Alarm behavior analysis method and device, computing equipment and readable storage medium

Abstract

The invention provides an alarm behavior analysis method and device suitable for an industrial control system. The method comprises the following steps: acquiring related information of the industrial control system according to a preset rule; carrying out generalization processing on the related information to form a key value pair; and analyzing and processing the key value pair, and triggering an alarm to output alarm information according to an analysis and processing result. The system comprises an acquisition module used for acquiring related information of the industrial control system; the governance module is used for carrying out generalization processing on the related information into key value pairs; the analysis module is used for carrying out analysis processing according to a preset rule based on the key value pair; and the trigger is used for triggering an alarm to output alarm information according to the analysis processing result of the analysis module. According to the invention, the operation condition and the potential safety hazard of the industrial control system and the information security problem of the industrial control network can be analyzed through the log information of the industrial control system, the network flow information, the use information of the industrial control system resources and the like, and the information security performance of the industrial control system and the network can be improved.

Description

Technical Field

[0001] The present invention relates to the field of information security of industrial control systems, and in particular to an alarm behavior analysis method, device, computing equipment and readable storage medium. Background Art

[0002] Industrial control systems are the country's key information infrastructure, playing a key role in meeting people's living needs and ensuring sustainable economic development, and are related to the country's economic lifeline and social stability. If the industrial control system is attacked maliciously or the system fails, it may affect the safe and sustainable development of the national economy and even cause social unrest. In order to ensure the safe and stable operation of the industrial control system, various types of industrial control terminals are widely deployed in the system to prevent potential malicious attacks on the system and ensure the availability, confidentiality, integrity and continuity of the industrial control system.

[0003] Industrial control terminals are widely used in many industrial control fields such as transportation, finance, electricity, medical treatment, and the Internet of Things. They mainly perform tasks such as data collection and operation control, and play a huge role in ensuring the stable operation of industrial control systems. However, with the continuous development of information security construction, information networks and application business systems have become more and more comprehensive and complex, especially in large units or institutions, where there are a large number of security devices and complex network topologies, and their information security involves more and more aspects. In recent years, with the increasing number of various network estimation events targeting industrial control systems, the serious deficiencies in industrial control systems in terms of security protection have been exposed. Most networks and equipment are unsafe. Faced with this situation, it is difficult for security managers to fully grasp the operation of the industrial control system network and security risks. At the same time, faced with a huge amount of network communication information, it is difficult for security managers to figure out the status of the network system, whether there is illegal communication, and whether they are facing network attacks or abnormalities and other information security issues. Summary of the invention

[0004] In view of the shortcomings of the prior art described above, the purpose of the present invention is to provide an alarm behavior analysis method, device, computing equipment and readable storage medium, which are used to analyze and process relevant information in the industrial control system to solve the problem in the prior art that security management personnel are unable to grasp the operating conditions and safety hazards of the industrial control system and the information security problem of the industrial control network.

[0005] To achieve the above objectives and other related objectives, this application provides the following solutions:

[0006] In a first aspect, the present application provides an alarm behavior analysis method applicable to an industrial control system, comprising:

[0007] Acquire relevant information of the industrial control system according to preset rules, wherein the relevant information includes at least one of the following: log information, equipment operation status information, and network traffic information;

[0008] Generalize the relevant information into key-value pairs;

[0009] The key-value pair is analyzed and processed, and an alarm is triggered to output alarm information according to the result of the analysis and processing.

[0010] Optionally, the preset rules include: acquiring relevant information of the industrial control system in real time; and / or, acquiring relevant information of the industrial control system periodically; and / or, acquiring relevant information of the corresponding industrial control system based on historical alarms.

[0011] Optionally, the step of generalizing the relevant information into key-value pairs includes:

[0012] Extract keywords and corresponding values ​​based on the relevant information;

[0013] The keyword and the value are combined into a key-value pair.

[0014] Optionally, the step of analyzing and processing the key-value pair includes:

[0015] Acquire the Realtime rules in the industrial control system that are in a startup state and / or a running state;

[0016] Executing the Realtime rule to perform calculation based on the key-value pair as Facts data;

[0017] If the calculation result is True, an alarm is triggered to output an alarm message.

