A method for full-flow detection of industrial control network security

Abstract

The present invention relates to the field of network security, and in particular to a full-flow detection method for industrial control network, comprising: obtaining industrial control network information, and determining the flow state according to the number of ports and a difficulty reference value; determining an abnormal impact value confirmation method according to a flow fluctuation value and a flow reference value; determining a flow distribution method according to the flow state to determine a combined distribution method according to pixel differences and distribution differences, or determining a priority setting method according to the abnormal impact value, and distributing flow data according to a transmission impact coefficient; determining an abnormality judgment method according to a protocol type; the present invention can ensure the transmission efficiency of flow data, thereby reducing the hidden dangers of industrial control network.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method for detecting full-flow of industrial control network security. Background Art

[0002] Due to the continuous increase of networked control devices in industrial control systems, the number of ports that need to be detected for anomaly is increasing. When the number of ports increases, it is impossible to select a suitable transmission method to transmit the port's traffic data to the processing node for anomaly analysis, resulting in the inability to timely discover abnormal information, which poses a serious safety hazard to the normal operation of equipment in the industrial control system. Therefore, how to choose a reasonable method to transmit the traffic data to the processing node in a timely manner to ensure the efficiency of traffic data transmission is an urgent problem to be solved by technical personnel in this field.

[0003] Chinese patent publication number CN112672356A discloses a method for implementing network security of industrial control systems in thermal power plants based on 5G technology, including: S1: receiving original network traffic data from the production control area, management information area and non-control area, and transmitting the network traffic data to the 5G base station; S2: collecting the original network traffic data uploaded by the 5G transmission module and transmitting it to the 5G network security server; S3: processing and analyzing the original network traffic data sent by the 5G base station. It can be seen that the above technical solution has the following problems: the data transmission method is single, and it is impossible to adaptively optimize the data transmission method according to the actual situation, and it is impossible to ensure the transmission efficiency of the traffic data, and thus it is impossible to respond to abnormal traffic in time, resulting in greater security risks in the industrial control network. Summary of the invention

[0004] To this end, the present invention provides a full-flow detection method for industrial control network security, which is used to overcome the problem that the data transmission mode in the prior art is single, the data transmission mode cannot be adaptively optimized according to actual conditions, the transmission efficiency of the flow data cannot be guaranteed, and the abnormal flow cannot be responded to in time, resulting in greater hidden dangers in the industrial control network.

[0005] To achieve the above object, the present invention provides an industrial control network security full flow detection method, comprising:

[0006] Obtain industrial control network information and determine traffic status based on the number of ports and difficulty reference values;

[0007] Determine the abnormal impact value confirmation method according to the flow fluctuation value and the flow reference value. The abnormal impact value confirmation method is determined according to the flow threshold or according to the port impact value and the device reference value;

[0008] Determining the flow distribution method according to the flow state is to determine the combined distribution method according to the pixel difference and the distribution difference, or to determine the priority setting method according to the abnormal impact value, and distribute the flow data according to the transmission impact coefficient;

[0009] The combination allocation methods include similar combination allocation and regular combination allocation;

[0010] The priority setting method is to determine the first priority coefficient according to the abnormal impact value or to determine the second priority coefficient according to the similar reference value;

[0011] The abnormality determination method is determined according to the protocol type. The abnormality determination method is to determine the known protocol state according to the feature matching degree or to determine the unknown protocol state according to the model matching degree.

[0012] Further, the flow state is determined according to the number of ports and the difficulty reference value, and the flow state includes:

[0013] A first flow state in which the number of ports is greater than or equal to a preset number of ports or the difficulty reference value is greater than or equal to a preset difficulty reference value;

[0014] A second flow state in which the number of ports is less than a preset number of ports and the difficulty reference value is less than a preset difficulty reference value.

[0015] Further, a confirmation method of the abnormal impact value is determined according to the flow fluctuation value and the flow reference value;

[0016] If the flow fluctuation value is greater than or equal to the preset flow fluctuation value or the flow reference value is greater than or equal to the preset flow reference value, the abnormal impact value confirmation method is determined according to the flow threshold;

[0017] If the flow fluctuation value is less than the preset flow fluctuation value and the flow reference value is less than the preset flow reference value, the abnormal impact value confirmation method is to determine it according to the port impact value and the device reference value.

[0018] Further, determining a flow distribution method according to the flow state;

[0019] In the first flow state, the flow distribution method is to determine the combined distribution method according to the pixel difference and the distribution difference;

[0020] In the second flow state, the flow allocation method is to determine the priority setting method according to the abnormal impact value, and allocate the flow data according to the transmission impact coefficient.

[0021] Further, a combination allocation method is determined according to the pixel difference and the distribution difference;

[0022] If the pixel difference is less than the preset pixel difference and the distribution difference is less than the preset distribution difference, the combination allocation method is similar combination allocation;

[0023] If the pixel difference is greater than or equal to the preset pixel difference or the distribution difference is greater than or equal to the preset distribution difference, the combination allocation method is regular combination allocation.

