An automated network security detection system

Abstract

The present invention relates to the field of communications, and specifically to an automated network security detection system, which collects the real-time execution parameters of multiple actuators on a production line, and then finds actuators with a collaborative relationship based on a collaborative association database. The real-time execution parameters of the actuators with a collaborative relationship are analyzed to determine whether the corresponding reaction time difference between the two meets the collaborative relationship when they are working in real time, that is, whether the time difference meets the historical law. Then, the collaborative relationship is used to determine whether the instructions of the actuator arrive at the scheduled time. The collaborative relationship between the actuators is used to verify whether there are security issues in the production network, so as to promptly discover the anomalies of each link in the production network, prevent the actuator from continuing to operate after the coordination fails, and avoid production accidents caused by coordination failure.

Description

Technical Field

[0001] The invention relates to the field of network security, and in particular to an automatic network security detection system. Background Art

[0002] The network that automated production relies on plays a vital role in modern manufacturing. It connects all links from design, production to monitoring and maintenance, allowing information to be transmitted quickly and accurately between various parts.

[0003] In production scenarios, internal networks are generally used to control various devices to ensure safety and timeliness. However, with the use of remote processes, cloud technology, and complex algorithms, internal networks need to be connected to the cloud to achieve remote control and access to high-computing devices, but this also brings challenges to network security. Existing production equipment has synergy. If the network is attacked or disturbed by external attacks, information will not be sent as scheduled, resulting in the failure of synergy between devices. Continuous operation when synergy fails will cause production accidents.

[0004] In the prior art, network fluctuations are generally monitored to determine whether there are security issues in the network. However, network fluctuation detection can only provide indirect evidence, indicating that there may be delays or packet loss problems. It cannot directly determine whether the instructions can reach the device on time, so the detection effect is poor. Summary of the invention

[0005] In view of this, an object of the present invention is to provide an automated network security detection system to solve the problems in the background technology.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] An automated network security detection system of the present invention comprises:

[0008] An acquisition module, used for acquiring real-time execution parameters of a plurality of actuators in a field device layer of a production network and acquiring a plurality of adjustment instructions of the plurality of actuators, wherein the plurality of actuators include a current actuator;

[0009] A grouping module, configured to determine a plurality of groups of cooperative actuators from a pre-built cooperative association database, wherein the cooperative association database includes a plurality of actuators and cooperative actuators of the plurality of actuators and a reference range of a change time difference, and each group of cooperative actuators includes a first actuator and a second actuator;

[0010] a curve fitting module, configured to construct a first variation curve based on the real-time execution parameters of the first actuator, and to construct a second variation curve based on the real-time execution parameters of the second actuator;

[0011] a time extraction module, configured to extract a change time point of the first change curve and a change time point of the second change curve, and determine an execution reaction time of the first actuator and an execution reaction time of the second actuator based on a plurality of adjustment instructions of the plurality of actuators, the change time point of the first change curve and the change time point of the second change curve;

[0012] The detection module is used to detect the network based on the execution reaction time of the first actuator, the execution reaction time of the second actuator and the reference range of the change time difference to obtain a detection result.

[0013] In one embodiment of the present application, the method for constructing the collaborative association database includes:

[0014] Get historical execution parameters of multiple executors;

[0015] Building change curves of multiple actuators based on historical execution parameters of multiple actuators;

[0016] Extracting a unidirectional change section from the change curve, and determining a change time point and a change type of the change time point from the unidirectional change section, wherein the change time point is a midpoint of the time point of the unidirectional change section, and the change type includes an ascending change and a descending change;

[0017] Align the change curves of any two actuators and calculate the time difference between the change time points of the same order in the two change curves , for order;

[0018] Calculate multiple time differences Variance and mean , and comparing the change types of the change time points of the same order in the change curves of the two actuators;

[0019] In the multiple time differences When the variance of the two actuators is less than a preset variance threshold, and the change types of the change time points with the same order in the change curves of the two actuators are the same or opposite, it is determined that the two actuators have a cooperative relationship;

[0020] Constructing the reference range of the time difference between two actuators in a collaborative relationship ,in, is the range adjustment parameter;

[0021] A collaborative association database is constructed based on multiple groups of actuators with collaborative relationships and the corresponding reference ranges of change time differences.