[0018] Optionally, before the step of generating and outputting the alarm information, the method further includes:

[0019] Determine whether the number of occurrences of the Realt ime rule whose calculation result is True in the preset time window reaches a number threshold;

[0020] If the number threshold is reached, whether the key-value pair meets the suppression condition is determined based on the preset anomaly detection model;

[0021] If the suppression condition is not met, the alarm is triggered and the alarm information is output.

[0022] Optionally, the step of triggering an alarm to output alarm information includes:

[0023] Generate corresponding warning information based on the analysis and processing results;

[0024] The alarm information is output according to a pre-configured output method.

[0025] In a second aspect, the present application provides an alarm behavior analysis device applicable to an industrial control system, comprising:

[0026] A collection module, used to collect relevant information of the industrial control system, wherein the relevant information includes at least one of the following: log information, equipment operation status information and network flow information;

[0027] A governance module, used for generalizing the relevant information into key-value pairs;

[0028] Analysis module, which performs analysis and processing based on key-value pairs according to preset rules

[0029] A trigger is used to trigger an alarm output according to the analysis and processing results of the analysis module.

[0030] Optionally, the analysis module includes:

[0031] A rule engine unit, used for calculating and analyzing the Realtime rules and the key-value pairs in the industrial control system;

[0032] The calculation engine unit is used to analyze the Realtime rules calculated and analyzed by the rule engine unit according to the time window and the model.

[0033] In a third aspect, the present application provides a computing device, comprising: at least one processor, a memory, and an input-output unit;

[0034] The memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute the alarm behavior analysis method as described above.

[0035] In a fourth aspect, the present application also provides a computer-readable storage medium, including instructions, which, when executed on a computer, enables the computer to execute the alarm behavior analysis method as described above.

[0036] As described above, the alarm behavior analysis method and device applicable to the industrial control system of the present invention have the following beneficial effects:

[0037] It can analyze the operation status and security risks of the industrial control system and the information security issues of the industrial control network through the log information, network traffic information and usage information of the industrial control system resources. It can effectively improve the security performance and corresponding capabilities of the industrial control system network and ensure the security of the industrial control system network. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 A flowchart of an alarm behavior analysis method applicable to an industrial control system provided in an embodiment of the present application;

[0040] Figure 2 A schematic diagram of a process for generalizing information related to an industrial control system into key-value pairs provided in an embodiment of the present application;

[0041] Figure 3 A schematic diagram of a flow chart for calculating and analyzing enabled rules and key-value pairs in an industrial control system provided by an embodiment of the present application;

[0042] Figure 4 A schematic diagram of a process for performing time window and model analysis on enabled rules in an industrial control system provided by an embodiment of the present application;

[0043] Figure 5 A schematic diagram of a process of triggering an alarm and outputting alarm information provided in an embodiment of the present application;

[0044] Figure 6 A schematic diagram of the structure of an alarm behavior analysis device applicable to an industrial control system provided in an embodiment of the present application; DETAILED DESCRIPTION

[0045] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0046] It should be noted that, in this article, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element. In addition, components, features, and elements with the same name in different embodiments of the present application may have the same meaning or different meanings, and their specific meanings need to be determined by their explanation in the specific embodiment or further combined with the context of the specific embodiment.

[0047] It should be understood that, although the terms first, second, third, etc. may be used to describe various information in this article, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this article, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination". Furthermore, as used in this article, the singular forms "one", "one" and "the" are intended to also include plural forms, unless there is an opposite indication in the context. It should be further understood that the terms "comprising" and "including" indicate that there are the described features, steps, operations, elements, components, projects, kinds, and / or groups, but do not exclude the existence, occurrence or addition of one or more other features, steps, operations, elements, components, projects, kinds, and / or groups. The terms "or", "and / or", "including at least one of the following" etc. used in this application can be interpreted as inclusive, or mean any one or any combination. For example, “comprising at least one of the following: A, B, C” means “any of the following: A; B; C; A and B; A and C; B and C; A and B and C”, and for another example, “A, B or C” or “A, B and / or C” means “any of the following: A; B; C; A and B; A and C; B and C; A and B and C”. An exception to this definition will only occur when a combination of elements, functions, steps or operations are inherently mutually exclusive in some manner.