[0024] Furthermore, the similar combination allocation includes:

[0025] A1, perform similarity detection on a single flow data that is not recorded as a similar combination, record the flow data as target flow data, and record other flow data that are not recorded as a similar combination except the target flow data as reference flow data;

[0026] A2, record the set of all reference flow data and target flow data whose threshold difference from the target flow data is less than the preset threshold difference as a similar combination;

[0027] A3, repeat steps A1 and A2 until all flow data are recorded in similar combinations;

[0028] A4, allocates to each similar combination according to the node processing reference value.

[0029] Furthermore, the regular combination allocation includes:

[0030] S1, sort the traffic data in descending order according to the mean value of the regular field and record it as the reference sequence;

[0031] S2, select the reference flow data that are not recorded as regular combinations and have the same number at both ends of the reference sequence and whose total number is the number of regular combination scales, and record them as a regular combination;

[0032] S3, repeat step S2 until all flow data are recorded in the regular combination;

[0033] S4, allocating to each rule combination according to the node processing reference value;

[0034] Among them, the number of regular combination scales is positively correlated with the minimum node processing reference value.

[0035] Further, a priority setting method is determined according to the abnormal impact value;

[0036] If the abnormal impact value is greater than or equal to the preset abnormal impact value, the priority setting method is to determine the first priority coefficient according to the abnormal impact value;

[0037] If the abnormal impact value is less than the preset abnormal impact value, a second priority coefficient is determined according to a similar reference value;

[0038] The first priority coefficient is positively correlated with the abnormal impact value, and the second priority coefficient is positively correlated with the similarity reference value.

[0039] Furthermore, the flow data is allocated according to the transmission impact coefficient, including:

[0040] The priority order of each flow data transmission is determined according to the first priority coefficient or the second priority coefficient. When allocating a single flow data, the flow data is recorded as the flow data to be allocated, and the flow data to be allocated is transmitted to the node with the largest transmission influence coefficient.

[0041] Furthermore, the traffic data includes unknown industrial control protocols and known industrial control protocols. Different protocol types have different corresponding abnormality determination methods.

[0042] For known industrial control protocols, the abnormality determination method is to determine the known protocol status based on the feature matching degree;

[0043] For unknown industrial control protocols, the abnormality determination method is to determine the unknown protocol status based on the model matching degree;

[0044] The known protocol state includes an abnormal known protocol state whose characteristic matching degree is less than a preset characteristic matching degree, and a normal known protocol state whose characteristic matching degree is greater than or equal to the preset characteristic matching degree;

[0045] The unknown protocol state includes an abnormal unknown protocol state whose model matching degree is less than a preset model matching degree, and a normal unknown protocol state whose model matching degree is greater than or equal to the preset model matching degree.

[0046] Compared with the prior art, the beneficial effect of the present invention lies in that, in the technical scheme of the present invention, the flow state is determined according to the number of ports and the difficulty reference value, and the number of ports and the difficulty reference value effectively reflect the quantity of flow data and the difficulty of processing the flow data, and then different flow distribution methods are adaptively selected according to the flow state, so that the selection of flow distribution method is more in line with the actual application scenario, avoiding the defects of the prior art that the data transmission method is single and the data transmission method cannot be adaptively optimized according to the actual situation, and also avoiding the problem that the flow data cannot be transmitted to the processing node in time when the difficulty of processing is high, thereby ensuring the transmission efficiency of the flow data, and then being able to respond to abnormal flow in time and reduce the safety risks of the industrial control network.

[0047] Furthermore, in the present invention, a method for confirming an abnormal impact value is determined based on a flow fluctuation value and a flow reference value, and the flow fluctuation value and the flow reference value are used to effectively reflect the flow change of the port, and then different methods for confirming abnormal impact values ​​are adaptively selected, so that the method for confirming abnormal impact values ​​is more in line with actual application scenarios, avoiding the problem of not being able to transmit dangerous flow data to the processing node in a timely manner when the flow change is not obvious, thereby effectively reducing the security risks in the industrial control network.

[0048] Furthermore, the present invention effectively reflects the similarity of flow data through pixel difference and distribution difference, and then adaptively selects different combination allocation methods according to the pixel difference and distribution difference, so that the selection of combination allocation method is more in line with the actual application scenario, avoiding the defect of the prior art that the transmission method cannot be optimized when the number of ports and the difficulty reference value are large, and also avoiding the problem of insufficient processing capacity of the processing node resulting in long waiting time during flow data transmission, thereby improving the transmission rate of flow data, and being able to respond to the safety hazards of industrial control systems in a timely manner.