[0022] In one embodiment of the present application, determining the execution reaction time of the first actuator and the execution reaction time of the second actuator based on the multiple adjustment instructions of the multiple actuators, the change time point of the first change curve, and the change time point of the second change curve includes:

[0023] Parsing a plurality of adjustment instructions of a plurality of actuators to obtain a sending timestamp, and sorting the plurality of adjustment instructions of the same actuator based on the sending timestamp;

[0024] The difference between the change time point of the first change curve and the sending timestamp of the same order in the corresponding executor is calculated to obtain the execution reaction time of the first executor; the difference between the change time point of the second change curve and the sending timestamp of the same order in the corresponding executor is calculated to obtain the execution reaction time of the second executor.

[0025] In an embodiment of the present application, the network is detected based on the execution reaction time of the first actuator, the execution reaction time of the second actuator, and the reference range of the change time difference to obtain a detection result, including:

[0026] Calculate the time difference between the execution reaction time of the first actuator and the execution reaction time of the second actuator of all the same order ;

[0027] Calculate multiple time differences The average and variance , the variance The variance is compared with the preset threshold and the is greater than a preset variance threshold, or the average value If the network link of the first actuator and the network link of the second actuator are not within the reference range of the change time difference, both the network link of the first actuator and the network link of the second actuator are marked as candidate abnormal links. ;

[0028] The abnormal link is determined based on all candidate abnormal links and the collaborative association database.

[0029] In one embodiment of the present application, determining an abnormal link based on all candidate abnormal links and the collaborative association database includes:

[0030] Determine the distribution of candidate abnormal links;

[0031] When all actuator links in the production network are candidate abnormal links, it is determined that an upper link of the level where the actuator is located has an abnormality;

[0032] When some actuator links in the production network are candidate abnormal links, all candidate abnormal links are calculated to perform connectivity tests to obtain test results; and abnormal links are determined based on the test results.

[0033] In an embodiment of the present application, extracting the change time point of the first change curve and the change time point of the second change curve includes:

[0034] Extracting a top inflection point and a bottom inflection point in the first change curve and the second change curve;

[0035] Extracting a unidirectional change section based on the top inflection point and the bottom inflection point;

[0036] The center point of the time period of the unidirectional change section is taken as the change time point.

[0037] In an embodiment of the present application, constructing a first change curve based on the real-time execution parameters of the first actuator, and constructing a second change curve based on the real-time execution parameters of the second actuator, includes:

[0038] Mapping the real-time execution parameters of the first actuator or the second actuator into a two-dimensional coordinate system to obtain a plurality of data points in the two-dimensional coordinate system, wherein the real-time execution parameters include parameter operation values ​​at a plurality of time points, the horizontal axis of the two-dimensional coordinate system is the time axis, and the vertical axis of the two-dimensional coordinate system is the parameter axis;

[0039] Curve fitting is performed on a plurality of data points in the two-dimensional coordinate system to obtain a first change curve or a second change curve.

[0040] In one embodiment of the present application, it also includes:

[0041] When an upper link of the level where the executor is located is abnormal, a connectivity test is performed on the upper link of the level where the executor is located.

[0042] In one embodiment of the present application, it also includes:

[0043] When some actuator links in the production network are candidate abnormal links, or when an upper link at the level where the actuator is located has an abnormality, abnormal information of the abnormal link is sent to the target object, wherein the abnormal information includes multiple time differences of the execution reaction time of the first actuator and the execution reaction time of the second actuator. and a reference range of a time difference between the first actuator and the second actuator.

[0044] In one embodiment of the present application, the real-time execution parameters include operating parameter values ​​of the actuator at the current time point and multiple time points before the current time point.

[0045] The beneficial effects of the present invention are as follows: an automated network security detection system of the present invention collects the real-time execution parameters of multiple actuators on the production line, and then finds the actuators with a collaborative relationship based on a collaborative association database. The real-time execution parameters of the actuators with a collaborative relationship are analyzed to determine whether the corresponding reaction time difference between the two meets the collaborative relationship when they are working in real time, that is, whether the time difference meets the historical law. Then, the above-mentioned collaborative relationship is used to determine whether the instructions of the actuator arrive at the scheduled time. The collaborative relationship between the actuators is thus used to verify whether there are security issues in the production network, so as to promptly discover the anomalies of each link in the production network, prevent the actuator from continuing to operate after the collaborative failure, and avoid production accidents caused by the collaborative failure. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The present invention will be further described below in conjunction with the accompanying drawings and embodiments:

[0047] Figure 1 It is an application scenario diagram of the automated network security detection system shown in one embodiment of the present application;

[0048] Figure 2 is a structural diagram of an automated network security detection system shown in one embodiment of the present application;

[0049] Figure 3 The process of constructing a collaborative association database in an embodiment of the present application;

[0050] Figure 4 A schematic diagram of a reaction time calculation process in an embodiment of the present application;

[0051] Figure 5 This is a schematic diagram of the process of detecting a network based on collaborative verification in this application. DETAILED DESCRIPTION

[0052] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0053] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show the layers related to the present invention rather than being drawn according to the number, shape and size of the layers in actual implementation. In actual implementation, the type, quantity and proportion of each layer may be changed arbitrarily, and the layer layout may also be more complicated.

[0054] In the following description, numerous details are discussed to provide a more thorough explanation of embodiments of the present invention; however, it is apparent to one skilled in the art that embodiments of the present invention may be practiced without these specific details.

[0055] Figure 1 is an application scenario diagram of an automated network security detection system shown in an embodiment of the present application, such as Figure 1 As shown, this application is mainly used in automated production scenarios, such as Figure 1 As shown, the automated production network in this application mainly includes the actuators of various automated production equipment, etc. The above equipment is connected to a router or switch through a network cable; the router or switch is connected to the upper-level switch, and finally connected to the gateway device by a three-layer switch, and connected to the external network through the gateway device. In the control technology based on remote control or cloud computing, the data collected by the sensor is sent to the server in the cloud through the above network structure. The server in the cloud performs calculations through relevant algorithms, obtains control or adjustment instructions, and sends them to the actuator.

[0056] This application intercepts the adjustment instructions sent by the server from the external network through another data link, and at the same time obtains the corresponding real-time execution parameters of the actuator from the actuator's sensor to perform real-time detection of the coordinated action of the actuator, so as to timely discover the coordination failure problem between the actuators.

[0057] Figure 2 is a structural diagram of an automated network security detection system shown in an embodiment of the present application, such as Figure 2 As shown: An automated network security detection system of this embodiment includes:

[0058] An acquisition module 210, configured to acquire real-time execution parameters of a plurality of actuators in a field device layer of a production network and to acquire a plurality of adjustment instructions of the plurality of actuators, wherein the plurality of actuators include a current actuator;

[0059] This application is mainly used in the production field. Taking the production line as an example, the conveyor belt in the production line is associated with the actuators of the upstream sorting equipment and the downstream production equipment. Therefore, this application obtains the real-time operating parameters of multiple actuators in the production line through sensors or reading the parameters of the equipment itself. For example, the motor speed, the stroke of the pneumatic actuator, etc.

[0060] A grouping module 220, configured to determine a plurality of groups of cooperative actuators from a pre-built cooperative association database, wherein the cooperative association database includes a plurality of actuators and cooperative actuators of the plurality of actuators and a reference range of a change time difference, and each group of cooperative actuators includes a first actuator and a second actuator;

[0061] Since it is common for the equipment in a production line to have a collaborative relationship, but there are many equipment in the production line, it is difficult to directly infer the specific collaborative relationship, execution order, time difference and other parameters from the physical structure of the production line. Therefore, this application analyzes the entire production line based on the historical execution parameters of the equipment to obtain a collaborative association database. Figure 3 This is the construction process of the collaborative association database in an embodiment of the present application, such as Figure 3 As shown in FIG. 1 , the construction process of the collaborative relational database specifically includes:

[0062] S221, obtaining historical execution parameters of multiple executors;

[0063] The historical execution parameters are operating parameter values ​​at multiple time points in one or more production cycles, for example, the speed values ​​of a motor at N sampling time points in a production cycle; the historical execution parameters here are reference data that have been manually checked.

[0064] S222, constructing change curves of multiple actuators based on historical execution parameters of the multiple actuators;

[0065] Since sensors generally use a timed acquisition method when collecting data, the historical execution parameters obtained are discrete. In order to facilitate analysis, this application converts them into continuous curves and then performs analysis.

[0066] The present application adopts a curve fitting algorithm to fit the historical execution parameters into a change curve. The fitting algorithm may adopt the least squares method, spline curve fitting, etc.