[0048] It should be understood that, although the various steps in the flowchart in the embodiment of the present application are displayed in sequence according to the indication of the arrows, these steps are not necessarily performed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and it can be performed in other orders. Moreover, at least a portion of the steps in the figure may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and their execution order is not necessarily performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0049] As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0050] It should be noted that in this article, step codes such as S10 and S20 are used for the purpose of expressing the corresponding content more clearly and concisely, and do not constitute a substantial limitation on the sequence. When implementing the step, those skilled in the art may execute S20 first and then S10, etc., but these should all be within the scope of protection of this application.

[0051] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present application, and have no specific meanings. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0053] In an exemplary embodiment, see Figure 1 As shown, a method for analyzing alarm behavior applicable to industrial control systems is provided. The prevention is performed by a computer device, which can be performed by a computing device such as a terminal or a server alone, or by a terminal and a server together. In the embodiment of the present application, the method is applied to a server as an example for explanation, and includes the following steps. Among them:

[0054] S1. Obtain relevant information of the industrial control system according to preset rules;

[0055] In the embodiment of the present application, in order to facilitate the analysis of each device in the industrial control system, the corresponding information is obtained through the interfaces of various network devices, agent probes, etc. in the industrial control system, such as log information, equipment operation status information, and network traffic of the industrial control network. In this embodiment, since the industrial control network of the industrial control system is usually complex, the amount of log information generated daily is also very huge, and analyzing and processing all the log information will lead to low efficiency of analysis and processing, and require a large amount of hardware cost. Therefore, when obtaining the relevant information of the industrial control system, the corresponding relevant information can be obtained according to actual needs. In one exemplary scenario, the latest log information generated in the industrial control system is obtained in real time for analysis and processing, that is, by analyzing a small amount of the latest log information or network traffic, it is possible to discover security issues in the industrial control system at any time; in one exemplary scenario, relevant information of the industrial control system is periodically obtained, for example, the log information generated by the industrial control system within a day is obtained for analysis and processing, and security issues of the empty bucket system are discovered. By periodically obtaining relevant information of the industrial control system, the changing progress of security issues in the industrial control system can be understood, that is, a more refined understanding of security issues can be achieved; in another exemplary scenario, relevant information corresponding to the industrial control system is obtained based on security issues with historical alarms, that is, through security issues with historical alarms, log information of equipment that is prone to security issues is obtained in a targeted manner, so that security issues in the industrial control system can be understood in a more targeted manner.

[0056] S2, generalizing the relevant information into key-value pairs;

[0057] In an embodiment of the present application, after obtaining relevant information of the industrial control system, for example, the log information of the industrial control system, keywords and corresponding values ​​are extracted from the log information to form key-value pairs. In a scenario of an embodiment, the key-value pairs extracted from the log information are usually relatively large. When a large number of key-value pairs are extracted, the extracted key-value pairs are stored in a database. Through the storage in the database, the key-value pairs of historical alarm security issues can be recorded, so that the historical alarm security issues can be referenced for subsequent extraction of key-value pairs or log information.

[0058] S3. Analyze and process the key-value pair, and trigger an alarm to output alarm information according to the result of the analysis and processing.

[0059] In an embodiment of the present application, after extracting the key-value pair from the log information in the industrial control system, the obtained key-value pair is further analyzed and processed. When the key-value pair meets the conditions, it is judged that the key-value pair is safe. Otherwise, it is judged that the key-value pair has a security problem.

[0060] refer to Figure 2As shown, the step of generalizing the relevant information into key-value pairs includes:

[0061] S21, extracting keywords and corresponding values ​​based on the relevant information;

[0062] S22. Form a key-value pair with the keyword and the corresponding value.