[0049] Furthermore, in the present invention, when the pixel difference is less than the preset pixel difference and the distribution difference is less than the preset distribution difference, the combination allocation method is similar combination allocation, which effectively reflects the degree of difference of each flow data through the threshold difference, and then determines the similar combination according to the threshold difference, and combines and allocates highly correlated flow data, thereby ensuring data analysis efficiency and avoiding the problem of long waiting time during flow data transmission due to insufficient processing capacity of the processing node, thereby improving the efficiency of flow data transmission.

[0050] Furthermore, in the present invention, when the pixel difference is greater than or equal to the preset pixel difference or the distribution difference is greater than or equal to the preset distribution difference, the combination allocation method is regular combination allocation, which effectively reflects the processing difficulty of the traffic data through the regular field mean, and then determines the regular combination according to the regular field mean, thereby ensuring the balance of the processing difficulty of each regular combination, avoiding the inability to identify abnormal traffic in time due to excessive processing difficulty, and thus effectively reducing the security risks in the industrial control network and reducing potential safety hazards.

[0051] Furthermore, the present invention effectively reflects the impact of abnormal flow data in the industrial control system on the control equipment through the abnormal impact value, and then adaptively selects different priority setting methods according to the abnormal impact value, so that the selection of the priority setting method is more in line with the actual application scenario, avoiding the defect of not being able to transmit flow data with a high degree of abnormality to the processing node in time, thereby reducing the safety risks of the industrial control network.

[0052] Furthermore, the present invention determines the abnormality determination method by the protocol type, so that the selection of the abnormality determination method is more in line with the actual application scenario, and can accurately and reasonably allocate network resources according to the protocol status, thereby improving the monitoring capability of the industrial control network, and can timely discover abnormal protocols, thereby ensuring the stable operation and security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A schematic diagram of a full-flow detection method for industrial control network security according to the present invention;

[0054] Figure 2A flow chart of determining a flow state according to the number of ports and a difficulty reference value of the present invention;

[0055] Figure 3 A flow chart of determining a flow distribution method according to a flow state in the present invention;

[0056] Figure 4 The present invention is a flow chart of determining a combination allocation method according to pixel difference and distribution difference. DETAILED DESCRIPTION

[0057] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0058] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0059] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0060] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0061] See also Figures 1 to 4 As shown, the present invention provides an industrial control network security full-flow detection method, comprising:

[0062] Obtain industrial control network information and determine traffic status based on the number of ports and difficulty reference values;

[0063] Determine the abnormal impact value confirmation method according to the flow fluctuation value and the flow reference value. The abnormal impact value confirmation method is determined according to the flow threshold or according to the port impact value and the device reference value;

[0064] Determining the flow distribution method according to the flow state is to determine the combined distribution method according to the pixel difference and the distribution difference, or to determine the priority setting method according to the abnormal impact value, and distribute the flow data according to the transmission impact coefficient;

[0065] The combination allocation methods include similar combination allocation and regular combination allocation;

[0066] The priority setting method is to determine the first priority coefficient according to the abnormal impact value or to determine the second priority coefficient according to the similar reference value;

[0067] The abnormality determination method is determined according to the protocol type. The abnormality determination method is to determine the known protocol state according to the feature matching degree or to determine the unknown protocol state according to the model matching degree.

[0068] In the present invention, the industrial control network information includes but is not limited to the number of ports, data information and the type of industrial control protocol. The port is a physical interface or logical channel in the industrial control network used to connect to an external network or device for data transmission and communication. The data information includes a number of flow data. A single flow data is a number of industrial control protocols corresponding to a single port when transmitting control instructions and monitoring data using network traffic as a carrier within a monitoring cycle. A single industrial control protocol contains several different types of bytes. Bytes of the same decimal size are recorded as bytes of the same type. The decimal size range of each type of byte is [0,255]. The type of industrial control protocol includes unknown industrial control protocols and known industrial control protocols. The identification of unknown industrial control protocols and known industrial control protocols can be determined through machine vision and deep learning networks. Control instructions include but are not limited to start / stop instructions, adjustment instructions and configuration instructions. Monitoring data includes data corresponding to several parameters, and the parameters include but are not limited to temperature, pressure, flow, speed and voltage. This is content that is easy for technical personnel in this field to understand and will not be elaborated in detail.

[0069] In the present invention, several processing nodes with processing capabilities are provided, and the processing nodes are used to identify abnormal industrial control protocols and trigger an alarm mechanism when an abnormality is detected. The specific setting position and setting number of the processing nodes are not specifically limited, and adaptive settings are performed according to actual application scenarios. This is content that is easy for technical personnel in this field to understand and will not be elaborated here.

[0070] The present invention is provided with a continuously cyclic monitoring cycle, and the data status is determined once at the end of each monitoring cycle. The duration of the monitoring cycle can be set according to the needs of the user. The greater the user's demand for reducing the hidden dangers of industrial control network security, the shorter the duration of the monitoring cycle. A value of the monitoring cycle is provided, and the monitoring cycle is 10s.

