mode and remote control address of the data processing device; for a data processing device that communicates based on the IEC 61850 protocol, the key field information includes the logical device name, logical node name and circuit breaker position of the data processing device.

6. The method according to claim 1, characterized in that During the safety test, the method further includes: receiving a test log corresponding to the security test, wherein the test log includes an instruction response mode and an instruction response result of the data processing device; A security verification result of the data processing device is determined based on the test log and a standard log corresponding to the data processing device.

7. The method according to claim 6, characterized in that The step of determining the security verification result of the data processing device based on the test log and the standard log corresponding to the preset protocol includes: If the instruction response mode and instruction response result of the test log are consistent with the preset response mode and preset response result in the standard log, it is determined that the data processing device lacks a security authentication mechanism, and the security verification result of the data processing device is verification failure.

8. A protocol detection device, characterized in that: include: A device determination module, used to determine a data processing device that communicates based on a target protocol in a target network, wherein the target protocol is a protocol in a preset protocol, and the preset protocol includes one of IEC 103 protocol, IEC 104 protocol or IEC 61850 protocol; An information acquisition module, used to acquire data interaction information between the data processing device and a device communicating with the data processing device, and parse the data interaction information to obtain key field information corresponding to the data processing device; The device testing module is used to generate a simulation control instruction corresponding to the key field information, and send the simulation control instruction to the data processing device, so that the data processing device performs a device safety test based on the simulation control instruction.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the protocol detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the protocol detection method according to any one of claims 1 to 7 when executed.

Images