[0067] S223, extracting a unidirectional change segment from the change curve, and determining a change time point and a change type of the change time point from the unidirectional change segment, wherein the change time point is a midpoint of the time point of the unidirectional change segment, and the change type includes an upward change and a downward change;

[0068] Among them, the one-way change section reflects the change in execution parameters generated when the actuator actually moves after the adjustment instruction is sent to the actuator. For example, after the cylinder stroke adjustment instruction from the server takes effect, the air pump adjustment causes the cylinder stroke to change, and the sensor detects that the execution parameters of the actuator (cylinder) have changed. This application mainly extracts this dynamic process as the response time period of the actuator.

[0069] Since the response time periods of the actuator in multiple execution responses are roughly the same, a representative time point is selected for time difference analysis, and this change time point can be the midpoint of the time points of the unidirectional change section.

[0070] In one embodiment of the present application, the extraction of the unidirectional change segment can be performed by sequentially differentiating the curve to find the rising or falling segment, or by extracting the upper and lower inflection points by inflection point extraction, and using the upper and lower inflection points to extract the rising segment or the falling segment.

[0071] S224, aligning the change curves of any two actuators, and calculating the time difference of the change time points of the same order in the two change curves , for order;

[0072] In this embodiment, in order to find out whether the adjustment actions between the actuators are synchronized, the time difference between the corresponding change time points of any two actuators is calculated. If the time difference distribution is relatively uniform, it means that there is a fixed rule. In some cases, the coordination between the actuators is in a sequence, so there is no limit on the size of the time difference. It is only necessary to determine whether its uniformity meets the requirements.

[0073] S225, calculating multiple time differences Variance and mean , and comparing the change types of the change time points of the same order in the change curves of the two actuators;

[0074] In this embodiment, for the multiple time differences obtained by calculation, their uniformity is analyzed by calculating their variances. The calculation of the variance is a prior art and will not be described in detail here.

[0075] S226, in the plurality of time differences When the variance of the two actuators is less than a preset variance threshold, and the change types of the change time points with the same order in the change curves of the two actuators are the same or opposite, it is determined that the two actuators have a cooperative relationship;

[0076] In this embodiment, when the variance is relatively small, it indicates that the uniformity is high and there is a synergistic regularity in the execution actions between the two actuators. In addition, there also needs to be a corresponding relationship in the change types, so the change types need to be the same or opposite.

[0077] S227, constructing a reference range of the time difference between two actuators in a coordinated relationship ,in, is the range adjustment parameter;

[0078] S228, constructing a collaborative association database based on multiple groups of actuators having collaborative relationships and corresponding reference ranges of change time differences.

[0079] Finally, if it is determined that there is a synergistic relationship between the two actuators, a reference range based on historical data is constructed based on the mean and variance extracted in the previous text. A synergistic association database is constructed based on the synergistic relationship and the reference range as a reference database.

[0080] After obtaining the collaborative association database, all actuator groups with collaborative relationships are extracted from the collaborative association database as analysis objects, so as to determine whether the adjustment actions of the actuators with collaborative relationships in the current time period meet the collaborative law.

[0081] A curve fitting module 230, configured to construct a first variation curve based on the real-time execution parameters of the first actuator, and to construct a second variation curve based on the real-time execution parameters of the second actuator;

[0082] In this embodiment, the real-time execution parameters are also converted into a change curve to facilitate subsequent analysis, which specifically includes:

[0083] Mapping the real-time execution parameters of the first actuator or the second actuator into a two-dimensional coordinate system to obtain a plurality of data points in the two-dimensional coordinate system, wherein the real-time execution parameters include parameter operation values ​​at a plurality of time points, the horizontal axis of the two-dimensional coordinate system is the time axis, and the vertical axis of the two-dimensional coordinate system is the parameter axis;

[0084] Curve fitting is performed on a plurality of data points in the two-dimensional coordinate system to obtain a first change curve or a second change curve.

[0085] The curve fitting principle is as described above and will not be elaborated here.

[0086] a time extraction module 240, configured to extract a change time point of the first change curve and a change time point of the second change curve, and determine an execution reaction time of the first actuator and an execution reaction time of the second actuator based on a plurality of adjustment instructions of the plurality of actuators, the change time point of the first change curve and the change time point of the second change curve;

[0087] In this embodiment, the extraction principle of the change time point of the first change curve and the change time point of the second change curve is similar to the above, specifically including: extracting the top inflection point and the bottom inflection point in the first change curve and the second change curve; extracting the unidirectional change segment based on the top inflection point and the bottom inflection point; and taking the center point of the time period of the unidirectional change segment as the change time point.