[0071] In the present invention, several historical records are correspondingly set up, and any historical record records the number of ports, difficulty reference value, traffic fluctuation value, traffic reference value and pixel difference in the historical process of at least one industrial control network traffic detection, and each historical record corresponds to a qualified mark, which records whether the transmission efficiency of the traffic data meets user requirements, and the qualified mark can be recorded manually.

[0072] Specifically, the traffic status is determined according to the number of ports and the difficulty reference value. The traffic status includes:

[0073] A first flow state in which the number of ports is greater than or equal to a preset number of ports or the difficulty reference value is greater than or equal to a preset difficulty reference value;

[0074] A second flow state in which the number of ports is less than a preset number of ports and the difficulty reference value is less than a preset difficulty reference value.

[0075] Among them, the number of ports is the total number of ports in the industrial control network, the difficulty reference value is the average value of the unit difficulty value corresponding to each flow data, the unit difficulty value = [the number of unknown industrial control protocols / (the number of known industrial control protocols + the number of unknown industrial control protocols)] + the difference field mean, the difference field mean is the average value of the difference field reference value corresponding to each unknown protocol in a single flow data, and the difference field reference value is the number of byte types in a single unknown protocol;

[0076] The values ​​of the preset number of ports and the preset difficulty reference value can be determined by the user according to the actual application scenario. The higher the user's demand for traffic data transmission efficiency, the smaller the values ​​of the preset number of ports and the preset difficulty reference value are. A value of the preset number of ports and the preset difficulty reference value is provided, and the historical records of determining the combination allocation method based on pixel difference and distribution difference are detected. The average value of the number of ports corresponding to the historical records that can meet the user's needs is recorded as the preset number of ports, and the average value of the difficulty reference values ​​corresponding to the historical records that can meet the user's needs is recorded as the preset difficulty reference value.

[0077] Specifically, the abnormal impact value confirmation method is determined based on the flow fluctuation value and the flow reference value;

[0078] If the flow fluctuation value is greater than or equal to the preset flow fluctuation value or the flow reference value is greater than or equal to the preset flow reference value, the abnormal impact value confirmation method is determined according to the flow threshold;

[0079] If the flow fluctuation value is less than the preset flow fluctuation value and the flow reference value is less than the preset flow reference value, the abnormal impact value confirmation method is to determine it according to the port impact value and the device reference value.

[0080] Among them, for the amount of data transmitted by each port monitored in the current monitoring period, an interval point is set every 0.5s in chronological order, and the starting point and all interval points are recorded as time points. The flow fluctuation value corresponding to a single flow data The calculation formula is: , n is the number of time points, is the amount of data corresponding to the i-th time point in the current monitoring period, The traffic reference value is the maximum value of the data volume monitored in the current monitoring period.

[0081] The values ​​of the preset flow fluctuation value and the preset flow reference value can be determined by the user according to the actual application scenario. The higher the user's demand for the accuracy of the abnormal impact value confirmation, the smaller the values ​​of the preset flow fluctuation value and the preset flow reference value are. A value of a preset flow fluctuation value and a preset flow reference value is provided, and the historical records of determining the abnormal impact value according to the flow threshold are detected, and the average value of the flow fluctuation values ​​corresponding to the historical records that can meet the user's needs is recorded as the preset flow fluctuation value, and the average value of the flow reference values ​​corresponding to the historical records that can meet the user's needs is recorded as the preset flow reference value;

[0082] Recording the flow fluctuation value greater than or equal to the preset flow fluctuation value or the flow reference value greater than or equal to the preset flow reference value as the first influencing condition, and recording the flow fluctuation value less than the preset flow fluctuation value and the flow reference value less than the preset flow reference value as the second influencing condition;

[0083] Under the first impact condition, the abnormal impact value is positively correlated with the flow threshold, and the flow threshold = flow fluctuation value + flow reference value;

[0084] Under the second impact condition, abnormal impact value = port impact value × port coefficient + device impact value × device coefficient. For the port corresponding to a single flow data, the port impact value is confirmed by recording the port as the target port, and recording the number of ports within the impact range corresponding to the target port as the port impact value. The impact range is the area within a circle with the target port as the center and the preset distance as the radius. The value of the preset distance can be determined by the user according to the actual application scenario. The smaller the value of the preset distance, the greater the user's demand for the accuracy of the abnormal impact value. A value of the preset distance is provided, and the preset distance is 10m.

[0085] For a single flow data, the device reference value is the number of devices connected to the port corresponding to the flow data, and the devices include but are not limited to industrial computers, programmable logic controllers, and sensors. This is easy to understand for those skilled in the art and will not be described in detail.

