Industrial control network fault detection method, device and system

Abstract

The invention belongs to the technical field of information, and particularly relates to an industrial control network fault detection method, device and system. The method is realized by constructing a unified protocol specification. Different from a traditional deep packet detection method, a protocol specification aims at a proprietary application layer protocol, only the effective load of a data packet is processed during operation, and the complexity brought by matching of multiple rules is reduced. The construction of the special protocol specification also brings flexibility, the analysis depth of different granularities is constructed for the specific industrial control application layer protocol, different applications can be distinguished in the flow semantic analysis process, and the unique protocol specification is used according to the actual application scene, so that the difference caused by different application granularities is avoided.

Description

Technical Field

[0001] The present invention belongs to the field of information technology, and in particular relates to an industrial control network fault detection method, device and system. Background Art

[0002] Industrial control network, also known as industrial control network, is a special network in industrial automation system. It is a complex system composed of different types of controllers, sensors and actuators, which aims to realize data transmission and control between devices. Industrial control network is a key component in the field of industrial automation. Application failure of industrial control network may lead to production line interruption, resulting in production stagnation and economic losses. In addition, industrial control network also carries the transmission of production data. Failure may lead to data loss or leakage, bringing information security risks to enterprises.

[0003] Traditional network application layer load parsing methods are usually implemented by deep packet inspection, which treats the payload of the data packet to be matched as a byte string and matches it with pre-defined regular expression rules to obtain valid information of the application layer protocol. However, this method is relatively complex. From the perspective of a single rule, the matching complexity of a rule is related to its length. When the bytes to be matched by the rule are large, it takes longer time and cannot meet the real-time requirements of industrial control network fault detection. Therefore, it is urgent to detect industrial control network faults more efficiently and accurately to ensure efficient and accurate data exchange between various devices and systems. Summary of the invention

[0004] In order to overcome the problems existing in the related art, a method, device and system for detecting faults in an industrial control network are provided.

[0005] According to one aspect of an embodiment of the present disclosure, a method for detecting an industrial control network fault is provided, the method comprising:

[0006] Step 1, obtaining all flow data of the application layer of the industrial control network to be detected in real time;

[0007] Step 2, determining the protocol type to which each data packet in the acquired traffic data belongs;

[0008] Step 3: For each data packet, load the protocol specification corresponding to the protocol type to which the data packet belongs, and match the data packet with the protocol field contained in the protocol specification to obtain structured traffic semantic information. Each protocol specification includes the field length and type information corresponding to the protocol type to which it belongs;

[0009] Step 4, matching the obtained traffic semantic information with the behavior automaton to obtain application behavior information;

[0010] Step 5, matching the obtained application behavior information with the fields in the corresponding operation specification;

[0011] Step 6. When the application behavior information matches the corresponding operation specification, generate and display security semantic information, which is used to indicate that the application behavior complies with the specification and display the specific content of the application behavior. When the application behavior information does not match the corresponding operation specification, generate, display and report fault semantic information, which is used to indicate that the application behavior does not comply with the specification and display the specific content of the application behavior and the reason for non-compliance with the specification.

[0012] In a possible implementation, step 1 further includes:

[0013] Step 11, collecting all traffic data in the industrial control network through a mirror switch, where the traffic data is binary data;

[0014] Step 12, scanning the industrial control network topology, detecting all terminal devices and switches in the industrial control network, binding each terminal device to the nearest switch virtual LAN identifier, and deduplicating each data packet according to the virtual LAN identifier of the IEEE 802.1Q protocol part of each data packet in the traffic data.

[0015] In a possible implementation, the flow semantic information includes key-value pairs of key fields of the industrial control application layer protocol. In the process of matching the flow semantic information with the protocol specification, the flow semantic information can be directly accessed through the key fields of the industrial control application layer protocol.

[0016] In a possible implementation, step 2 includes:

[0017] Step 21, the preamble parsing determines the application layer protocol information by combining the transport layer protocol information.

