Layered auditing method and device based on message interaction behavior

Abstract

The invention discloses a layered auditing method and device based on message interaction behaviors, and relates to the technical field of industrial control security. The method comprises the following steps: layering according to an OSI model of a message; auditing is carried out according to OSI model layering; a data link layer and a network layer are only responsible for transmitting data and do not carry out auditing and analysis; auditing TCP messages of a transmission layer and a session layer: locking a quintuple, monitoring a full life cycle of the quintuple, recording a handshake condition, a data interaction condition and a link disconnection condition, and performing natural language display on the recorded quintuple condition; for auditing of the application layer, industrial control protocols are classified, key fields are extracted, the interaction situation of the key fields is recorded, and the interaction process is subjected to natural language display; and auditing the transmission layer and the application layer: carrying out fusion auditing on the data of the transmission layer and the application layer to find an abnormal problem. The situation of the whole life cycle can be audited, and possible abnormal situations can be analyzed.

Description

Technical Field

[0001] The present invention relates to the field of industrial control security technology, and in particular to a method and device based on hierarchical auditing of message interaction behaviors. Background Art

[0002] In industrial sites, audit equipment is a tool that effectively records and analyzes on-site flow data. Currently, the content display form of audit equipment is mostly in report format, and the displayed content is not easy for non-professionals to understand. In addition, there are problems such as low display resolution and loss of details. The present invention proposes an audit method based on interactive behavior, which records interactive behaviors for easy viewing and understanding. Summary of the invention

[0003] The present invention provides a method for hierarchical auditing based on message interaction behaviors, comprising:

[0004] Layering according to the OSI model of the message;

[0005] Auditing is performed according to the OSI model layers:

[0006] The data link layer and network layer are only responsible for transmitting data and do not perform auditing or analysis;

[0007] Audit TCP messages at the transport layer and session layer: lock the five-tuple, monitor the entire life cycle of the five-tuple, record the handshake status, data interaction status, link disconnection status, and display the recorded five-tuple status in natural language;

[0008] Auditing at the application layer: classify industrial control protocols, extract key fields and record the interaction of key fields, and display the interaction process in natural language;

[0009] Audit the transport layer and application layer: Conduct a fusion audit of the data at the transport layer and application layer to identify abnormal problems.

[0010] The method for layered auditing based on message interaction behavior as described above, wherein the TCP messages of the transport layer and the session layer are audited, specifically comprises the following sub-steps:

[0011] Lock a quintuple, starting from the SYN that establishes the TCP link, and monitor the entire life cycle of the quintuple;

[0012] Record the handshake of the five-tuple;

[0013] Record the data interaction of the quintuples of normal and abnormal links;

[0014] Record the disconnection of the quintuple link;

[0015] Record the situation where the quintuple is disconnected through rest and record the time;

[0016] Set link abnormality thresholds for the above five-tuple situations respectively, and issue reminders when the thresholds are exceeded;

[0017] The recorded five-tuple situation is displayed in the form of natural language.

[0018] A method for hierarchical auditing based on message interaction behavior as described above, wherein, for a quintuple that completes the three-way handshake normally, the creation time, the link direction, the count of created links, and the time consumption of the three-way handshake are recorded; for a quintuple that does not complete the three-way handshake normally, the creation time, the link direction, the count of created links, and the step completed are recorded.

[0019] A method for hierarchical auditing based on message interaction behavior as described above, wherein recording is performed with different time resolutions and displayed in the form of a curve chart or a bar chart.

[0020] A method based on hierarchical audit of message interaction behavior as described above, wherein the situation of disconnection of a quintuple link includes normal completion of disconnection and failure to complete disconnection normally; the situation of normal completion of disconnection of the quintuple link is recorded, including the time of disconnection of the link, and the time taken for four waves of disconnection; the situation of failure to complete disconnection of the quintuple link is recorded, including the time of disconnection of the link, and the step to which the four waves are carried out.

[0021] The method for hierarchical auditing based on message interaction behavior described above, wherein the auditing at the application layer specifically includes the following sub-steps:

[0022] Classify industrial control protocols;

[0023] Extract key fields of industrial control protocols from different industrial control protocols;

[0024] Record the interaction of key fields;

[0025] Provide natural language display of the interaction process.

[0026] In the method for hierarchical auditing based on message interaction behavior as described above, the interaction record of key fields includes the number, direction and time of interactions.