[0086] The values ​​of the port coefficient and the device coefficient can be obtained by the user through deep learning convolutional neural network learning based on historical records. It can be understood that the present invention reflects the degree of harm to the control device when the traffic data is abnormal through the abnormal impact value. The user can use deep learning through historical records to obtain the impact of the port impact value and the device impact value on the degree of harm, and then select the corresponding values ​​of the port coefficient and the device coefficient, wherein the port coefficient + the device coefficient = 1, and one value of the port coefficient and the device coefficient is provided, the port coefficient is 0.4, and the device coefficient is 0.6.

[0087] Specifically, the flow distribution method is determined according to the flow status;

[0088] In the first flow state, the flow distribution method is to determine the combined distribution method according to the pixel difference and the distribution difference;

[0089] In the second flow state, the flow allocation method is to determine the priority setting method according to the abnormal impact value, and allocate the flow data according to the transmission impact coefficient.

[0090] Specifically, the combination allocation method is determined according to the pixel difference and distribution difference;

[0091] If the pixel difference is less than the preset pixel difference and the distribution difference is less than the preset distribution difference, the combination allocation method is similar combination allocation;

[0092] If the pixel difference is greater than or equal to the preset pixel difference or the distribution difference is greater than or equal to the preset distribution difference, the combination allocation method is regular combination allocation.

[0093] Among them, since the decimal size range of each type of byte in the industrial control protocol and the grayscale value range of each pixel in the grayscale image are both [0, 255], each byte in the industrial control protocol is mapped to a grayscale pixel to generate a grayscale image. This is easy to understand for those skilled in the art and will not be described in detail;

[0094] Pixel difference = maximum value among mutation means corresponding to each flow data - minimum value among mutation means corresponding to each flow data. Mutation mean is the average value of mutation pixel ratios of each industrial control protocol corresponding to a single flow data. For a single industrial control protocol, the industrial control protocol is recorded as the target industrial control protocol, and the grayscale image corresponding to the target industrial control protocol is recorded as the target image. Mutation pixel ratio = number of mutation pixels in the target image / total number of pixels in the target image. For a single pixel, if the minimum pixel value difference between the pixel and its neighboring pixels is greater than the preset difference, the pixel is a mutation pixel. The value of the preset difference can be set by the user according to the actual situation. The greater the user's demand for the accuracy of confirming pixel difference, the smaller the preset difference value. A preset difference value is provided. The preset difference is the minimum value of the minimum pixel value difference between each mutation pixel and its neighboring pixel in the historical records.

[0095] Distribution difference = maximum value among distribution means corresponding to each flow data - minimum value among distribution means corresponding to each flow data, distribution mean is the average value of distribution reference values ​​of each industrial control protocol corresponding to a single flow data; the method for confirming the distribution reference value is to perform distance detection on each mutation pixel point, when performing distance detection on a single mutation pixel point, record the mutation pixel point as the target mutation pixel point, record other mutation pixel points in the target image as reference mutation pixel points, detect the influence distances corresponding to the target sensitive area and each reference sensitive area, record the minimum value among the influence distances as the minimum influence distance, and record the average value of the minimum influence distances corresponding to each mutation pixel point as the distribution reference value; the influence distance is the shortest distance between any two mutation pixels;

[0096] The values ​​of the preset pixel difference and the preset distribution difference can be determined by the user according to the actual application scenario. It can be understood that the smaller the values ​​of the preset pixel difference and the preset distribution difference, the greater the user's demand for regular combination allocation. A value of the preset pixel difference and the preset distribution difference is provided, and the historical records of similar combination allocation are detected. The average value of the pixel difference corresponding to the historical records that can meet the user's needs is recorded as the preset pixel difference, and the average value of the distribution difference corresponding to the historical records that can meet the user's needs is recorded as the preset distribution difference.

[0097] Specifically, the similar combination allocation includes:

[0098] A1, perform similarity detection on a single flow data that is not recorded as a similar combination, record the flow data as target flow data, and record other flow data that are not recorded as a similar combination except the target flow data as reference flow data;

[0099] A2, record the set of all reference flow data and target flow data whose threshold difference from the target flow data is less than the preset threshold difference as a similar combination;

[0100] A3, repeat steps A1 and A2 until all flow data are recorded in similar combinations;

[0101] A4, allocates to each similar combination according to the node processing reference value.

[0102] Among them, the threshold difference is the absolute value of the difference between the similarity reference values ​​corresponding to any two flow data. For a single flow data, the similarity reference value = mutation mean + distribution mean. The value of the preset threshold difference can be determined by the user according to the actual application scenario. It can be understood that the smaller the value of the preset threshold difference, the greater the user's demand for the similarity of flow data in similar combinations. A value of the preset threshold difference is provided, and the historical records of similar combination allocation are detected. The average value of the threshold difference corresponding to the historical records that can meet the user's needs is recorded as the preset threshold difference.