[0018] In a possible implementation, the method further includes: normalizing the protocol specifications of the same type and merging the same fields and detection values.

[0019] In a possible implementation, the method further includes: dividing step 3 and step 4 into different threads, and interactively controlling step 3 and step 4 through a lock-free queue.

[0020] In a possible implementation, step 4 includes:

[0021] Step 41, the behavior automaton matches the fields in the traffic semantic information with the rules, and if a match is found, a state jump is performed internally. The states of the behavior automaton include the behavior formed by a single data packet, the behavior composed of multiple data packets, the single application layer protocol, the multiple application layer protocols, and the state that may trigger a fault;

[0022] Step 42: If the behavior automaton jumps to a state that may trigger a fault, fault semantic information is generated and displayed.

[0023] According to another aspect of an embodiment of the present disclosure, an industrial control network fault detection system is provided, the system comprising a computer device and an industrial control network; the computer device is deployed at the periphery of the industrial control network topology, and is used to execute the above method.

[0024] According to another aspect of an embodiment of the present disclosure, there is provided an industrial control network fault detection device, the device comprising:

[0025] An acquisition module is used to acquire all flow data of the application layer of the industrial control network to be detected in real time;

[0026] A classification module, used to determine the protocol type to which each data packet in the acquired traffic data belongs;

[0027] A parsing module is used to load the protocol specification corresponding to the protocol type to which the data packet belongs for each data packet, and match the data packet with the protocol field contained in the protocol specification to obtain structured traffic semantic information, wherein each protocol specification includes the field length and type information of the corresponding protocol type;

[0028] The behavior analysis module is used to match the obtained traffic semantic information with the behavior automaton to obtain application behavior information;

[0029] A fault detection module, used to match the obtained application behavior information with the fields in the corresponding operation specification;

[0030] The display module is used to generate and display security semantic information when the application behavior information matches the corresponding operation specification, and the security semantic information is used to indicate that the application behavior complies with the specification and display the specific content of the application behavior; when the application behavior information does not match the corresponding operation specification, generate, display and report fault semantic information, and the fault semantic information is used to indicate that the application behavior does not comply with the specification and display the specific content of the application behavior and the reason for non-compliance with the specification.

[0031] According to another aspect of an embodiment of the present disclosure, there is provided an industrial control network fault detection device, the device comprising:

[0032] processor;

[0033] a memory for storing processor-executable instructions;

[0034] Wherein, the processor is configured to execute the above method.

[0035] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0036] The beneficial effect of the present disclosure is that the present disclosure is achieved by constructing a unified protocol specification. Unlike traditional deep packet inspection methods, the protocol specification targets proprietary application layer protocols and only processes the payload of the data packet at runtime, reducing the complexity of matching multiple rules. Building proprietary protocol specifications also brings flexibility. Constructing different granularity parsing depths for specific industrial control application layer protocols can distinguish different applications during the flow semantic analysis process, and use unique protocol specifications according to actual application scenarios, thereby avoiding differences caused by different application granularities. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flow chart of an industrial control network fault detection method shown in the present disclosure.

[0038] Figure 2 The diagram is a schematic diagram showing an example of generating traffic semantic information shown in the present disclosure.

[0039] Figure 3 FIG. 4 is a flowchart showing a fault detection according to an example of the present disclosure.

[0040] Figure 4 It is a schematic diagram of an industrial control network fault detection system shown in the present disclosure.

[0041] Figure 5 It is a block diagram of an industrial control network fault detection device shown in the present disclosure. DETAILED DESCRIPTION

[0042] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0043] In the related art, the degree of analysis of the industrial control network application layer protocol is positively correlated with the degree of mining the details of the industrial control application. The traditional network application layer load analysis method is usually implemented by deep packet inspection. This method regards the payload of the data packet to be matched as a byte string and matches it with the pre-defined regular expression rules to obtain valid information of the application layer protocol. However, this method is relatively complex. From the perspective of a single rule, the matching complexity of a rule is related to its length. When the bytes to be matched by the rule are large, it takes longer time. Therefore, this method cannot meet the real-time requirements of industrial control network fault detection.