[0063] In an embodiment of the present application, when extracting key-value pairs through the acquired relevant information, for example, when extracting key-value pairs from the log information of the industrial control system, in a scenario of an embodiment, the corresponding character string of the device in the industrial control system is used as the keyword, and the information output by the device is used as the value. The network of the industrial control system usually contains a large number of devices, such as various network devices, agent probe devices, etc. When extracting key-value pairs based on log information, the extracted keywords can be character strings related to network devices, agent probes, etc. as keywords, and the relevant output information, status, etc. of network devices, agent probes, etc. as values, and the keywords and values ​​are combined into key-value pairs for storage.

[0064] refer to Figure 3 As shown, the step of analyzing and processing the key-value pair includes:

[0065] S31, obtaining the Realtime rules in the industrial control system that are in a startup state and / or a running state;

[0066] S32, executing the Realtime rule to perform calculation based on the key-value pair as Facts data;

[0067] S33. If the calculation result is False, trigger an alarm to output an alarm message.

[0068] In an embodiment of the present application, after the key-value pairs are extracted through the log information, the Realtime rules cached in the industrial control system are further traversed to find the Realtime rules in the enabled state, for example, the Realtime rules that are started and not running, and the Realtime rules that are started and running, for example, the process startup rules and running rules in the industrial control system; the transmission rules of the network traffic of the industrial control network; the usage of the system resources of the industrial control system, such as the usage rate of resources such as CPU, memory, hard disk, the status and number of processes, etc., and the extracted key-value pair data is further used as Facts data, and the Realtime rules in the started state are searched. The time rule and Facts data are used to perform rule calculations. When the calculation result is False, it is considered that there are abnormal behaviors and attack behaviors in the industrial control network. For example, if unknown process startup and unknown port access appear in the log, it may mean that the industrial control system has been attacked. Further, an alarm is triggered for the abnormal behavior or attack behavior, and an alarm message is generated; for example, if abnormal data transmission behavior, a large number of unauthorized remote access requests, and data packets of unknown protocols are found in network traffic, it may mean that there are abnormal behaviors in the industrial control system; for example, if the use of system resources of the industrial control system is abnormal, it may mean that the industrial control system has been attacked. When the calculation result is True, it is considered that there are no abnormal behaviors or attack behaviors in the industrial control network.

[0069] refer to Figure 4 As shown, before the step of generating and outputting the alarm information, it also includes:

[0070] S34, determining whether the number of occurrences of the Realt ime rule whose calculation result is True in the preset time window reaches a number threshold;

[0071] S35. If the number threshold is not reached, determine whether the Real time rule meets the suppression condition based on the preset anomaly detection model;

[0072] S36: If the suppression condition is not met, trigger an alarm to output alarm information.

[0073] In an embodiment of the present application, in order to further improve the accuracy of identifying abnormal behaviors and attack behaviors in industrial control networks, when the rule calculation result of the aforementioned Realtime rules and Facts data is True, that is, no abnormal behaviors or attack behaviors in the industrial control network are identified, it is further determined whether the number of occurrences of the corresponding Realtime rule in the preset time window reaches the number threshold. For example, if the number of frequent accesses to the database in a short period of time exceeds the preset number threshold, an alarm is triggered and an alarm message is generated; and when the number of occurrences of the Realtime rule in the preset time window does not reach the number threshold, it is further determined by a preset anomaly detection model whether the Realtime rule meets the suppression condition. If the suppression condition is met, an alarm is triggered and an alarm message is generated. For example, after detecting that a user has accessed the database, it is further detected that sensitive files are accessed, dangerous commands are executed, etc., and an alarm is triggered to generate an alarm message.

[0074] In an embodiment of the present application, after analyzing the Realtime rules as described above, if no abnormal behavior or attack behavior is found, the above steps are re-executed to start the analysis of abnormal behavior or attack behavior in the industrial control system.

[0075] refer to Figure 5 As shown, the step of triggering an alarm to output alarm information includes:

[0076] Generate corresponding warning information based on the analysis and processing results;

[0077] The alarm information is output according to a pre-configured output method.