[0103] In step A4, allocation is made for each similar combination according to the node processing reference value, including: allocation is made for each similar combination in the order of the similar combination scale from large to small, and when allocating for a single similar combination, the similar combination is allocated to the processing node with the smallest node processing reference value that has not been allocated similar combination, and the allocation for the unallocated similar combination continues until each processing node is allocated with a similar combination, and the unallocated single similar combination is allocated to the processing node with the smallest node processing reference value and the least number of allocated similar combinations, until each similar combination is allocated to the corresponding processing node; the similar combination scale is the number of traffic data in a single similar combination. For a single processing node, the node processing reference value is the difference between the maximum amount of data that the processing node can process and the amount of data that the processing node is processing in a single monitoring cycle, and the unit of the data amount is GB.

[0104] Specifically, the regular combination allocation includes:

[0105] S1, sort the traffic data in descending order according to the mean value of the regular field and record it as the reference sequence;

[0106] S2, select the reference flow data that are not recorded as regular combinations and have the same number at both ends of the reference sequence and whose total number is the number of regular combination scales, and record them as a regular combination;

[0107] S3, repeat step S2 until all flow data are recorded in the regular combination;

[0108] S4, allocating to each rule combination according to the node processing reference value;

[0109] Among them, the number of regular combination scales is positively correlated with the minimum node processing reference value.

[0110] Among them, the regular field mean is the average value of the regular field proportion of each industrial control protocol corresponding to a single flow data. The method for confirming the regular field proportion is that for a single industrial control protocol, the industrial control protocol is recorded as the target industrial control protocol, and the regular field proportion = the number of associated bytes / the number of all bytes in the target industrial control protocol. The number of associated bytes is the total number of bytes in each associated paragraph. It should be noted that the number of regular combination scales is an even number. If the number of flow data not recorded as a regular combination in the reference sequence is less than the number of regular combination scales, all flow data not recorded as a regular combination in the reference sequence are recorded as one regular combination.

[0111] In step S2, if the flow data in the reference sequence are b1, b2, b3, b4, b5, b6, b7, b8, b9 and b10 respectively, and if the number of regular combination scales is 4, two flow data are taken from both ends of the reference sequence respectively, b1, b2, b9 and b10 are recorded as a regular combination, b3, b4, b7 and b8 are recorded as a regular combination, and b5 and b6 are recorded as a regular combination;

[0112] For the bytes in the target industrial control protocol that are not recorded as associated paragraphs in the reading order, regularity detection is performed. When regularity detection is performed on a single byte, the byte is recorded as the target byte, and other bytes that are not recorded as associated paragraphs, excluding the target byte, are recorded as reference bytes. The reference byte that is the same as the target byte and the target byte are recorded as the same byte. Two adjacent identical bytes and the bytes between two adjacent identical bytes are recorded as a feature paragraph. The feature paragraph where the target byte is located is recorded as the target paragraph, and other feature paragraphs are recorded as reference paragraphs. Association detection is performed on the reference paragraphs after the reading order of the target paragraph in turn until there is no association relationship between the reference paragraph and the target paragraph, then the association detection is stopped, and the reference paragraph that is associated with the target paragraph is recorded. The paragraphs before the reference paragraphs without any association relationship are recorded as associated paragraphs, and regularity detection is continued for the bytes that are not recorded as associated paragraphs; the association relationship includes but is not limited to the same relationship, geometric relationship and arithmetic relationship. The user can determine the association relationship between the feature paragraphs according to the deep learning network. If the bytes in an industrial control protocol are M, P, D, M, C, V, M, ..., then one feature paragraph is a set consisting of M, P, D and M, and the other feature paragraph is a set consisting of M, C, V and M. If P=C and D=V, the two feature paragraphs have the same relationship. If P=5C and D=5V, the two feature paragraphs have a geometric relationship. This is easy for technicians in this field to understand and will not be described in detail.

[0113] The number of regular combination scales is the total number of flow data in a single regular combination, and the minimum node processing reference value is the minimum value of the node processing reference values ​​corresponding to each processing node.

[0114] In step S4, allocation is performed for each rule combination according to the node processing reference value, including: allocation is performed for each rule combination, when allocation is performed for a single rule combination, the rule combination is allocated to the processing node with the smallest node processing reference value, and allocation is continued for the rule combinations that have not been allocated until each rule combination is allocated to the corresponding processing node.

[0115] Specifically, the priority setting method is determined according to the abnormal impact value;

[0116] If the abnormal impact value is greater than or equal to the preset abnormal impact value, the priority setting method is to determine the first priority coefficient according to the abnormal impact value;

[0117] If the abnormal impact value is less than the preset abnormal impact value, a second priority coefficient is determined according to a similar reference value;

[0118] The first priority coefficient is positively correlated with the abnormal impact value, and the second priority coefficient is positively correlated with the similarity reference value.