[0044] Figure 1is a flow chart of an industrial control network fault detection method shown in the present disclosure. The method can be executed by a computer device, wherein the computer device can be a server cluster, a server, a desktop computer, a laptop computer, etc. The present disclosure embodiment does not limit the type of terminal device. Figure 1 The method includes: steps 1 to 6.

[0045] Step 1: Obtain all traffic data of the application layer of the industrial control network to be detected in real time.

[0046] For example, in step 1, the computer device can continuously collect binary stream data from the industrial control network to be detected through the network card of the mirror switch.

[0047] In a possible implementation, step 1 also includes: step 11 and step 12.

[0048] Step 11: Collect all traffic data in the industrial control network through a mirror switch, where the traffic data is binary data.

[0049] Step 12, scanning the industrial control network topology, detecting all terminal devices and switches in the industrial control network, binding each terminal device to the nearest switch virtual LAN identifier, and deduplicating each data packet according to the virtual LAN identifier of the IEEE 802.1Q protocol part of each data packet in the traffic data.

[0050] Since the collection of industrial control network topology traffic is achieved by collecting the mirror switch, there will be duplication in the original traffic data collected from the network card. The present disclosure solves this problem by introducing a deduplication algorithm. The deduplication algorithm is implemented by utilizing the characteristics of the mirror switch. First, the network topology to be detected is scanned to detect all terminal devices and switches therein. Deduplication is performed at the traffic collection end by binding the terminal device to the virtual LAN identifier (vlan-id) of its nearest switch. The algorithm effectively avoids the problem of multiple duplications of a single data packet in the network topology. At the same time, when parsing the original binary data to obtain the virtual LAN identifier, it is only necessary to focus on the IEEE 802.1Q protocol part of the data packet to obtain the virtual LAN identifier. Compared with the operation of deduplication after fully parsing the original data, the algorithm reduces the parsing complexity. It only needs to obtain the first 24 bytes of the data packet to obtain the source of the data packet and complete the deduplication operation.

[0051] Step 2: Determine the protocol type to which each data packet in the acquired traffic data belongs.

[0052] In the actual analysis process of industrial control network traffic semantics, it is necessary to consider that there will be multiple application layer protocols in the actual operation scenario. Therefore, the fine-grained analysis of traffic semantics requires the goal of extending to multi-protocol parallel detection, so as to achieve comprehensive detection of multiple application behaviors of industrial control networks.

[0053] The present disclosure can effectively avoid the complexity brought about by the expansion of multi-protocol semantic parsing engines by constructing a unified protocol specification for each protocol type. Traditional traffic parsing tools such as WireShark use code embedding to parse network protocols, and the parsing process of each protocol corresponds to a code file. This method causes the protocol specification to be over-coupled with the runtime code. When adding new specifications, not only a certain understanding of the source code is required, but also a large amount of code needs to be written, which is highly complex. The present disclosure declares the protocol as a unified and flexible protocol specification. When matching, it only needs to load the specification file corresponding to the protocol type described in each data packet to detect the corresponding protocol, which is more flexible than traditional parsing tools. At the same time, the independent protocol specification is distinguished from the running code, which reduces the difficulty of writing the protocol specification and facilitates the addition of new protocols to increase the expression ability of the semantic parsing engine.

[0054] In one possible implementation, step 2 includes: step 21, the preamble parsing determines the application layer protocol information by combining the transport layer protocol information, normalizes the protocol specifications of the same type, and merges the same fields and detection values.

[0055] In the application scenario of multiple protocol types, detection can be performed in a serialized manner, but when the number of protocol types is large, this redundant detection method will greatly affect the parsing speed.