[0027] The present invention also provides a device for hierarchical auditing based on message interaction behavior, comprising:

[0028] The message layering module is used to layer the messages according to the OSI model;

[0029] Layered audit modules include:

[0030] The transport layer and session layer audit submodules are used to audit the TCP messages at the transport layer and session layer, lock the five-tuple, monitor the entire life cycle of the five-tuple, record the handshake status, data interaction status, link disconnection status, and display the recorded five-tuple status in natural language;

[0031] The application layer audit submodule is used to classify industrial control protocols, extract key fields and record the interaction of key fields, and display the interaction process in natural language;

[0032] The transport layer and application layer fusion audit module is used to perform fusion audit on the transport layer and application layer data to detect abnormal problems.

[0033] The present invention also provides a computer storage medium, characterized in that it comprises: at least one memory and at least one processor;

[0034] The memory is used to store one or more program instructions;

[0035] A processor is used to run one or more program instructions to execute any of the above-mentioned methods for hierarchical auditing based on message interaction behavior.

[0036] The beneficial effects achieved by the present invention are as follows: the present invention can analyze possible abnormal situations through a clear link traffic audit of the entire life cycle, and can display them in a natural language manner, thereby lowering the threshold for users. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0038] Figure 1 This is a flow chart of a method for hierarchical auditing based on message interaction behavior provided in Example 1 of the present application;

[0039] Figure 2 It is a flow chart for auditing TCP messages at the transport layer and session layer;

[0040] Figure 3 It is an audit flowchart for the application layer;

[0041] Figure 4 It is a schematic diagram of a device for hierarchical auditing based on message interaction behavior provided in Example 2 of the present application. DETAILED DESCRIPTION

[0042] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0043] Embodiment 1

[0044] like Figure 1 As shown, the first embodiment of the present invention provides a method for hierarchical auditing based on message interaction behavior, including:

[0045] Step 110, layering according to the OSI model of the message;

[0046] Specifically, the messages are divided into seven layers according to the OSI model (Open System Interconnect), including the physical layer, data link layer, network layer, transport layer, session layer, presentation layer and application layer. Each layer has its specific functions and protocols to ensure the effective transmission and processing of data in the network.

[0047] Step 120: Audit according to the OSI model layering:

[0048] ①The data link layer and network layer are only responsible for transmitting data and do not perform auditing and analysis;

[0049] ② Audit the TCP messages of the transport layer and session layer: lock the five-tuple, monitor the entire life cycle of the five-tuple, record the handshake status, data interaction status, link disconnection status, and display the recorded five-tuple status in natural language;

[0050] ③ Auditing at the application layer: classify industrial control protocols, extract key fields and record the interaction of key fields, and display the interaction process in natural language;

[0051] ④ Conduct integrated audit on the transport layer and application layer: Conduct integrated audit on the data of the transport layer and application layer to identify abnormal problems.

[0052] Specifically, Figure 2 As shown in FIG. 2 , the audit of the TCP messages at the transport layer and the session layer includes the following sub-steps:

[0053] Step 210: lock a quintuple, start from the SYN (handshake signal used when TCP / IP establishes a connection) of the quintuple to establish a TCP link, and monitor the entire life cycle of the whole quintuple;

[0054] The quintuple includes the source IP address, source port, destination IP address, destination port, and transport layer protocol.

[0055] Step 220, record the handshake status of the quintuple;

[0056] For the five-tuple that completes the three-way handshake normally, record the creation time, link direction, link creation count, and the time consumption of the three-way handshake; for the five-tuple that does not complete the three-way handshake normally, record the creation time, link direction, link creation count, and the step completed.

[0057] Step 230, recording the data interaction of the quintuples of normal link completion and abnormal link completion;

[0058] Optionally, the data may be recorded at different time resolutions; for example, the data may be recorded at a one-minute time resolution to record the data flow size generated by the five-tuple every minute, and the data may be displayed in the form of a curve graph or a bar graph.

[0059] Step 240, record the situation where the quintuple link is disconnected;

[0060] The situations where the quintuple disconnection is completed normally and the disconnection is not completed normally are recorded; the situations where the quintuple disconnection is completed normally are recorded, including the time when the connection is disconnected and the time taken for the four waves to disconnect the connection; the situations where the quintuple disconnection is not completed normally are recorded, including the time when the connection is disconnected and the step to which the four waves are performed.

[0061] Step 250, record the situation where the quintuple is disconnected through rest, and record the time;

[0062] Specifically, rest disconnection means that in programming or network communication, when a resource or connection is disconnected, it no longer participates in the current operation or communication process, and the status and time of the resource or connection being disconnected or stopped are recorded.

[0063] Step 260: Set link abnormality thresholds for the above five-tuple situations respectively, and issue a reminder when the threshold is exceeded;

[0064] Specifically, a link abnormality threshold is set for each of the five-tuple situations recorded above, and a reminder is given if a situation exceeds the set link abnormality threshold, such as the completion time threshold of a three-way handshake, the completion time threshold of a four-wave handshake, etc. When the threshold is exceeded, a reminder is given.

