Hierarchical identification method based on industrial control equipment interaction mode

Abstract

The invention discloses a hierarchical identification method based on an industrial control equipment interaction mode, and relates to the field of industrial control asset identification, and the method comprises the following steps: collecting flow data in a to-be-identified industrial control system network, and carrying out the preprocessing of the flow data; extracting equipment interaction characteristic attributes meeting the level identification requirement in the preprocessed flow data to form an equipment interaction mode set; shunting the device interaction mode set to obtain a device IP address pair set using an industrial control protocol for communication and a device IP address pair set not using the industrial control protocol for communication; and respectively carrying out equipment identification of less than three layers and equipment identification of more than three layers on the equipment IP address pair set using the industrial control protocol for communication and the equipment IP address pair set not using the industrial control protocol for communication. According to the method, the equipment levels in the unknown industrial control system can be accurately identified by utilizing the equipment interaction relationship in the network traffic, and a cognitive basis is provided for subsequent deployment of safety equipment.

Description

Technical Field

[0001] The present invention relates to the field of industrial control asset identification, and in particular to a hierarchical identification method based on an interaction mode of industrial control equipment. Background Art

[0002] Network asset detection refers to the process of tracking and mastering the status of network assets, and is an important prerequisite for achieving network security management. IT systems usually use active detection to detect assets, but this method is not suitable for industrial control systems. Compared with traditional IT systems, industrial control systems include not only traditional equipment such as hosts, switches, and routers in IT systems, but also unique industrial control equipment such as HMI, PLC, and RTU. In addition, industrial control systems also have the characteristics of device heterogeneity, weak computing power of devices, and long TCP session running time. If traditional asset detection methods are directly applied to industrial control systems, not only will we not be able to obtain the information we need, but it will also interfere with the normal and stable operation of the system.

[0003] In order to reduce the interference of traditional asset detection methods on industrial control systems, identify industrial control equipment in a targeted manner, and solve the problem of blind detection causing impact on the system when the equipment type is not clearly distinguished during asset detection, combined with the different sensitivity characteristics of various ICS devices, it is proposed to first perform device-level identification on industrial control equipment during asset detection, and then use different detection methods for traditional IT equipment and industrial control equipment to obtain detailed information. In the process of hierarchical identification of industrial control equipment, industrial control equipment and traditional IT equipment exist in the industrial control system at the same time. Different communication characteristics between them will produce different communication modes. The mixture of the two communication modes will interfere with the hierarchical identification of industrial control equipment. The existing method directly performs hierarchical identification on mixed traffic, which has the problem of low identification accuracy. Therefore, in order to improve the accuracy of device hierarchical identification, it is necessary to separate the communication traffic of the two types of equipment and then perform hierarchical identification separately.

[0004] The industrial control system that conforms to the Purdue model includes a five-layer structure: the equipment at and above the enterprise network layer is mainly composed of traditional IT equipment such as hosts and servers. The research focus of industrial control asset detection is on industrial control equipment below layer 3, so this part is not specifically subdivided when identifying the device level, and is uniformly identified as layer 3 and above equipment. The process monitoring layer includes HMI, SCADA server, engineer station, historical database, etc. The role of these devices is to monitor and control the equipment on site. The device level identifies them as layer 2 devices. The field control layer is mainly connected to the field equipment, including PLC, RTU, IED, etc., and the device level identifies them as layer 1 devices. The field device layer includes some actuators and sensors, etc. When we perform layer identification, because Remote IO is installed at the remote site and it has no controller, the data must be transmitted to the control layer device in the end, and it is identified as a layer 0 device. Summary of the invention

[0005] In view of the shortcomings of the existing technology, the present invention proposes a hierarchical identification method based on the interaction mode of industrial control equipment. Its purpose is to solve the problems of low accuracy of device hierarchical identification and device communication mode limited by ideal environment in the existing methods. Compared with the current industrial control equipment hierarchical identification method, the accuracy and versatility are improved.