[0056] The present disclosure solves the above-mentioned problem by combining preamble analysis with optimized protocol specifications when processing multiple protocol specifications. Preamble analysis determines application layer protocol information by combining transport layer protocol information. For example, the Transmission Control Protocol (TCP) will map the application layer protocol in the port number field. For example, the HyperText Transfer Protocol (HTTP) usually uses port number 80. When optimizing protocol specifications, the same type of protocol specifications are normalized and the same fields are merged with the detection values ​​to reduce redundant matching of the same information. At the same time, the goal of identification and parsing is achieved, and effective information is extracted in a timely manner.

[0057] Step 3, for each data packet, load the protocol specification corresponding to the protocol type to which the data packet belongs, and match the data packet with the protocol field contained in the protocol specification to obtain structured traffic semantic information. Each protocol specification includes the field length and type information corresponding to the protocol type.

[0058] According to an example of this embodiment, in step 3, when constructing the protocol specification, the length and type information of the specific field can be given for description. When describing the type of the field, a variety of description field structures can be provided, such as an integer field (IntField), a long integer field (LongIntField), an enumeration field (EnumField), etc. In the actual parsing process, the system will send the load to be matched into the corresponding protocol specification, and match it with the protocol field therein, and finally obtain structured traffic semantic information.

[0059] In a possible implementation, the flow semantic information includes a key-value pair of a key field of the industrial control application layer protocol. In the process of matching the flow semantic information with the protocol specification, the flow semantic information can be directly accessed through the key field of the industrial control application layer protocol. This makes the structured flow semantic information an iterable object, which in turn reduces the complexity caused by multi-application matching.

[0060] like Figure 2 As shown in the figure, taking the industrial control protocol S7comm as an example, as an application layer protocol, the data unit is composed of a header, a parameter, and data. The structure of the S7comm protocol will be different depending on the implemented function. According to the value of the ROSCTR field in the header, the S7comm data packet is divided into four categories: Job (job request), Ack (acknowledgement response), Ack_Data (acknowledgement data response), and User_Data (original protocol extension). For data packets of types such as Job and Ack_Data, they contain characteristic information such as function and PDU length.

[0061] For more complex User_Data data packets, the number of characteristic information contained is greater. For example, the function code field can extract the function group of the traffic data packet, including "Mode-transition", "Programmer commands", "Block functions", "CPU functions", "Security functions", "Time functions", etc. After the function group of User_Dat data is determined, a sub-function can be uniquely determined by the sub-function code. These sub-functions contain a variety of behaviors and can extract rich protocol characteristic information. For example, "Read system status list" (Read SZL), "Message service" (Message service), "Diagnostic message" (Diagnostic message), etc. In addition, some sub-functions directly identify certain component information of industrial control equipment, such as the name of the automation system, the module name, the device identification of the module, the copyright information of the system, the serial number of the module, the module type name, etc.

[0062] Step 4: Match the obtained traffic semantic information with the behavior automaton to obtain application behavior information.

[0063] For example, step 4 may include step 41 and step 42 .

[0064] Step 41, the behavior automaton matches the fields in the traffic semantic information with the rules, and if a match is found, a state jump is performed internally. The states of the behavior automaton include the behavior formed by a single data packet, the behavior composed of multiple data packets, the single application layer protocol, the multiple application layer protocols, and the state that may trigger a fault;

[0065] Step 42: If the behavior automaton jumps to a state that may trigger a fault, fault semantic information is generated and displayed.

[0066] In the related technology, it is impossible to fully detect and match application behaviors by only starting with a single network traffic semantic information, and simple structured data cannot deduce complete application behavior information. Therefore, the network behavior composed of a set of related traffic semantic data is publicly defined in the industrial control network application behavior.