[0065] Step 270: Display the recorded quintuple in the form of natural language;

[0066] Specifically, the captured information can be used for natural language translation, making the behavior of each flow more readable.

[0067] The following is an example of auditing the transport layer and the application layer:

[0068] Example 1: The five-tuple sip1, sip2, port1, port2, created a TCP link at 2023-10-2010:10:10, with the link direction sip1->sip2. The link was completed normally, the link process took 0.01S, and the link was disconnected normally through four waves at 2023-10-2011:11:11. There was no abnormality in the interaction process.

[0069] Example 2: A TCP link was created with the five-tuple sip1, sip2, port1, port2 at 2023-10-2010:10:10. The link direction was sip1->sip2. The three-way handshake was not completed, and the SYN from sip1->sip2 was performed. The link process took 0.01 seconds, and the interaction process was abnormal. Since the link was not completed normally, interaction data was generated, and there was a possibility of human attack.

[0070] Example 3: A TCP link was created for the quintuple sip1, sip2, port1, port2 at 2023-10-2010:10:10. The link direction was sip1->sip2. The three-way handshake was not completed, and the SYN from sip1->sip2 was performed. The link process took 0.01S, and the link was disconnected by the reset command at 2023-10-2011:11:11. The sender went from sip1->sip2. The interaction process may be caused by an abnormality in the device of sip1, or there may be an attack and interference on the data flow by the reset command.

[0071] like Figure 3 As shown in the figure, the audit of the application layer includes the following sub-steps:

[0072] Step 310: classify the industrial control protocols;

[0073] Step 320: extracting key fields of industrial control protocols from different industrial control protocols;

[0074] Step 330: Record the interaction of key fields;

[0075] The interaction records of key fields include but are not limited to the number, direction, and time of interactions.

[0076] Step 340: Display the interaction process in natural language;

[0077] For example: the key fields that can be extracted from the modbus protocol include function code, address, checksum, etc.

[0078] Example 1: Device IP1 performed multiple modbus interactions with device IP2 at 2023-10-2010:10:10, during which the operation of reading the coil address 0x11 was performed 1000 times and the operation of writing the coil address 0x11 was performed 500 times, with no abnormalities in the process;

[0079] Example 2: Device IP1 interacted with device IP2 multiple times via Modbus at 2023-10-2010:10:10. The operation of reading the coil address 0x11 was performed 1000 times, and the operation of writing the coil address 0x11 was performed 500 times. If the checksum of the interaction process is incorrect, all operations may fail.

[0080] Example 3: Device IP1 performed multiple modbus interactions with device IP2 at 2023-10-2010:10:10, among which the operation of reading the coil address 0x11 was performed 1000 times and the operation of writing the coil address 0x11 was performed 500 times. Among them, the operation of writing the coil violated the whitelist rules and was all blocked.

[0081] The following are specific examples of auditing the transport layer and application layer:

[0082] Example 1: A large number of industrial protocol interactions are performed without TCP connections, which may be abnormal testing or attacks;

[0083] Example 2: In an industrial protocol with an authentication field, if the authentication field is always an incorrect value during the interaction, there may be an attack, and a brute force cracking attempt is made;

[0084] Example 3: In an industrial protocol with link authentication, if multiple link attempts fail, it indicates that there is a brute force cracking of the link process.

[0085] By adopting the technical solution of the present application, more anomalies or attacks can be determined through the fusion of multiple levels of the OIS model, and the audit analysis of the traffic can be better completed. It can also be presented in natural language with better readability.

[0086] Embodiment 2

[0087] like Figure 4 As shown, the second embodiment of the present invention provides a device for hierarchical auditing based on message interaction behavior, which is characterized by comprising:

[0088] A message layering module 41, used for layering messages according to the OSI model;

[0089] The layered audit module 42 specifically includes:

[0090] The transport layer and session layer audit submodule 421 is used to audit the TCP messages of the transport layer and the session layer, lock the five-tuple, monitor the whole life cycle of the five-tuple, record the handshake situation, data interaction situation, link disconnection situation, and display the recorded five-tuple situation in natural language;

[0091] The application layer audit submodule 422 is used to classify the industrial control protocols, extract key fields and record the interaction of key fields, and display the interaction process in natural language;

[0092] The transport layer and application layer fusion audit module 423 is used to perform fusion audit on the transport layer and application layer data to find abnormal problems.

[0093] Corresponding to the above embodiment, an embodiment of the present invention provides a computer storage medium, including: at least one memory and at least one processor;

[0094] The memory is used to store one or more program instructions;

[0095] A processor is used to run one or more program instructions to execute a method of hierarchical auditing based on message interaction behavior.