[0006] The technical solution adopted by the present invention to achieve the above-mentioned purpose is:

[0007] A hierarchical identification method based on an interaction mode of industrial control equipment comprises the following steps:

[0008] 1) Collect the traffic data in the network of the industrial control system to be identified and pre-process it;

[0009] 2) Extracting the device interaction feature attributes that meet the hierarchical identification requirements from the preprocessed traffic data to form a device interaction pattern set;

[0010] 3) Dividing the device interaction mode set to obtain a set of device IP address pairs that use the industrial control protocol for communication and a set of device IP address pairs that do not use the industrial control protocol for communication;

[0011] 4) Perform layer 3 or lower device identification and layer 3 or higher device identification on a set of device IP addresses pairs that use an industrial control protocol for communication and a set of device IP addresses pairs that do not use an industrial control protocol for communication, respectively.

[0012] The pretreatment in step 1) is specifically as follows:

[0013] Directly remove the broadcast traffic in the network traffic of industrial control equipment, and use manual session completion to supplement the lost messages in the network traffic of industrial control equipment, that is, the incomplete interactive messages in the session.

[0014] The device interaction mode f is a set of characteristic attributes used to describe the interaction information between devices, expressed as:

[0015] f=<clientIp,serverIp,clientPort,serverPort>

[0016] Wherein, clientIp represents the client IP address of the session between devices, serverIp represents the server IP address of the session between devices, clientPort represents the client port number of the session between devices, and serverPort represents the server port number of the session between devices;

[0017] The device interaction mode set FS is composed of multiple device interaction modes f, which can be expressed as:

[0018] FS = {f 1 , f 2 , …, f n}

[0019] Where n is the number of elements in the device interaction mode set;

[0020] The device that meets the hierarchical identification requirements means that the characteristic attribute information of the device does not lack any information in the device interaction mode f.

[0021] The step 3) comprises the following steps:

[0022] 3.1) The device interaction mode set FS is filtered by ports to obtain the address pair set IPSF, where the address pair set IPSF is a set consisting of IP address pairs ips, expressed as

[0023] IPSF = {ips 1 ,ips 2 ,…,ips m}

[0024] Where m is the number of IP address pair elements;

[0025] 3.2) Determine whether the server port number in f is a port number specific to the industrial control protocol. If so, f is a session that uses the industrial control protocol for communication, and the IP address pair ips is stored in the set IPSF_ICS; otherwise, f is a session that does not use the industrial control protocol for communication, and the IP address pair ips is stored in the set IPSF_NOICS, where ips is represented by<clientIp,serverIp> .

[0026] The step of identifying devices below layer 3 on a set of IP addresses of devices communicating using an industrial control protocol comprises the following steps:

[0027] 1) Extract all IP address sets IcsIpSet, client IP address set clientIpSet and server IP address set serverIpSet from IPSF_ICS set respectively;

[0028] 2) For any device in IcsIpSet, if the device's IP address deviceIp only exists in clientIpSet but not in serverIpSet, the device is determined to be a layer 2 device;

[0029] 3) For any device in IcsIpSet, if the device's IP address deviceIp exists in both clientIpSet and serverIpSet, the device is determined to be a layer 1 device;

[0030] 4) For any device in IcsIpSet, if the device's IP address deviceIp only exists in serverIpSet and its corresponding client device is a layer 2 device, then the device is determined to be a layer 1 device;

[0031] 5) The remaining devices are determined to be layer 0 devices.

[0032] The step of identifying devices below layer 3 for a set of IP addresses of devices that do not use an industrial control protocol for communication comprises the following steps:

[0033] 1) Extract all IP address sets in IPSF_NOICS, filter out the IPs that are not in the IcsIpSet set and store them in NonIcsIpSet;

[0034] 2) For any device in NonIcsIpSet, if the device communicates with a layer 2 device, the device is determined to be a layer 3 or higher device.