[0067] The present disclosure realizes automatic matching by matching automata with behavior rule deduction models (example of step 4). The matching automata are used to record the matching status of the current application behavior and save the necessary information in the semantics of the preceding traffic. For example, when operating the underlying valve in an industrial control system, three GIOP application layer protocol data packets will be generated. The first data packet is generated by the operator station, which is responsible for issuing commands and calling the execute command (idl_execute_command) method; the second data packet is the request from the operator station by the central processing server and is passed to the underlying valve device. When the operation is completed, the processing completion (idl_command_ended) method is returned upward; the third data packet is generated by the central processing server, and a request to update the interface (idl_update_application_state) is issued to the operator station. In the process of operating the underlying valves in the above-mentioned industrial control system, the automata are used to save the specific state of the currently matched GIOP protocol to prevent the corresponding node from being found in the subsequent matching process of the automata.

[0068] During operation, the matching automaton will match the fields and rules in the structured traffic semantic information, and will jump to a state internally if a match is found. The entire automaton is composed of multiple states to meet various requirements, such as the behavior formed by a single data packet (only one state), the behavior composed of multiple data packets (multiple states), the single application layer protocol (all states are the same application layer protocol), and the multiple application layer protocols (there are multiple application layer protocols in the automaton), covering various types of application behaviors. The matching automaton also includes states that may trigger faults. If the application automaton jumps to a state that may trigger a fault, it means that the semantic information input at this time meets the conditions for triggering a fault, which will cause a fault. After detecting the fault state, the matching model will generate corresponding behavior data, which will be analyzed and processed by the application fault detection module.

[0069] The behavior rule derivation model is mainly responsible for two aspects of work. On the one hand, it checks and models the application rules defined by the user, and on the other hand, it optimizes and adjusts the application rules. In terms of checking and modeling, the model checks the various application behaviors input by the user to see whether they conform to the deterministic finite automaton (DFA), so as to ensure that the automaton modeled by the rules can detect valid information during runtime. In the modeling stage, the model generates automaton objects by applying behavior rules, and matches them with the parsed traffic semantic information at runtime to discover application behavior information. In the optimization and adjustment stage of application rules, the model is mainly responsible for merging and optimizing multiple application rules. In the actual detection process of application behavior, there are repeated nodes and protocol semantic information in multiple application behavior rules. If linear matching is performed according to the actual rules, it will consume time and space, which will challenge the real-time goal of the system. The behavior rule derivation model eliminates the performance error caused by sequential matching by optimizing multiple rules into multiple hierarchical matching trees.

[0070] In the actual matching process, the application automaton matching model receives the traffic semantic information and sends it to the corresponding behavior automaton to match it with the application behavior rules, thereby generating behavior information for subsequent use.

[0071] Step 5, matching the obtained application behavior information with the fields in the corresponding operation specification;

[0072] Step 6. When the application behavior information matches the corresponding operation specification, generate and display security semantic information, which is used to indicate that the application behavior complies with the specification and display the specific content of the application behavior. When the application behavior information does not match the corresponding operation specification, generate, display and report fault semantic information, which is used to indicate that the application behavior does not comply with the specification and display the specific content of the application behavior and the reason for non-compliance with the specification.

[0073] For example, Figure 3As shown, the present disclosure uses an application fault detection module (examples of steps 5 and 6) to process the application behavior information generated from the application automaton matching model, capture and extract the fault information therein, and determine the scope and extent of its impact. For example, in a case related to the processing center processing server permissions, the application behavior information generated in the previous order is structured data: "Time: 21:30:34 on January 10, administrator station: A, destination operator station: kic-owp1, behavior: send a data packet to the central processing server to request to open the operator station", and the application fault detection module matches the information with the valid range of the corresponding field in the matching specification. According to the scope given by the matching specification, if the application behavior is a compliant operation, the security semantic information "the administrator station requested and successfully opened the operator station kic-owp1, and the administrator station has permission, so the operation is legal." is generated and recorded. If the input data does not conform to the specifications, the match will fail and the message "The administrator station requests to open the operator station kic-owp1. The administrator station does not have permission and the operation is illegal" will be generated and reported to the relevant personnel account, so that the fault can be projected to the display interface and the terminal interface of the relevant personnel, so that the industrial control site management personnel can maintain the fault.

