Network attack trapping method and system based on industrial control network environment full-scene simulation

Abstract

The invention belongs to the technical field of network security, and discloses a network attack trapping method and system based on industrial control network environment full-scene simulation, and the method monitors and captures all network communication flows of a simulation industrial control virtual machine, carries out the comprehensive monitoring of the internal and external network communication of the virtual machine, and achieves the full-scene simulation of the virtual machine. An industrial control protocol instruction is extracted and analyzed from the captured flow, specific operation content is recognized, and analysis results are converted into structured log information; the system comprises a virtualization management module, a security monitoring module, a flow capture module, an instruction analysis module and a log management module. The targets with similar functions are put in the honeypot system, the industrial control network environment can be simulated more truly through the full-scene simulation technology, and the fidelity and effectiveness of the trapping system are improved.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and in particular, relates to a network attack trapping method and system based on full-scenario simulation of an industrial control network environment. Background Art

[0002] In the trapping system, protocol simulation is a key link, which simulates the behavior of network protocols in the real environment to lure attackers to interact and collect attack information. However, industrial control systems are highly integrated, real-time and complex, and the content of the protocol is not public. Therefore, there are certain challenges in implementing protocol simulation in industrial control environments. Summary of the invention

[0003] The purpose of this application is to overcome the defects of the prior art and to provide a network attack trapping method and system based on full-scene simulation of an industrial control network environment.

[0004] In order to achieve the above objectives, this application provides the following technical solutions:

[0005] In a first aspect, the present application provides a network attack trapping method based on full-scenario simulation of an industrial control network environment, comprising:

[0006] Step 1: Use a virtual machine as the basis for setting up the environment, install industrial control environment-related software, set software running parameters, simulate the industrial control system environment, ensure that the software can work as expected, and reproduce the operating environment of the industrial control protocol;

[0007] Step 2: Monitor key system resources within the industrial computer to ensure timely detection and response to potential security threats;

[0008] Step 3: Monitor and capture all network communication traffic of the simulated industrial control virtual machine, and comprehensively monitor the internal and external network communications of the virtual machine;

[0009] Step 4: Extract and parse the industrial control protocol instructions from the captured traffic, identify the specific operation content, and convert these parsing results into structured log information;

[0010] Step 5: Collect, store, manage, and analyze all log data generated by the threat trapping system and provide detailed log data support.

[0011] Further, step 1 comprises:

[0012] Step 1.1: Configure the hardware resources and software environment of the virtual machine;

[0013] Step 1.2: Configure the network interface for each simulated industrial control virtual machine, assign a virtual IP address, and configure the network connection method;

[0014] Step 1.3: Dynamically adjust resource allocation based on the actual workload of the simulated industrial control virtual machine.

[0015] Further, step 2 includes:

[0016] Step 2.1: Monitor the read, write, and delete operations of all key files in the virtual machine in real time;

[0017] Step 2.2: Monitor the start and end operations of all processes in the simulated industrial control virtual machine in real time, and record the process name, PID, start time and user;

[0018] Step 2.3: Monitor the status of all network ports in real time, record the opening and closing operations of each port, and identify abnormal port behavior.

[0019] Further, step 3 includes:

[0020] Step 3.1: Monitor and capture the communication traffic between the internal processes of the simulated industrial control virtual machine;

[0021] Step 3.2: Capture the communication traffic between services running inside the virtual machine and monitor the network interaction between the industrial control protocol service and other auxiliary services;

[0022] Step 3.3: Capture all traffic data sent by the simulated industrial control virtual machine to the external network in real time;

[0023] Step 3.4: Monitor and capture all traffic data from the external network to the simulated industrial control virtual machine.

[0024] Further, step 4 includes:

[0025] Step 4.1: Identify the type of industrial control protocol used by the data packet by analyzing the header information or specific identifier of the data packet;

[0026] Step 4.2: Parse the header information of the industrial control protocol instruction;

[0027] Step 4.3: The instruction parsing module also has a sensitive operation detection function to identify high-risk operations in industrial control protocols;

[0028] Step 4.4: After the analysis of the industrial control instructions is stored, a structured analysis result log is generated.