[0035] A hierarchical identification system based on the interaction mode of industrial control equipment includes:

[0036] The data acquisition module is used to collect the flow data in the network of the industrial control system to be identified and pre-process it;

[0037] The device interaction pattern set building module is used to extract the device interaction feature attributes that meet the hierarchical identification requirements from the pre-processed traffic data to form a device interaction pattern set;

[0038] A traffic distribution module is used to distribute the device interaction mode set to obtain a set of device IP address pairs that use the industrial control protocol for communication and a set of device IP address pairs that do not use the industrial control protocol for communication;

[0039] The identification module is used to identify devices below layer 3 and devices above layer 3 for a set of device IP addresses that communicate using an industrial control protocol and a set of device IP addresses that do not communicate using an industrial control protocol.

[0040] A hierarchical identification system based on an industrial control equipment interaction mode comprises a memory and a processor; the memory is used to store a computer program; the processor is used to implement the hierarchical identification method based on an industrial control equipment interaction mode when executing the computer program.

[0041] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the hierarchical identification method based on the interaction mode of industrial control equipment is implemented.

[0042] The present invention has the following beneficial effects and advantages:

[0043] 1. The device interaction mode is not extracted under the ideal device communication mode. It can be used in real industrial control scenarios and has good versatility and applicability.

[0044] 2. The problem that the mixed communication mode caused by the different communication characteristics of industrial control equipment and traditional IT equipment will interfere with the hierarchical identification of industrial control equipment is solved. The industrial control protocol filtering is used to effectively handle the situation where industrial control equipment and traditional IT equipment coexist in the industrial control system, thereby improving the accuracy of hierarchical identification of industrial control equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a schematic flow diagram of the method of the present invention;

[0046] Figure 2 is a session diagram when extracting the interaction mode of the industrial control device in an embodiment of the present invention;

[0047] Figure 3 is a topological diagram of the public data set run_6rtu in an embodiment of the present invention;

[0048] Figure 4 This is a schematic diagram of commonly used protocols and corresponding port numbers when filtering industrial control protocols in an embodiment of the present invention;

[0049] Figure 5 It is a specific flow chart of the identification of devices below the third layer in the method of the present invention;

[0050] Figure 6 It is a specific flow chart of the identification of layer 3 and above devices in the method of the present invention. DETAILED DESCRIPTION

[0051] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0052] The overall process of a hierarchical identification method based on an industrial control equipment interaction mode provided by an embodiment of the present invention is as follows: Figure 1 As shown, the specific steps include:

[0053] 1) Collect traffic data in the network of the industrial control system to be identified;

[0054] 2) Preprocessing the collected traffic data;

[0055] 3) Extracting a set of device interaction patterns that meet the hierarchical identification requirements from the preprocessed traffic data;

[0056] 4) Dividing the device interaction mode set to obtain a set of device IP address pairs that use the industrial control protocol for communication and a set of device IP address pairs that do not use the industrial control protocol for communication;

[0057] 5) Identify devices below Layer 3 for the IP address pair set of devices that communicate using industrial control protocols;

[0058] 6) Based on the analysis results of step 5), identify layer 3 and above devices for the set of device IP addresses that do not use industrial control protocols for communication.

[0059] The preprocessing of the collected traffic data in step 2) is specifically as follows: the broadcast traffic in the industrial control equipment network traffic is directly eliminated; the lost messages in the industrial control equipment network traffic, that is, the interactive messages with incomplete sessions, are processed by completing the session.

[0060] The device interaction mode set that meets the hierarchical identification requirements is extracted in step 3). Specifically, the device interaction mode f is a set of characteristic attributes used to describe the interaction information between devices, expressed as:

[0061] f=<clientIp,serverIp,clientPort,serverPort>

[0062] Among them, clientIp represents the client IP address of the session between devices, serverIp represents the server IP address of the session between devices, clientPort represents the client port number of the session between devices, and serverPort represents the server port number of the session between devices.

[0063] The device interaction mode set FS consists of the device interaction mode f, which can be expressed as:

[0064] FS = {f 1 , f 2 , …, f n}, where n is the number of elements in the device interaction mode set.