[0074] The main work of the application fault detection module is to match the previous detection information with the normal information in the behavior specification to obtain security semantic information. Security semantic information displays information related to the fault, including the terminal device where the fault occurred and its detailed description information. Through the pre-established industrial control network topology model, the impact range of the fault can be discovered, so that managers can locate the location of the fault in time and handle the fault.

[0075] The present disclosure is achieved by building a unified protocol specification. Unlike traditional deep packet inspection methods, the protocol specification targets proprietary application layer protocols and only processes the payload of the data packet at runtime, reducing the complexity of matching multiple rules. Building a proprietary protocol specification also brings flexibility. Building different granularity analysis depths for specific industrial control application layer protocols can distinguish different applications during the flow semantic analysis process, and use unique protocol specifications according to actual application scenarios, thereby avoiding differences caused by different application granularities.

[0076] In a possible implementation, the method further includes: dividing step 3 and step 4 into different threads, and interactively controlling step 3 and step 4 through a lock-free queue.

[0077] The present disclosure introduces a lock-free queue dedicated to storing traffic semantic data, and divides traffic real-time analysis and application analysis into two different threads. The interactive control between the two is carried out through the lock-free queue. This achieves the goal of real-time analysis and reduces the performance gap between traffic analysis and subsequent application behavior detection.

[0078] Figure 4 is a schematic diagram of an industrial control network fault detection system shown in the present disclosure, such as Figure 4 As shown, the system includes a computer device and an industrial control network; the computer device is deployed at the periphery of the industrial control network topology and is used to execute the above method. The computer device can be connected to the network through an idle input port of a mirror switch, and the mirror switch collects all network traffic data in the industrial control network topology. On the basis of obtaining traffic data from the mirror switch in real time, the computer device will perform fine-grained analysis on the traffic to obtain semantic information. The application automaton matching model will match and identify the semantic information obtained by the analysis, and the automaton will be modeled in real time according to pre-established rules to obtain corresponding application behavior information. After obtaining detailed application behavior information, the fault detection module will detect the details therein, determine the possible problems and faults therein, and finally achieve the purpose of real-time detection of possible problems in the industrial control network by applying the fault detection system.

[0079] According to another aspect of an embodiment of the present disclosure, there is provided an industrial control network fault detection device, the device comprising:

[0080] An acquisition module is used to acquire all flow data of the application layer of the industrial control network to be detected in real time;

[0081] A classification module, used to determine the protocol type to which each data packet in the acquired traffic data belongs;

[0082] A parsing module is used to load the protocol specification corresponding to the protocol type to which the data packet belongs for each data packet, and match the data packet with the protocol field contained in the protocol specification to obtain structured traffic semantic information, wherein each protocol specification includes the field length and type information of the corresponding protocol type;

[0083] The behavior analysis module is used to match the obtained traffic semantic information with the behavior automaton to obtain application behavior information;

[0084] A fault detection module, used to match the obtained application behavior information with the fields in the corresponding operation specification;

[0085] The display module is used to generate and display security semantic information when the application behavior information matches the corresponding operation specification, and the security semantic information is used to indicate that the application behavior complies with the specification and display the specific content of the application behavior; when the application behavior information does not match the corresponding operation specification, generate, display and report fault semantic information, and the fault semantic information is used to indicate that the application behavior does not comply with the specification and display the specific content of the application behavior and the reason for non-compliance with the specification.

[0086] The description of the above-mentioned device has been explained in detail in the description of the above-mentioned method, and will not be repeated here.