[0119] Among them, the value of the preset abnormal impact value can be determined by the user according to the actual application scenario. The greater the user's demand for timely transmission of abnormal traffic data, the smaller the value of the preset abnormal impact value. It can be understood that under different confirmation methods, the value of the preset abnormal impact value is different. An abnormal impact value is provided under the first impact condition and the second impact condition. The historical records of determining the second priority coefficient based on similar reference values ​​are detected, and the average value of the abnormal impact values ​​corresponding to the historical records that can meet user needs and determine the abnormal impact values ​​based on the traffic threshold is recorded as the preset abnormal impact value under the first impact condition, and the average value of the abnormal impact values ​​corresponding to the historical records that can meet user needs and determine the abnormal impact values ​​based on the port impact value and the equipment reference value is recorded as the preset abnormal impact value under the second impact condition.

[0120] Specifically, the traffic data is allocated according to the transmission impact coefficient, including:

[0121] The priority order of each flow data transmission is determined according to the first priority coefficient or the second priority coefficient. When allocating a single flow data, the flow data is recorded as the flow data to be allocated, and the flow data to be allocated is transmitted to the node with the largest transmission influence coefficient.

[0122] Among them, it should be noted that when determining the priority order of each flow data transmission according to the first priority coefficient or the second priority coefficient, only one of them can be determined. When the abnormal impact value is greater than or equal to the preset abnormal impact value, the priority order of each flow data transmission is determined according to the first priority coefficient; when the abnormal impact value is less than the preset abnormal impact value, the priority order of each flow data transmission is determined according to the second priority coefficient;

[0123] It can be understood that the larger the value of the first priority coefficient or the second priority coefficient, the higher the priority of the transmission order of the traffic data. The transmission impact coefficient = the node processing reference value corresponding to the processing node - the shortest distance between the port where the traffic data is located and the processing node. For a single processing node, the node processing reference value is the difference between the maximum amount of data that the processing node can process and the amount of data that the processing node is processing in a single monitoring cycle. The unit of data volume is GB.

[0124] Specifically, traffic data includes unknown industrial control protocols and known industrial control protocols. Different protocol types have different corresponding abnormality determination methods.

[0125] For known industrial control protocols, the abnormality determination method is to determine the known protocol status based on the feature matching degree;

[0126] For unknown industrial control protocols, the abnormality determination method is to determine the unknown protocol status based on the model matching degree;

[0127] The known protocol state includes an abnormal known protocol state whose characteristic matching degree is less than a preset characteristic matching degree, and a normal known protocol state whose characteristic matching degree is greater than or equal to the preset characteristic matching degree;

[0128] The unknown protocol state includes an abnormal unknown protocol state whose model matching degree is less than a preset model matching degree, and a normal unknown protocol state whose model matching degree is greater than or equal to the preset model matching degree.

[0129] Among them, the present invention is provided with a known protocol library, which contains historical byte vectors corresponding to known industrial control protocols uploaded by several users. For a known industrial control protocol, each byte in the known industrial control protocol is converted into a byte vector. The present invention adopts TF-IDF technology to convert the byte vector; the feature matching degree is the maximum value of the cosine value of the angle between the byte vector corresponding to a single known industrial control protocol and each historical byte vector. It can be understood that the value range of the feature matching degree is [0,1];

[0130] For a single unknown industrial control protocol, the unknown working condition protocol is recorded as the target protocol, and the characteristic curve and the baseline corresponding to the target protocol are obtained through the abnormal detection baseline model. The characteristic curve and the baseline have the same horizontal coordinates, and the data points with a deviation greater than the preset deviation in the characteristic curve are detected. The data point is a point on the characteristic curve corresponding to a horizontal coordinate value, and the deviation is the absolute value of the difference between the vertical coordinate value of the characteristic curve corresponding to a single horizontal coordinate value and the vertical coordinate value of the baseline when the characteristic curve corresponding to the target protocol is compared with the baseline. This is easy for technicians in this field to understand and will not be described in detail.

[0131] Model matching degree = the number of data points in the characteristic curve corresponding to the target protocol whose deviation is greater than the preset deviation / the number of data points in the characteristic curve corresponding to the target protocol;

[0132] The value of the preset deviation can be determined by the user according to the actual application scenario. The greater the user's demand for the accuracy of the model matching, the smaller the value of the preset deviation. A preset deviation value is provided, and the average value of the deviation corresponding to the historical records that can meet the user's needs is recorded as the preset deviation;

[0133] The values ​​of the preset feature matching degree and the preset model matching degree can be determined by the user according to the actual application scenario. The higher the user's demand for the accuracy of confirming known protocol states and unknown protocol states, the greater the values ​​of the preset feature matching degree and the preset model matching degree. A value of the preset feature matching degree and the preset model matching degree is provided, and the preset feature matching degree is 0.95 and the model matching degree is 95%.