[0078] In an embodiment of the present application, when abnormal behavior or attack behavior is found in the industrial control system through the above-mentioned analysis process, an alarm message is generated, and the alarm message is output according to the pre-configured output method, for example, the generated alarm message is sent to the target user by sending an email, text message, or instant messaging, such as WeChat, DingTalk, Feishu, etc. In an embodiment of the present application, when issuing an alarm message, further, the corresponding output method can be preferentially selected according to the level of abnormal behavior or attack behavior. For example, when it is analyzed that there is a hacker attack on the industrial control system, the alarm message is sent to the target user through instant messaging or voice call, and when it is analyzed that there is an abnormal process in the industrial control system, the alarm message is sent to the target user by email or text message.

[0079] refer to Figure 6As shown, the present application provides an alarm behavior analysis device applicable to industrial control systems, including: a collection module, a governance module, an analysis module and a trigger. The alarm behavior analysis device applicable to industrial control systems obtains relevant information in the industrial control system through the collection module, such as log information of the industrial control system, network traffic information of the industrial control system, usage of system resources of the industrial control system, etc.; further generalizes the obtained relevant information through the governance module, that is, extracts keywords and corresponding values ​​from the obtained relevant information to form a key-value pair, for example: takes the character string of each network device, agent probe device, etc. in the industrial control system as a keyword, takes the relevant output information, status, etc. of the network device, agent probe device, etc. as a value, and forms a key-value pair with the keyword and the value; further, the analysis module identifies the abnormal behavior or attack behavior that may exist in the industrial control system based on the key-value pairs obtained above, specifically, the rule engine unit in the analysis module calculates and analyzes the Realtime rules and the extracted key-value pairs in the industrial control system. In one embodiment, the Realt in the startup state in the industrial control system is detected. ime rules, such as the process startup rules of the industrial control system, the use rules of the industrial control system resources, etc., are used to calculate the rules with the extracted key-value pairs, so as to analyze whether there are abnormal behaviors and attack behaviors in the industrial control system; for example, the Realt ime rules calculated and analyzed by the rule engine unit are analyzed by the time window and the preset abnormal detection model by the calculation engine unit, so as to determine whether there are abnormal behaviors or attack behaviors in the industrial control system; finally, after determining that there are abnormal behaviors or attack behaviors, further, the corresponding alarm information is generated by the trigger for alarm, for example, by sending an email, a text message, or an instant messaging, such as WeChat, DingTalk, Feishu, etc., to send the generated alarm information to the target user. In one embodiment of the present application, when issuing the alarm information, further, the corresponding output method can be preferentially selected according to the level of the abnormal behavior or attack behavior. For example, when it is analyzed that there is a hacker attack on the industrial control system, the alarm information is sent to the target user by instant messaging or voice call, and when it is analyzed that there is an abnormal process in the industrial control system, the alarm information is sent to the target user by email or text message.

[0080] In summary, the present invention is applicable to the alarm behavior analysis method and system of the industrial control environment, which can analyze the security problems in the industrial control system through the log information, network flow information and the use information of the industrial control system resources, and can effectively improve the security performance and corresponding capabilities of the industrial control system network, and ensure the security of the industrial control system network. The present invention effectively overcomes various shortcomings in the prior art and has a high industrial utilization value.

[0081] An embodiment of the present application also provides a computing device, including a memory and a processor. A control program is stored in the memory. When the control program is executed by the processor, the steps of the alarm behavior analysis method in any of the above embodiments are implemented.

[0082] An embodiment of the present application also provides a computer-readable storage medium, on which a control program is stored. When the control program is executed by a processor, the steps of the alarm behavior analysis method in any of the above embodiments are implemented.

[0083] In the embodiments of the smart terminal and storage medium provided in the present application, all technical features of any of the above-mentioned control method embodiments may be included, and the expanded and explained contents of the specification are basically the same as those of the embodiments of the above-mentioned methods, and will not be repeated here.

[0084] The embodiment of the present application further provides a computer program product, which includes a computer program code. When the computer program code runs on a computer, the computer executes the methods in the above various possible implementation modes.

[0085] An embodiment of the present application also provides a chip, including a memory and a processor, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that a device equipped with the chip executes the methods in various possible implementation modes as described above.

[0086] It is understood that the above scenarios are only examples and do not constitute a limitation on the application scenarios of the technical solutions provided in the embodiments of the present application. The technical solutions of the present application can also be applied to other scenarios. For example, it is known to those skilled in the art that with the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0087] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0088] The steps in the method of the embodiment of the present application can be adjusted in order, combined and deleted according to actual needs.