[0029] Further, step 5 comprises:

[0030] Step 5.1: Collect log data;

[0031] Step 5.2: The collected log data is stored in a structured manner, using a unified data format and hierarchical storage strategy to ensure the security and long-term availability of the log data.

[0032] In a second aspect, the present application provides a network attack trapping system based on full-scenario simulation of an industrial control network environment, comprising:

[0033] A virtualization management module is used to simulate the actual industrial control system environment so that the simulated industrial control virtual machine reproduces the operating environment of the industrial control protocol;

[0034] Security monitoring module, used to monitor key system resources inside the industrial computer;

[0035] Traffic capture module, used to monitor and capture all network communication traffic of the simulated industrial control virtual machine;

[0036] The instruction parsing module is used to extract and parse industrial control protocol instructions and convert these parsing results into structured log information;

[0037] The log management module is used to collect, store, manage and analyze all log data generated by the system and provide log data support.

[0038] Furthermore, the outbound traffic is monitored through the traffic capture module, and all traffic data sent by the simulated industrial control virtual machine to the external network is captured in real time, including commands, requests or data packets sent by the industrial control protocol service to the external server.

[0039] In a third aspect, the present application provides an electronic device including a memory and a processor, wherein the memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the network attack trapping method based on full-scene simulation of an industrial control network environment is implemented.

[0040] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-readable instructions are stored. When the computer-readable instructions are executed, the network attack entrapment method based on full-scene simulation of an industrial control network environment is implemented.

[0041] Compared with the prior art, the network attack trapping method and system based on full-scenario simulation of industrial control network environment provided by the present application has the following beneficial effects:

[0042] This application places targets with similar functions in the honeypot system. Through full-scenario simulation technology, it can more realistically simulate the industrial control network environment and improve the realism and effectiveness of the trapping system.

[0043] The present application provides an industrial control scenario simulation based on a virtual machine, which is combined with other interactive devices to build a highly simulated environment, thereby attracting attackers to make more in-depth attack attempts, record operations, and infer their intentions.

[0044] In addition, the method provided in this application is a full-scenario simulation trapping method, which is based on a virtual machine and builds common equipment and services in industrial control systems. It also captures the activities of attackers through a detailed monitoring mechanism. It mainly monitors processes, files, registries, network traffic, behavior analysis, and scenario simulation to simulate common operating procedures and device interactions in industrial control systems, thereby attracting attackers to make more in-depth attack attempts. This method can not only improve the security protection capabilities of industrial control networks, but also provide valuable attack intelligence and data analysis support for security teams. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solution of the present application, the following is a brief introduction to the drawings required for the technical description.

[0046] Figure 1 A flowchart of a network attack trapping method based on full-scenario simulation of an industrial control network environment provided in this application;

[0047] Figure 2 Provided for this application

[0048] Figure 3 A schematic diagram of the structure of a network attack trapping system based on full-scenario simulation of an industrial control network environment provided in this application. DETAILED DESCRIPTION

[0049] The following is further explained in detail through specific implementation methods.

[0050] like Figure 1 and Figure 2 As shown, the present application provides a network attack trapping method based on full-scenario simulation of an industrial control network environment, comprising:

[0051] Step 1: Use virtualization technology to simulate the actual industrial control system environment to ensure that the simulated industrial control virtual machine can truly reproduce the operating environment of the industrial control protocol;

[0052] Step 2: Use the probes deployed in the simulated industrial control virtual machine to comprehensively monitor the key system resources inside the industrial control computer to ensure timely detection and response to potential security threats;

[0053] Step 3: Monitor and capture all network communication traffic of the simulated industrial control virtual machine. By comprehensively monitoring the internal and external network communications of the virtual machine, ensure that traffic data related to industrial control behavior is captured in real time, and provide an accurate data basis for subsequent instruction parsing and security analysis.

[0054] Step 4: Extract and parse the industrial control protocol instructions from the captured traffic, identify the specific operation content, and convert these parsing results into structured log information for subsequent security analysis and alarm processing;

[0055] Step 5: Collect, store, manage and analyze all log data generated by the system (threat trapping system) to ensure that the results of all monitoring and analysis activities are fully recorded by the system and provide detailed log data support for security audits, threat analysis and incident response.