[0065] In step 4), the device interaction mode set FS is filtered by ports to obtain the address pair set IPSF. The address pair set IPSF is a set consisting of IP address pairs ips, which is expressed as

[0066] IPSF = {ips 1 ,ips 2 ,…,ips n}, where n is the number of IP address pair elements.

[0067] Specifically, if the server port number in f is a port number specific to the industrial control protocol, it is a session that uses the industrial control protocol for communication, and the IP address pair ips is stored in the set IPSF_ICS, otherwise it is stored in the set IPSF_NOICS, where ips is represented by And IPSF_ICS∨IPSF_NOICS=IPSF_ICS.

[0068] The step 5) uses the IPSF_ICS set to identify devices below layer 3, including the following steps:

[0069] 1) Extract all IP address sets IcsIpSet, client IP address set clientIpSet and server IP address set serverIpSet from IPSF_ICS set respectively;

[0070] 2) For any device in IcsIpSet, if the device's IP address deviceIp only exists in clientIpSet but not in serverIpSet, the device is considered a layer 2 device. Then deviceIp∈2ndDeviceIpSet, where 2ndDeviceIpSet represents a layer 2 device IP set.

[0071] 3) For any device in IcsIpSet, if the device's IP address deviceIp exists in both clientIpSet and serverIpSet, the device is considered a layer 1 device. Then deviceIp∈1stDeviceIpSet, where 1stDeviceIpSet represents a layer of device IP set.

[0072] 4) For any device in IcsIpSet, if the device's IP address deviceIp only exists in serverIpSet and its corresponding client device is a layer 2 device, then the device is determined to be a layer 1 device. and Then deviceIp∈1stDeviceIpSet, where 1stDeviceIpSet represents a layer of device IP set.

[0073] 5) The remaining devices are determined to be layer 0 devices.

[0074] In step 5), the IPSF_NOICS set is used to identify layer 3 and above devices. Specifically, all IP address sets in IPSF_NOICS are first extracted, and the IP addresses that are not in the IcsIpSet set are filtered out and stored in NonIcsIpSet; for any device in NonIcsIpSet, if the device has communication with a layer 2 device, the device is determined to be a layer 3 and above device. Then deviceIp∈3rdDeviceIpSet, where 3rdDeviceIpSet represents the IP set of devices at layer 3 and above.

[0075] Example:

[0076] Step 1: Collect the flow data in the network of the industrial control device to be identified through the mirror port. In this embodiment, the flow data obtained only needs one complete cycle of the industrial control system to be run.

[0077] Step 2: Preprocess the collected traffic data. The specific steps are as follows:

[0078] 1) Eliminate the interactive traffic of devices that are not in the target network segment, for example, the interactive traffic generated by broadcast, 255.255.255.0;

[0079] 2) Complete the missing packets in the interactive session. For example, if there is only the synack packet from ip2 to ip1 in the network traffic, the syn packet from ip1 to ip2 needs to be added to the session to obtain a complete interactive relationship. Figure 2 In the session, the syn packet from 192.168.1.99 to 192.168.1.101 is lost, and only the synack packet from 192.168.1.101 to 192.168.1.99 is available, so the request packet is added to the session.

[0080] Step 3: Use the preprocessed network traffic to extract device interaction patterns. Figure 2 After data preprocessing of the session, the extracted device interaction mode f = <192.168.1.99, 192.168.1.101, 2133, 502>. Taking the public dataset run_6rtu as an example, Figure 3 is the topology of the run_6rtu dataset. The device interaction pattern set FS is finally extracted = {<192.168.1.99, 192.168.1.101, 2133, 502>, <192.168.1.99, 192.168.1.103, 2134, 502>, <192.168.1.99, 192.168.1.104, 2135, 502>, < 192.168.1.10, 192.168.1.99, 53103, 135>, <192.168.1.10, 192.168.1.100, 36502, 135>, ..., <192.168.1.100, 192.168.1.104, 2209, 502>}, where there are 99 entries in the set FS.