[0088] The execution response time is the difference between the instruction issuance time and the actual execution time of the executor. The response time is calculated in real time and stored in the memory as the data basis for network security analysis. Figure 4 FIG. 1 is a schematic diagram of a reaction time calculation process in an embodiment of the present application. Figure 4 The specific process includes:

[0089] S241, parsing a plurality of adjustment instructions of a plurality of actuators to obtain a sending timestamp, and sorting the plurality of adjustment instructions of the same actuator based on the sending timestamp;

[0090] The adjustment instruction contains the actuator identification code (routing information), the sending timestamp, the adjustment content, etc. When the system receives the adjustment instruction, it parses the above information and forwards it, so that the corresponding actuator executes according to the adjustment instruction. When calculating the reaction time, it is necessary to parse the sending timestamp as a reference time. .

[0091] S242, calculate the difference between the change time point of the first change curve and the sending timestamp of the same order in the corresponding executor to obtain the execution reaction time of the first executor; calculate the difference between the change time point of the second change curve and the sending timestamp of the same order in the corresponding executor to obtain the execution reaction time of the second executor.

[0092] In this application, the reaction time is the difference between the actual execution time and the issued timestamp. Since real-time calculation is adopted, there is no need to align on the time axis. It only needs to be calculated in real time in sequence.

[0093] The detection module 250 is used to detect the network based on the execution reaction time of the first actuator, the execution reaction time of the second actuator and the reference range of the change time difference to obtain a detection result.

[0094] After obtaining the real-time reaction time of the first actuator and the second actuator, the synergy verification can be performed based on the real-time reaction time. In this application, the analysis is not performed after a certain number of reaction times are accumulated, but based on the real-time calculation results. For example, it is set to use the current 5 reaction times to perform synergy analysis. That is, the synergy analysis is performed using the 5 reaction times closest to the current time, and a network test is performed every time the reaction time is updated. This meets the timeliness of network detection.

[0095] Figure 5 This is a schematic diagram of the process of the collaborative verification detection network in this application, such as Figure 5 Specifically, the process of performing coordination verification and network detection based on the above data includes:

[0096] S251, calculating the time difference between the execution reaction time of the first actuator and the execution reaction time of the second actuator of all the same order ;

[0097] The synergy is mainly reflected by the time difference between the reactions. Therefore, the time difference between the execution reaction time of the first actuator and the execution reaction time of the second actuator is first calculated. .

[0098] S252, calculating multiple time differences The average and variance , the variance The variance is compared with the preset threshold and the is greater than a preset variance threshold, or the average value If the network link of the first actuator and the network link of the second actuator are not within the reference range of the change time difference, both the network link of the first actuator and the network link of the second actuator are marked as candidate abnormal links. ;

[0099] For the current N time differences, calculate their average value and variance The variance reflects the stability of the collaboration. The larger the variance, the more unstable the difference in reaction time is, and there may be network fluctuations. Reflecting the overall situation, if the average If the time difference does not fall within the reference range of the variation time difference, it may be that there is a delay in the network link of the first actuator or there is a delay in the network link of the second actuator, resulting in a delay in the execution time of one of the actuators.

[0100] S253: Determine an abnormal link based on all candidate abnormal links and the collaborative association database.

[0101] Finally, since the analysis is performed in pairs in the previous article, and since the abnormal link needs to be found accurately, further logical reasoning and network testing are required, including:

[0102] S2531, determining the distribution of candidate abnormal links;

[0103] S2532, when all executor links in the production network are candidate abnormal links, determining that an upper-level link at the level where the executor is located has an abnormality;

[0104] If all the links at the end have fluctuations, delays and other abnormalities, then there may be a problem with the upper-level network. The upper-level link here can be the link corresponding to the upper-level switch, or it can be the network link corresponding to the server and the internal network. At this time, it is necessary to notify the network administrator to perform a connectivity test on the upper-level link at the level where the actuator is located. This will determine the problem and avoid continuous operation when the equipment fails to work together.