[0056] In some embodiments, step 1 comprises:

[0057] Step 1.1: Configure the virtual machine's hardware resources (such as CPU, memory, and storage space) and software environment (such as operating system, industrial control protocol services, etc.) according to specific needs;

[0058] Step 1.2: Configure the network interface for each simulated industrial control virtual machine, assign a virtual IP address, and configure the network connection method (such as NAT, bridging, isolated network, etc.);

[0059] Step 1.3: Dynamically adjust resource allocation based on the actual workload of the simulated industrial control virtual machine.

[0060] In some embodiments, step 2 comprises:

[0061] Step 2.1: Monitor the read, write, and delete operations of all key files in the virtual machine in real time;

[0062] Step 2.2: Monitor the start and end operations of all processes in the simulated industrial control virtual machine in real time, and record the process name, PID, start time and user;

[0063] Step 2.3: Monitor the status of all network ports in real time, record the opening and closing operations of each port, and identify abnormal port behavior.

[0064] In some embodiments, step 3 includes:

[0065] Step 3.1: Monitor and capture the communication traffic between processes inside the simulated industrial control virtual machine, including communication through the local loopback interface (loopback) or shared memory;

[0066] Step 3.2: Capture the communication traffic between services running inside the virtual machine and monitor the network interaction between the industrial control protocol service and other auxiliary services;

[0067] Step 3.3: Capture all traffic data sent by the simulated industrial control virtual machine to the external network in real time, including commands, requests or data packets sent by the industrial control protocol service to the external server;

[0068] Step 3.4: Monitor and capture all traffic data from the external network to the simulated industrial control virtual machine, including requests or responses from external clients to industrial control protocol services.

[0069] In some embodiments, step 4 includes:

[0070] Step 4.1: Identify the type of industrial control protocol used by the data packet by analyzing the header information or specific identifier of the data packet, such as Modbus, DNP3, T2000, etc. This step ensures that the subsequent parsing operation can use the correct parsing rules;

[0071] Step 4.2: Parse the header information of the industrial control protocol instruction, including transaction identifier, function code, data length, etc.

[0072] Step 4.3: Analyze the specific content of the instruction, extract the operation type (such as read, write, query, etc.), operation object (such as register, device status, etc.) and operation parameter (such as data value, address, etc.), and identify high-risk operations in the industrial control protocol;

[0073] Step 4.4: After the parsing of the industrial control instructions is completed, a structured parsing result log will be generated and the log data will be stored.

[0074] In some embodiments, step 5 includes:

[0075] Step 5.1: Collect log data from the system, including outputs from modules such as security monitoring, traffic capture, and command parsing;

[0076] Step 5.2: The collected log data is stored in a structured manner, using a unified data format and hierarchical storage strategy to ensure the security and long-term availability of the log data.

[0077] like Figure 3 As shown, the present application provides a network attack entrapment system based on full-scenario simulation of an industrial control network environment, including a virtualization management module, a security monitoring module, a traffic capture module, an instruction parsing module, and a log management module.

[0078] The virtualization management module is used to simulate the actual industrial control system environment, so that the simulated industrial control virtual machine can reproduce the operating environment of the industrial control protocol. The virtualization module is responsible for creating and managing the entire life cycle of the simulated industrial control virtual machine. The virtualization module simulates the actual industrial control system environment through virtualization technology, ensuring that the simulated industrial control virtual machine can truly reproduce the operating environment of the industrial control protocol and support other modules of the system for effective monitoring and analysis.

[0079] The virtualization management module is used to create virtualization and configure the hardware resources (such as CPU, memory and storage space) and software environment (such as operating system, industrial control protocol services, etc.) of the virtual machine according to specific needs.

[0080] The virtualization management module is used for virtual network configuration: configure the network interface for each simulated industrial control virtual machine, assign a virtual IP address, and configure the network connection method (such as NAT, bridging, isolated network, etc.).

[0081] The virtualization management module is used for resource allocation and monitoring. It dynamically adjusts resource allocation according to the actual workload of the simulated industrial control virtual machine.