[0081] Step 4: Use industrial control port screening to divert network traffic. Since different industrial control systems use different industrial control protocols, the corresponding industrial control ports are also different. Figure 2 The industrial control protocol used in the session is the Modbus protocol, and the corresponding industrial control port number is 502. Figure 4 is the commonly used industrial control port number. We store the IP address pairs that use these ports for communication into the set IPSF_ICS, and the others into the set IPSF_NONICS. Taking the public dataset run_6rtu as an example, the extracted address pair set IPSF_ICS = {<192.168.1.99, 192.168.1.101>, <192.168.1.99, 192.168.1.102>, <192.168.1.99, 192.168.1.103>, <192.168.1.99, 192.168.1. 104>, <192.168.1.99, 192.168.1.105>, <192.168.1.99, 192.168.1.106>, <192.168.1.100, 192.168.1.101>, ..., <192.168.1.100, 192.168.1.106>}, of which there are 12 entries in the IPSF_ICS set.

[0082] IPSF_NOICS={<192.168.1.10, 192.168.1.99>, <192.168.1.10, 192.168.1.100>}.

[0083] Step 5: Use the IP address pair set IPSF_ICS in step 4 to identify the layer 2 device, and then use the layer 2 device to distinguish between the layer 1 device and the layer 0 device. The specific process is as follows: Figure 5 shown.

[0084] (1) Count all IP address sets in IPSF_ICS IcsIpSet = {192.168.1.99, 192.168.1.100, 192.168.1.101, 192.168.1.102, 192.168.1.103, 192.168.1.104, 192.168.1.105, 192.168.1.106}; Count client IP addresses The set clientIpSet = {192.168.1.99, 192.168.1.100}; the set of statistics server IP addresses is serverIpSet = {192.168.1.101, 192.168.1.102, 192.168.1.103, 192.168.1.104, 192.168.1.105, 192.168.1.106}.

[0085] (2) Determine the layers of all IPs in IcsIpSet. 192.168.1.99 and 192.168.1.100 only exist in clientIpSet, so they are layer 2 devices; 192.168.1.101, 192.168.1.102, 192.168.1.103, 192.168.1.104, 192.168.1.105, and 192.168.1.106 only exist in serverIpSet, and according to IPSF_ICS, they are communicating with layer 2 devices, so they are layer 1 devices; there are no layer 0 devices in this data set.

[0086] Step 6: Use the IP address pair set IPSF_NOICS in step 5 to identify devices at layer 3 and above. The specific process is as follows: Figure 6 shown.

[0087] (1) Count the IP address pairs of IPSF_NOICS that have not been judged by the hierarchy, NonIcsIpSet={192.168.1.10};

[0088] (2) Determine all IP levels in NonIcsIpSet. Based on the address pair set IPSF_NOICS in step 4 and the layer 2 device identification result in step 6, we determine that 192.168.1.10 has communication with the layer 2 device, and its destination address is the layer 2 device, so it is a layer 3 or higher device.

Claims

1. A hierarchical identification method based on the interaction mode of industrial control equipment, characterized in that: The following steps are involved: 1) Collect the traffic data in the network of the industrial control system to be identified and pre-process it; 2) Extracting the device interaction feature attributes that meet the hierarchical identification requirements from the preprocessed traffic data to form a device interaction pattern set; 3) Dividing the device interaction mode set to obtain a set of device IP address pairs that use the industrial control protocol for communication and a set of device IP address pairs that do not use the industrial control protocol for communication; 4) Perform layer 3 or lower device identification and layer 3 or higher device identification on a set of device IP addresses pairs that use an industrial control protocol for communication and a set of device IP addresses pairs that do not use an industrial control protocol for communication, respectively.

2. A hierarchical identification method based on the interaction mode of industrial control equipment according to claim 1, characterized in that: The pretreatment in step 1) is specifically as follows: Directly remove the broadcast traffic in the network traffic of industrial control equipment, and use manual session completion to supplement the lost messages in the network traffic of industrial control equipment, that is, the incomplete interactive messages in the session.