[0087] Figure 5 1900 is a block diagram of an industrial control network fault detection device shown in the present disclosure. For example, the device 1900 can be provided as a server. Figure 5 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0088] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0089] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0090] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0091] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0092] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0093] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0094] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0095] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0096] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0097] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0098] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting faults in an industrial control network, characterized in that: The method comprises: Step 1, obtaining all flow data of the application layer of the industrial control network to be detected in real time; Step 2, determining the protocol type to which each data packet in the acquired traffic data belongs; Step 3: For each data packet, load the protocol specification corresponding to the protocol type to which the data packet belongs, and match the data packet with the protocol field contained in the protocol specification to obtain structured traffic semantic information. Each protocol specification includes the field length and type information corresponding to the protocol type to which it belongs; Step 4, matching the obtained traffic semantic information with the behavior automaton to obtain application behavior information; Step 5, matching the obtained application behavior information with the fields in the corresponding operation specification; Step 6. When the application behavior information matches the corresponding operation specification, display the security semantic information, which is used to indicate that the application behavior complies with the specification, and display the specific content of the application behavior. When the application behavior information does not match the corresponding operation specification, display and report the fault semantic information, which is used to indicate that the application behavior does not comply with the specification, and display the specific content of the application behavior and the reason for non-compliance with the specification.

2. The method according to claim 1, characterized in that Step 1 also includes: Step 11, collecting all traffic data in the industrial control network through a mirror switch, where the traffic data is binary data; Step 12, scanning the industrial control network topology, detecting all terminal devices and switches in the industrial control network, binding each terminal device to the nearest switch virtual LAN identifier, and deduplicating each data packet according to the virtual LAN identifier of the IEEE 802.1Q protocol part of each data packet in the traffic data.

3. The method according to claim 1, characterized in that The flow semantic information includes key-value pairs of key fields of the industrial control application layer protocol. In the process of matching the flow semantic information with the protocol specification, the flow semantic information can be directly accessed through the key fields of the industrial control application layer protocol.

4. The method according to claim 1, characterized in that Step 2 includes: Step 21, the preamble parsing determines the application layer protocol information by combining the transport layer protocol information.

5. The method according to claim 1, characterized in that The method further includes: normalizing and arranging the same type of protocol specifications, and merging the same fields and detection values.

6. The method according to claim 1, characterized in that The method further includes: dividing step 3 and step 4 into different threads, and interactively controlling step 3 and step 4 through a lock-free queue.

7. The method according to claim 1, characterized in that Step 4 includes: Step 41, the behavior automaton matches the fields in the traffic semantic information with the rules, and if a match is found, a state jump is performed internally. The states of the behavior automaton include the behavior formed by a single data packet, the behavior composed of multiple data packets, the single application layer protocol, the multiple application layer protocols, and the state that may trigger a fault; Step 42: If the behavior automaton jumps to a state that may trigger a fault, the fault semantic information is displayed.

8. An industrial control network fault detection system, characterized in that: The system includes computer equipment and an industrial control network; the computer equipment is deployed at the periphery of the industrial control network topology and is used to execute the method described in any one of claims 1 to 7.

9. An industrial control network fault detection device, characterized in that: The device comprises: An acquisition module is used to acquire all flow data of the application layer of the industrial control network to be detected in real time; A classification module, used to determine the protocol type to which each data packet in the acquired traffic data belongs; A parsing module is used to load the protocol specification corresponding to the protocol type to which the data packet belongs for each data packet, and match the data packet with the protocol field contained in the protocol specification to obtain structured traffic semantic information, wherein each protocol specification includes the field length and type information of the corresponding protocol type; The behavior analysis module is used to match the obtained traffic semantic information with the behavior automaton to obtain application behavior information; A fault detection module, used to match the obtained application behavior information with the fields in the corresponding operation specification; A display module is used to display security semantic information when the application behavior information matches the corresponding operation specification, and the security semantic information is used to indicate that the application behavior complies with the specification, and the specific content of the application behavior is displayed; when the application behavior information does not match the corresponding operation specification, the fault semantic information is displayed and reported, and the fault semantic information is used to indicate that the application behavior does not comply with the specification, and the specific content of the application behavior and the reason for non-compliance with the specification are displayed.

10. An industrial control network fault detection device, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 7.

11. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images