[0082] The security monitoring module is used to monitor the key system resources inside the industrial computer. The security monitoring module comprehensively monitors the key system resources inside the industrial computer through the probes deployed in the simulated industrial control virtual machine to ensure timely detection and response to potential security threats. The main functions of the security monitoring module include file monitoring, process monitoring, port monitoring, and registry monitoring (for Windows systems) to ensure the security and stability of the simulation environment.

[0083] The security monitoring module is used for file monitoring. It monitors the read, write, and delete operations of all key files in the virtual machine in real time.

[0084] The security monitoring module is used for process monitoring. It monitors the start and end operations of all processes in the simulated industrial control virtual machine in real time, and records the process name, PID, start time and user.

[0085] The security monitoring module is used for port monitoring. It monitors the status of all network ports in real time, records the opening and closing operations of each port, and identifies abnormal port behavior.

[0086] The traffic capture module is used to monitor and capture all network communication traffic of the simulated industrial control virtual machine. The traffic capture module comprehensively monitors the internal and external network communications of the virtual machine to ensure that the traffic data related to the industrial control behavior can be captured in real time, and provide an accurate data basis for subsequent instruction parsing and security analysis. The main functions of the traffic capture module include internal traffic monitoring, external traffic monitoring, traffic filtering and classification, and traffic log recording.

[0087] The traffic capture module is used to capture inter-process communication. It monitors and captures the communication traffic between processes inside the simulated industrial control virtual machine, including communication through the local loopback interface (loopback) or shared memory.

[0088] The traffic capture module is used for internal service communication monitoring. It captures the communication traffic between services running inside the virtual machine and monitors the network interaction between industrial control protocol services and other auxiliary services.

[0089] The traffic capture module is used for outbound traffic monitoring. It captures all traffic data sent by the simulated industrial control virtual machine to the external network in real time, including commands, requests or data packets sent by the industrial control protocol service to the external server.

[0090] The traffic capture module is used for inbound traffic monitoring. It monitors and captures all traffic data from the external network to the simulated industrial control virtual machine, including requests or responses from external clients to industrial control protocol services.

[0091] The instruction parsing module is used to extract and parse industrial control protocol instructions and convert these parsing results into structured log information. The instruction parsing module extracts and parses industrial control protocol instructions from the captured traffic, identifies the specific operation content, and converts these parsing results into structured log information for subsequent security analysis and alarm processing. The main functions of the instruction parsing module include protocol identification, instruction parsing, sensitive operation detection, parsing result log generation and structured storage.

[0092] The instruction parsing module is used for protocol identification. By analyzing the header information or specific identifiers of the data packet, the type of industrial control protocol used by the data packet is identified, such as Modbus, DNP3, T2000, etc. This function ensures that the subsequent parsing operations can use the correct parsing rules.

[0093] The instruction parsing module is used for protocol parsing. It parses the header information of industrial control protocol instructions, including transaction identifier, function code, data length, etc.

[0094] The instruction parsing module is used to generate and structure the parsing result log. After the instruction parsing module completes the parsing of the industrial control instruction, it will generate a structured parsing result log and store the log data in the system's log management module.

[0095] The log management module is used to collect, store, manage and analyze all log data generated by the system (network attack trapping system) to ensure that the results of all monitoring and parsing activities are fully recorded by the system and provide detailed log data support for security audits, threat analysis and incident response.

[0096] The log management module is used for log management. The log management module centrally collects log data from various sub-modules of the system, including the output of modules such as security monitoring, traffic capture, and instruction parsing.

[0097] The log management module is used for log storage. The log management module is responsible for storing the collected log data in a structured manner, using a unified data format and hierarchical storage strategy to ensure the security and long-term availability of log data.

[0098] In addition, the present application also provides an electronic device, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the above-mentioned network attack entrapment method based on full-scene simulation of an industrial control network environment is implemented.

[0099] In addition, the present application also provides a computer-readable storage medium, on which computer-readable instructions are stored. When the computer-readable instructions are executed, the above-mentioned network attack entrapment method based on full-scene simulation of the industrial control network environment is implemented.

[0100] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0101] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed in the present application should be covered within the protection scope of the present application.