[0105] S2532, when some executor links in the production network are candidate abnormal links, all candidate abnormal links are calculated to perform connectivity tests to obtain test results; and abnormal links are determined based on the test results.

[0106] Among them, the network connectivity test includes hardware connectivity test and software connectivity test, but generally the hardware connectivity test does not appear. Therefore, the software connectivity test is performed by default, including protocol configuration check, PING test, Traceroute test, etc. The above tests can be automatically executed through scripts, and the results can be fed back to relevant personnel.

[0107] In addition, when some actuator links in the production network are candidate abnormal links, or when an upper link at the level where the actuator is located has an abnormality, abnormal information of the abnormal link is sent to the target object, wherein the abnormal information includes multiple time differences of the execution reaction time of the first actuator and the execution reaction time of the second actuator. and a reference range of a time difference between the first actuator and the second actuator.

[0108] When there is an abnormal link, an alarm mechanism needs to be triggered, that is, the abnormal information is fed back to the target object (manager). It plays a role in timely reminding the failure of coordination. The manager can decide whether to suspend the production line for maintenance based on the abnormal information.

[0109] In summary, an automated network security detection system of the present invention collects the real-time execution parameters of multiple actuators on the production line, and then finds the actuators with a collaborative relationship based on a collaborative association database. The real-time execution parameters of the actuators with a collaborative relationship are analyzed to determine whether the corresponding reaction time difference between the two meets the collaborative relationship when they are working in real time, that is, whether the time difference meets the historical law. Then, the above-mentioned collaborative relationship is used to determine whether the instructions of the actuator arrive at the scheduled time. The collaborative relationship between the actuators is thus used to verify whether there are security issues in the production network, so as to promptly discover the anomalies of each link in the production network, prevent the actuator from continuing to operate after the coordination fails, and avoid production accidents caused by coordination failure.

[0110] This embodiment further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, any one of the methods in this embodiment is implemented, wherein the method is the execution logic of this system.

[0111] This embodiment also provides an electronic terminal, including: a processor and a memory;

[0112] The memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the terminal executes any one of the methods in this embodiment.

[0113] The computer-readable storage medium in this embodiment can be understood by ordinary technicians in this field: all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to the computer program. The aforementioned computer program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes.

[0114] The electronic terminal provided in this embodiment includes a processor, a memory, a transceiver and a communication interface. The memory and the communication interface are connected to the processor and the transceiver and complete communication with each other. The memory is used to store computer programs, the communication interface is used to communicate, and the processor and the transceiver are used to run computer programs so that the electronic terminal executes each step of the above method.

[0115] In this embodiment, the memory may include a random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0116] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0117] In the above-mentioned embodiments, although the present invention has been described in conjunction with the specific embodiments of the present invention, many replacements, modifications and variations of these embodiments will be apparent to those of ordinary skill in the art based on the foregoing description. The embodiments of the present invention are intended to cover all such replacements, modifications and variations falling within the broad scope of the appended claims.

[0118] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. An automated network security detection system, characterized in that: include: An acquisition module, used for acquiring real-time execution parameters of a plurality of actuators in a field device layer of a production network and acquiring a plurality of adjustment instructions of the plurality of actuators, wherein the plurality of actuators include a current actuator; A grouping module is used to determine multiple groups of collaborative actuators from a pre-constructed collaborative association database, wherein the collaborative association database includes multiple actuators and collaborative actuators of multiple actuators and a reference range of change time difference, and each group of collaborative actuators includes a first actuator and a second actuator; the method for constructing the collaborative association database includes: obtaining historical execution parameters of multiple actuators; constructing change curves of multiple actuators based on the historical execution parameters of multiple actuators; extracting a unidirectional change segment from the change curve, and determining a change time point and a change type of the change time point from the unidirectional change segment, wherein the change time point is the midpoint of the time point of the unidirectional change segment, and the change type includes an upward change and a downward change; aligning the change curves of any two actuators, and calculating the time difference between change time points of the same order in the two change curves. , For order; calculate multiple time differences Variance and mean , and compare the change types of the change time points of the same order in the change curves of the two actuators; in the multiple time differences When the variance of the two actuators is less than the preset variance threshold, and the change types of the change time points with the same order in the change curves of the two actuators are the same or opposite, it is determined that the two actuators have a cooperative relationship; and a reference range of the change time difference of the two actuators having a cooperative relationship is established. ,in, A collaborative association database is constructed based on multiple groups of actuators with collaborative relationships and corresponding reference ranges of change time differences; a curve fitting module, configured to construct a first variation curve based on the real-time execution parameters of the first actuator, and to construct a second variation curve based on the real-time execution parameters of the second actuator; a time extraction module, configured to extract a change time point of the first change curve and a change time point of the second change curve, and determine an execution reaction time of the first actuator and an execution reaction time of the second actuator based on a plurality of adjustment instructions of the plurality of actuators, the change time point of the first change curve and the change time point of the second change curve; a detection module, configured to detect the network based on the execution reaction time of the first actuator, the execution reaction time of the second actuator, and the reference range of the change time difference, and obtain the detection result; detecting the network based on the execution reaction time of the first actuator, the execution reaction time of the second actuator, and the reference range of the change time difference, and obtaining the detection result, including: calculating the time difference of the execution reaction time of the first actuator and the execution reaction time of the second actuator in the same order; ; Calculate multiple time differences The average and variance , the variance The variance is compared with the preset threshold and the is greater than a preset variance threshold, or the average value If the network link of the first actuator and the network link of the second actuator are not within the reference range of the change time difference, both the network link of the first actuator and the network link of the second actuator are marked as candidate abnormal links. ; Determine the abnormal link based on all candidate abnormal links and the collaborative association database.