3. The hierarchical identification method based on the interaction mode of industrial control equipment according to claim 1 is characterized in that: The device interaction mode f is a set of characteristic attributes used to describe the interaction information between devices, expressed as: f=<clientIp,serverIp,clientPort,serverPort> Wherein, clientIp represents the client IP address of the session between devices, serverIp represents the server IP address of the session between devices, clientPort represents the client port number of the session between devices, and serverPort represents the server port number of the session between devices; The device interaction mode set FS is composed of multiple device interaction modes f, which can be expressed as: FS={f1,f2,…,f n } Where n is the number of elements in the device interaction mode set; The device that meets the hierarchical identification requirements means that the characteristic attribute information of the device does not lack any information in the device interaction mode f.

4. The hierarchical identification method based on the interaction mode of industrial control equipment according to claim 1 is characterized in that: The step 3) comprises the following steps: 3.1) The device interaction mode set FS is filtered by ports to obtain an address pair set IPSF, wherein the address pair set IPSF is a set consisting of IP address pairs ips, and is represented as IPSF = {ips1, ps2, ..., ps m } Where m is the number of IP address pair elements; 3.2) Determine whether the server port number in f is a port number specific to the industrial control protocol. If so, f is a session that uses the industrial control protocol for communication, and the IP address pair ips is stored in the set IPSF_ICS; otherwise, f is a session that does not use the industrial control protocol for communication, and the IP address pair ips is stored in the set IPSF_NOICS, where ips is expressed as <clientIp,serverIp>.

5. The hierarchical identification method based on the interaction mode of industrial control equipment according to claim 1 is characterized in that: The step of identifying devices below layer 3 on a set of IP addresses of devices communicating using an industrial control protocol comprises the following steps: 1) Extract all IP address sets IcsIpSet, client IP address set clientIpSet and server IP address set serverIpSet from IPSF_ICS set respectively; 2) For any device in IcsIpSet, if the device's IP address deviceIp only exists in clientIpSet but not in serverIpSet, the device is determined to be a layer 2 device; 3) For any device in IcsIpSet, if the device's IP address deviceIp exists in both clientIpSet and serverIpSet, the device is determined to be a layer 1 device; 4) For any device in IcsIpSet, if the device's IP address deviceIp only exists in serverIpSet and its corresponding client device is a layer 2 device, then the device is determined to be a layer 1 device; 5) The remaining devices are determined to be layer 0 devices.

6. The hierarchical identification method based on the interaction mode of industrial control equipment according to claim 1 is characterized in that: The step of identifying devices below layer 3 for a set of IP addresses of devices that do not use an industrial control protocol for communication comprises the following steps: 1) Extract all IP address sets in IPSF_NOICS, filter out the IPs that are not in the IcsIpSet set and store them in NonIcsIpSet; 2) For any device in NonIcsIpSet, if the device communicates with a layer 2 device, the device is determined to be a layer 3 or higher device.

7. A hierarchical identification system based on the interaction mode of industrial control equipment, characterized in that: include: The data acquisition module is used to collect the flow data in the network of the industrial control system to be identified and pre-process it; The device interaction pattern set building module is used to extract the device interaction feature attributes that meet the hierarchical identification requirements from the pre-processed traffic data to form a device interaction pattern set; A traffic distribution module is used to distribute the device interaction mode set to obtain a set of device IP address pairs that use the industrial control protocol for communication and a set of device IP address pairs that do not use the industrial control protocol for communication; The identification module is used to identify devices below layer 3 and devices above layer 3 for a set of device IP addresses that communicate using an industrial control protocol and a set of device IP addresses that do not communicate using an industrial control protocol.

8. A hierarchical identification system based on the interaction mode of industrial control equipment, characterized in that: It comprises a memory and a processor; the memory is used to store a computer program; the processor is used to implement a hierarchical identification method based on an industrial control equipment interaction mode as described in any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the hierarchical identification method based on the interaction mode of industrial control equipment as described in any one of claims 1 to 6 is implemented.

Images