Claims

1. A network attack trapping method based on full-scene simulation of industrial control network environment, characterized in that: include: Step 1: Simulate the industrial control system environment and reproduce the operating environment of the industrial control protocol; Step 2: Monitor key system resources within the industrial computer to ensure timely detection and response to potential security threats; Step 3: Monitor and capture all network communication traffic of the simulated industrial control virtual machine, and comprehensively monitor the internal and external network communications of the virtual machine; Step 4: Extract and parse the industrial control protocol instructions from the captured traffic, identify the specific operation content, and convert these parsing results into structured log information; Step 5: Collect, store, manage, and analyze all log data generated by the system, and provide detailed log data support.

2. The network attack trapping method based on full-scene simulation of industrial control network environment according to claim 1 is characterized in that: Step 1 includes: Step 1.1: Configure the hardware resources and software environment of the virtual machine; Step 1.2: Configure the network interface for each simulated industrial control virtual machine, assign a virtual IP address, and configure the network connection method; Step 1.3: Dynamically adjust resource allocation based on the actual workload of the simulated industrial control virtual machine.

3. The network attack trapping method based on full-scene simulation of industrial control network environment according to claim 1 is characterized in that: Step 2 includes: Step 2.1: Monitor the read, write, and delete operations of all key files in the virtual machine in real time; Step 2.2: Monitor the start and end operations of all processes in the simulated industrial control virtual machine in real time, and record the process name, PID, start time and user; Step 2.3: Monitor the status of all network ports in real time, record the opening and closing operations of each port, and identify abnormal port behavior.

4. The network attack trapping method based on full-scene simulation of industrial control network environment according to claim 1 is characterized in that: Step 3 includes: Step 3.1: Monitor and capture the communication traffic between the internal processes of the simulated industrial control virtual machine; Step 3.2: Capture the communication traffic between services running inside the virtual machine and monitor the network interaction between the industrial control protocol service and other auxiliary services; Step 3.3: Capture all traffic data sent by the simulated industrial control virtual machine to the external network in real time; Step 3.4: Monitor and capture all traffic data from the external network to the simulated industrial control virtual machine.

5. The network attack trapping method based on full-scene simulation of industrial control network environment according to claim 1 is characterized in that: Step 4 includes: Step 4.1: Identify the type of industrial control protocol used by the data packet by analyzing the header information or specific identifier of the data packet; Step 4.2: Parse the header information of the industrial control protocol instruction; Step 4.3: The instruction parsing module also has a sensitive operation detection function to identify high-risk operations in industrial control protocols; Step 4.4: After the analysis of the industrial control instructions is stored, a structured analysis result log is generated.

6. The network attack trapping method based on full-scene simulation of industrial control network environment according to claim 1 is characterized in that: Step 5 includes: Step 5.1: Collect log data; Step 5.2: The collected log data is stored in a structured manner, using a unified data format and hierarchical storage strategy to ensure the security and long-term availability of the log data.

7. A network attack trapping system based on full-scene simulation of industrial control network environment, characterized in that: include: A virtualization management module is used to simulate the actual industrial control system environment so that the simulated industrial control virtual machine reproduces the operating environment of the industrial control protocol; Security monitoring module, used to monitor key system resources inside the industrial computer; Traffic capture module, used to monitor and capture all network communication traffic of the simulated industrial control virtual machine; The instruction parsing module is used to extract and parse industrial control protocol instructions and convert these parsing results into structured log information; The log management module is used to collect, store, manage and analyze all log data generated by the system and provide log data support.

8. The network attack trapping system based on full-scenario simulation of industrial control network environment according to claim 7 is characterized in that: The outbound traffic is monitored through the traffic capture module, and all traffic data sent by the simulated industrial control virtual machine to the external network is captured in real time, including commands, requests or data packets sent by the industrial control protocol service to the external server.

9. An electronic device, characterized in that: It includes a memory and a processor, the memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, it implements the network attack entrapment method based on full-scene simulation of an industrial control network environment as described in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that: Computer-readable instructions are stored in the computer-readable storage medium, and when the computer-readable instructions are executed, the network attack entrapment method based on full-scene simulation of an industrial control network environment as described in any one of claims 1-6 is implemented.

Images