2. An automated network security detection system according to claim 1, characterized in that: Determining the execution reaction time of the first actuator and the execution reaction time of the second actuator based on the multiple adjustment instructions of the multiple actuators, the change time point of the first change curve and the change time point of the second change curve includes: Parsing a sending timestamp from a plurality of adjustment instructions of a plurality of actuators, and sorting the plurality of adjustment instructions of the same actuator based on the sending timestamp; The difference between the change time point of the first change curve and the sending timestamp of the same order in the corresponding executor is calculated to obtain the execution reaction time of the first executor; the difference between the change time point of the second change curve and the sending timestamp of the same order in the corresponding executor is calculated to obtain the execution reaction time of the second executor.

3. The automated network security detection system according to claim 1, characterized in that: Determining an abnormal link based on all candidate abnormal links and the collaborative association database includes: Determine the distribution of candidate abnormal links; When all actuator links in the production network are candidate abnormal links, it is determined that an upper link of the level where the actuator is located has an abnormality; When some actuator links in the production network are candidate abnormal links, a connectivity test is performed on all candidate abnormal links to obtain a test result; and the abnormal link is determined based on the test result.

4. The automated network security detection system according to claim 1, characterized in that: Extracting the change time point of the first change curve and the change time point of the second change curve includes: Extracting a top inflection point and a bottom inflection point in the first change curve and the second change curve; Extracting a unidirectional change section based on the top inflection point and the bottom inflection point; The center point of the time period of the unidirectional change section is taken as the change time point.

5. The automated network security detection system according to claim 1, characterized in that: Constructing a first change curve based on the real-time execution parameter of the first actuator, and constructing a second change curve based on the real-time execution parameter of the second actuator, including: Mapping the real-time execution parameters of the first actuator or the second actuator into a two-dimensional coordinate system to obtain a plurality of data points in the two-dimensional coordinate system, wherein the real-time execution parameters include parameter operation values ​​at a plurality of time points, the horizontal axis of the two-dimensional coordinate system is the time axis, and the vertical axis of the two-dimensional coordinate system is the parameter axis; Curve fitting is performed on a plurality of data points in the two-dimensional coordinate system to obtain a first change curve or a second change curve.

6. The automated network security detection system according to claim 3, characterized in that: Also includes: When an upper link of the level where the executor is located is abnormal, a connectivity test is performed on the upper link of the level where the executor is located.

7. The automated network security detection system according to claim 1, characterized in that: Also includes: When some actuator links in the production network are candidate abnormal links, or when an upper link at the level where the actuator is located has an abnormality, abnormal information of the abnormal link is sent to the target object, wherein the abnormal information includes multiple time differences of the execution reaction time of the first actuator and the execution reaction time of the second actuator. and a reference range of a time difference between the first actuator and the second actuator.

8. The automated network security detection system according to claim 1, characterized in that: The real-time execution parameters include operating parameter values ​​of the actuator at the current time point and at multiple time points before the current time point.

Images