[0096] Corresponding to the above-mentioned embodiment, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer storage medium contains one or more program instructions, and the one or more program instructions are used by a processor to execute a method for hierarchical auditing based on message interaction behavior.

[0097] The embodiment disclosed in the present invention provides a computer-readable storage medium, in which computer program instructions are stored. When the computer program instructions are executed on a computer, the computer executes the above-mentioned method of hierarchical auditing based on message interaction behavior.

[0098] In the embodiment of the present invention, the processor may be an integrated circuit security chip having the signal processing capability. The processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0099] The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present invention can be directly embodied as a hardware decoding processor for execution, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The processor reads the information in the storage medium and completes the steps of the above method in combination with its hardware.

[0100] The storage medium may be a memory, which may be, for example, a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memory.

[0101] Among them, the non-volatile memory can be a read-only memory (ROM), a programmable ROM (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory.

[0102] The volatile memory may be a random access memory (RAM) which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM).

[0103] The storage media described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memory.

[0104] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention can be implemented using a combination of hardware and software. When software is used, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of computer programs from one place to another. Storage media can be any available media that can be accessed by general or special-purpose computers.

[0105] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for hierarchical auditing based on message interaction behavior, characterized in that: include: Layering according to the OSI model of the message; Auditing is performed according to the OSI model layers: The data link layer and network layer are only responsible for transmitting data and do not perform auditing or analysis; Audit TCP messages at the transport layer and session layer: lock the five-tuple, monitor the entire life cycle of the five-tuple, record the handshake status, data interaction status, link disconnection status, and display the recorded five-tuple status in natural language; Auditing at the application layer: classify industrial control protocols, extract key fields and record the interaction of key fields, and display the interaction process in natural language; Audit the transport layer and application layer: Conduct a fusion audit of the data at the transport layer and application layer to identify abnormal problems.

2. A method for hierarchical auditing based on message interaction behavior as claimed in claim 1, characterized in that: Auditing TCP messages at the transport layer and session layer includes the following sub-steps: Lock a quintuple, starting from the SYN that establishes the TCP link, and monitor the entire life cycle of the quintuple; Record the handshake of the five-tuple; Record the data interaction of the quintuples of normal and abnormal links; Record the disconnection of the quintuple link; Record the situation where the quintuple is disconnected through rest and record the time; Set link abnormality thresholds for the above five-tuple situations respectively, and issue reminders when the thresholds are exceeded; The recorded five-tuple situation is displayed in the form of natural language.

3. A method for hierarchical auditing based on message interaction behavior as claimed in claim 2, characterized in that: For the five-tuple that completes the three-way handshake normally, record the creation time, link direction, link creation count, and the time consumption of the three-way handshake; for the five-tuple that does not complete the three-way handshake normally, record the creation time, link direction, link creation count, and the step completed.

4. A method for hierarchical auditing based on message interaction behavior as claimed in claim 2, characterized in that: Record at different time resolutions and display in the form of curve graphs or bar graphs.

5. A method for hierarchical auditing based on message interaction behavior as claimed in claim 2, characterized in that: The situations of quintuple link disconnection include normal completion of link disconnection and failure to complete link disconnection normally; Record the situation where the quintuple completes the disconnection normally, including the time of the disconnection and the time taken for the four handshakes to disconnect the link; record the situation where the quintuple does not complete the disconnection normally, including the time of the disconnection and the step of the four handshakes.

6. A method for hierarchical auditing based on message interaction behavior as claimed in claim 1, characterized in that: The audit of the application layer includes the following sub-steps: Classify industrial control protocols; Extract key fields of industrial control protocols from different industrial control protocols; Record the interaction of key fields; Provide natural language display of the interaction process.

7. A method for hierarchical auditing based on message interaction behavior as claimed in claim 6, characterized in that: The interaction records of key fields include the number, direction, and time of interactions.

8. A device for hierarchical auditing based on message interaction behavior, characterized in that: include: The message layering module is used to layer the messages according to the OSI model; Layered audit modules include: The transport layer and session layer audit submodules are used to audit the TCP messages at the transport layer and session layer, lock the five-tuple, monitor the entire life cycle of the five-tuple, record the handshake status, data interaction status, link disconnection status, and display the recorded five-tuple status in natural language; The application layer audit submodule is used to classify industrial control protocols, extract key fields and record the interaction of key fields, and display the interaction process in natural language; The transport layer and application layer fusion audit module is used to perform fusion audit on the transport layer and application layer data to detect abnormal problems.

9. A computer storage medium, characterized in that: include: at least one memory and at least one processor; The memory is used to store one or more program instructions; A processor, used to run one or more program instructions to execute a method for hierarchical auditing based on message interaction behavior as described in any one of claims 1-7.

Images