[0134] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0135] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for detecting full flow of industrial control network security, characterized in that: include: Obtain industrial control network information and determine traffic status based on the number of ports and difficulty reference values; The flow state includes a first flow state in which the number of ports is greater than or equal to a preset number of ports or a difficulty reference value is greater than or equal to a preset difficulty reference value, and a second flow state in which the number of ports is less than the preset number of ports and the difficulty reference value is less than the preset difficulty reference value; Determine the abnormal impact value confirmation method according to the flow fluctuation value and the flow reference value. The abnormal impact value confirmation method is determined according to the flow threshold or according to the port impact value and the device reference value; If the flow fluctuation value is greater than or equal to the preset flow fluctuation value or the flow reference value is greater than or equal to the preset flow reference value, the abnormal impact value confirmation method is determined according to the flow threshold; If the flow fluctuation value is less than the preset flow fluctuation value and the flow reference value is less than the preset flow reference value, the abnormal impact value confirmation method is to determine it according to the port impact value and the device reference value; Determining the flow distribution method according to the flow state is to determine the combined distribution method according to the pixel difference and the distribution difference, or to determine the priority setting method according to the abnormal impact value, and distribute the flow data according to the transmission impact coefficient; The combination allocation methods include similar combination allocation and regular combination allocation; The priority setting method is to determine the first priority coefficient according to the abnormal impact value or to determine the second priority coefficient according to the similar reference value; The abnormality determination method is determined according to the protocol type. The abnormality determination method is to determine the known protocol state according to the feature matching degree or to determine the unknown protocol state according to the model matching degree.

2. The industrial control network security full-flow detection method according to claim 1 is characterized in that: Determine the flow distribution method according to the flow status; In the first flow state, the flow distribution method is to determine the combined distribution method according to the pixel difference and the distribution difference; In the second flow state, the flow allocation method is to determine the priority setting method according to the abnormal impact value, and allocate the flow data according to the transmission impact coefficient.

3. The industrial control network security full-flow detection method according to claim 2 is characterized in that: Determine the combination allocation method according to the pixel difference and distribution difference; If the pixel difference is less than the preset pixel difference and the distribution difference is less than the preset distribution difference, the combination allocation method is similar combination allocation; If the pixel difference is greater than or equal to the preset pixel difference or the distribution difference is greater than or equal to the preset distribution difference, the combination allocation method is regular combination allocation.

4. The industrial control network security full-flow detection method according to claim 3 is characterized in that: The similar combination allocation includes: A1, perform similarity detection on a single flow data that is not recorded as a similar combination, record the flow data as target flow data, and record other flow data that are not recorded as a similar combination except the target flow data as reference flow data; A2, record the set of all reference flow data and target flow data whose threshold difference from the target flow data is less than the preset threshold difference as a similar combination; A3, repeat steps A1 and A2 until all flow data are recorded in similar combinations; A4, allocates to each similar combination according to the node processing reference value.

5. The industrial control network security full-flow detection method according to claim 3 is characterized in that: The regular combination allocation includes: S1, sort the traffic data in descending order according to the mean value of the regular field and record it as the reference sequence; S2, select the reference flow data that are not recorded as regular combinations and have the same number at both ends of the reference sequence and whose total number is the number of regular combination scales, and record them as a regular combination; S3, repeat step S2 until all flow data are recorded in the regular combination; S4, allocating to each rule combination according to the node processing reference value; Among them, the number of regular combination scales is positively correlated with the minimum node processing reference value.

6. The industrial control network security full flow detection method according to claim 2 is characterized in that: Determine the priority setting method based on the abnormal impact value; If the abnormal impact value is greater than or equal to the preset abnormal impact value, the priority setting method is to determine the first priority coefficient according to the abnormal impact value; If the abnormal impact value is less than the preset abnormal impact value, a second priority coefficient is determined according to a similar reference value; The first priority coefficient is positively correlated with the abnormal impact value, and the second priority coefficient is positively correlated with the similarity reference value.

7. The industrial control network security full-flow detection method according to claim 2 is characterized in that: The traffic data is allocated according to the transmission impact coefficient, including: The priority order of each flow data transmission is determined according to the first priority coefficient or the second priority coefficient. When allocating a single flow data, the flow data is recorded as the flow data to be allocated, and the flow data to be allocated is transmitted to the node with the largest transmission impact coefficient.

8. The industrial control network security full flow detection method according to claim 7 is characterized in that: Traffic data includes unknown industrial control protocols and known industrial control protocols. Different protocol types have different abnormality determination methods. For known industrial control protocols, the abnormality determination method is to determine the known protocol status based on the feature matching degree; For unknown industrial control protocols, the abnormality determination method is to determine the unknown protocol status based on the model matching degree; The known protocol state includes an abnormal known protocol state whose characteristic matching degree is less than a preset characteristic matching degree, and a normal known protocol state whose characteristic matching degree is greater than or equal to the preset characteristic matching degree; The unknown protocol state includes an abnormal unknown protocol state whose model matching degree is less than a preset model matching degree, and a normal unknown protocol state whose model matching degree is greater than or equal to the preset model matching degree.

Images