[0089] The units in the device of the embodiment of the present application can be merged, divided and deleted according to actual needs.

[0090] In the present application, the same or similar terminology concepts, technical solutions and / or application scenario descriptions are generally described in detail only the first time they appear. When they appear again later, they are generally not repeated for the sake of brevity. When understanding the technical solutions and other contents of the present application, for the same or similar terminology concepts, technical solutions and / or application scenario descriptions that are not described in detail later, reference can be made to the previous related detailed descriptions.

[0091] In the present application, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0092] The various technical features of the technical solution of the present application can be arbitrarily combined. In order to make the description concise, not all possible combinations of the various technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of the present application.

[0093] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, a controlled terminal, or a network device, etc.) to execute the method of each embodiment of the present application.

[0094] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a storage medium, or transmitted from one storage medium to another storage medium. For example, computer instructions can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The storage medium can be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integration. Available media can be magnetic media, (e.g., floppy disk, storage disk, tape), optical media (e.g., DVD), or semiconductor media (e.g., solid-state storage disk Solid State Disk (SSD)) and the like.

[0095] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for analyzing alarm behavior, applicable to industrial control systems, characterized in that: The alarm behavior analysis method comprises: Acquire relevant information of the industrial control system according to preset rules, wherein the relevant information includes at least one of the following: log information, equipment operation status information, and network traffic information; Generalize the relevant information into key-value pairs; The key-value pair is analyzed and processed, and an alarm is triggered to output alarm information according to the result of the analysis and processing.

2. The alarm behavior analysis method according to claim 1, characterized in that: The preset rules include: Acquire relevant information of the industrial control system in real time; and / or, Periodically obtain relevant information of the industrial control system; and / or, Obtain relevant information corresponding to the industrial control system based on historical alarms.

3. The alarm behavior analysis method according to claim 1, characterized in that: The step of generalizing the relevant information into key-value pairs includes: Extract keywords and corresponding values ​​based on the relevant information; The keyword and the value are combined into a key-value pair.

4. The alarm behavior analysis method according to claim 1, characterized in that: The step of analyzing and processing the key-value pair comprises: Acquire the Realtime rules in the industrial control system that are in a startup state and / or a running state; Executing the Realtime rule to perform calculation based on the key-value pair as Facts data; If the calculation result is True, an alarm is triggered to output an alarm message.

5. The alarm behavior analysis method according to claim 4, characterized in that: Before the step of triggering an alarm to output alarm information, the method further includes: Determine whether the number of occurrences of the Realtime rule whose calculation result is True in the preset time window reaches the number threshold; If the number threshold is reached, whether the key-value pair meets the suppression condition is determined based on the preset anomaly detection model; If the suppression condition is not met, the alarm is triggered and the alarm information is output.

6. The alarm behavior analysis method according to any one of claims 1 to 5, characterized in that: The step of triggering an alarm to output alarm information comprises: Generate corresponding warning information based on the analysis and processing results; The alarm information is output according to a pre-configured output method.

7. An alarm behavior analysis device, characterized in that: The alarm behavior analysis device comprises: A collection module, used to collect relevant information of the industrial control system, wherein the relevant information includes at least one of the following: log information, equipment operation status information and network flow information; A governance module, used for generalizing the relevant information into key-value pairs; An analysis module performs analysis and processing based on the key-value pairs according to preset rules; A trigger is used to trigger an alarm output according to the analysis and processing results of the analysis module.

8. The alarm behavior analysis device according to claim 7, characterized in that: The analysis module comprises: A rule engine unit, used for calculating and analyzing the Realtime rules and the key-value pairs in the industrial control system; The calculation engine unit is used to analyze the Realtime rules calculated and analyzed by the rule engine unit according to the time window and the model.

9. A computing device, characterized in that The computing device comprises: at least one processor, memory, and input-output unit; The memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute the alarm behavior analysis method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The method comprises instructions, which, when executed on a computer, enable the computer to execute the alarm behavior analysis method according to any one of claims 1 to 6.

Images