Hidden path discovery method, device and system and computer readable storage medium

Abstract

The invention provides a method, equipment and system for hidden path discovery in OT safety monitoring and a computer readable storage medium, so as to identify potential hidden paths between different safety areas as much as possible and avoid omission of possible hidden paths. The method may include: receiving IP configuration data of a network connection among an OT network and at least one IT network connected to the OT network from at least one data collector connected to the OT network; identifying a subnet among the OT network and the at least one IT network based on the IP configuration data; determining different security zones among the OT network and the at least one IT network based on the identified subnets; at least one covert path across a first identified subnet and a second identified subnet is discovered, where the first identified subnet belongs to a first determined secure zone and the second identified subnet belongs to a second determined secure zone.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the technical field of OT security monitoring, and in particular, to a method, device, and system for covert path discovery in OT security monitoring, and a computer-readable storage medium. Background Art

[0002] In industrial control systems, industrial control devices work together to control industrial processes. For example, some industrial control devices such as PLCs, industrial hosts, and workstations are connected via a network, which is usually called an OT (operational technology) network to distinguish it from a traditional IT (information technology) network.

[0003] As industrial digitalization progresses, OT networks and IT networks are increasingly interconnected, which may expose OT networks to cyber attacks, malware intrusions, and other types of threats from IT networks.

[0004] Security devices such as firewalls can logically isolate OT networks from IT networks. Physical isolation can also be applied to disrupt threats from IT networks. Using security policies set on security devices, OT networks and connected IT networks can be divided into different security zones, and devices in the same security zone can communicate freely with each other, while devices in different security zones cannot communicate freely with each other.

[0005] However, it is possible to bypass such isolation via covert paths across different security zones. Covert paths, also known as covert channels or hidden channels, are network connections across different security zones that are unknown to the network management system or network administrator. For example, a server with multiple network interface cards deployed on the boundary of an OT network may create a potential access path from an IT network to an OT network. In addition, IoT (Internet of Things) devices used for data collection may also form covert paths across production control systems in the OT network and monitoring systems in the IT network. The network management system is not aware of the covert paths, which may pose a great potential risk to the OT network. Summary of the invention

[0006] In view of this, embodiments of the present disclosure provide a method, device, system, and computer-readable storage medium for covert path discovery in OT security monitoring to discover covert paths across different security zones in an OT network and at least one connected IT network.

[0007] According to a first aspect of an embodiment of the present disclosure, a method for discovering hidden paths in OT security monitoring is provided, and the method can be performed by a central OT security monitoring server. The central OT security monitoring server can be connected to at least one data collector and receive IP configuration data from the at least one data collector; the at least one data collector is connected to an OT network. The method may include the following steps: receiving IP configuration data of a network connection from the at least one data collector, wherein the IP configuration data can be obtained by the at least one data collector from network flow data, IP configuration data of a network interface card installed on an OT device in the OT network, and a log of permitted communications in at least one security device in the OT network; identifying a subnet in the OT network and at least one IT network connected to the OT network based on the IP configuration data; determining different security zones in the OT network and at least one IT network based on the identified subnet; discovering at least one hidden path across a first identified subnet and a second identified subnet, wherein the first identified subnet belongs to a first determined security zone, and the second identified subnet belongs to a second determined security zone.

[0008] According to a second aspect of an embodiment of the present disclosure, a device for hidden path discovery in OT security monitoring is provided, which can be implemented as software installed on a central OT security monitoring server and includes a module for executing the method according to the first aspect of an embodiment of the present disclosure.

[0009] According to a third aspect of an embodiment of the present disclosure, a device for discovering hidden paths in OT security monitoring is provided, and the device may be part of a central OT security monitoring server, or the central OT security monitoring server itself. The device may include: at least one memory configured to store computer executable instructions; at least one processor coupled to the at least one memory and configured to execute the method according to the first aspect of the embodiment of the present disclosure when the computer executable instructions are executed.

[0010] According to a fourth aspect of an embodiment of the present disclosure, a system for hidden path discovery in OT security monitoring is provided, and the system may include: at least one data collector connected to an OT network, the at least one data collector being configured to obtain IP configuration data of network connections between the OT network and at least one IT network connected to the OT network; a central security monitoring center connected to the at least one data collector, wherein the central security monitoring center may include equipment according to the second or third aspect of the embodiment of the present disclosure.

[0011] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, which can be stored on a readable medium of a device and contains computer executable instructions, wherein the computer executable instructions, when executed, cause at least one processor to perform the method according to the first aspect of an embodiment of the present disclosure.

[0012] According to the sixth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein the computer-executable instructions, when executed, enable at least one processor to perform the method according to the first aspect of an embodiment of the present disclosure.

[0013] In an embodiment of the present disclosure, the IP configuration data of the network connection can be timely received from the OT network via the data collector, and the subnet involved in the network connection can be obtained based on the IP configuration data. Based on whether the subnet involved in the network connection belongs to the same security zone, as many potential hidden paths between different security zones as possible can be identified. This can avoid missing possible hidden paths. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly describe the technical solution in the embodiments of the present disclosure or the prior art, the following will briefly introduce the drawings used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments disclosed in the embodiments of the present disclosure. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0015] Figure 1 is a schematic diagram of a system for hidden path discovery in OT security monitoring according to an embodiment of the present disclosure;

[0016] Figure 2 is a flow chart of a method for hidden path discovery in OT security monitoring according to an embodiment of the present disclosure;

[0017] Figure 3 is a schematic diagram of a device for hidden path discovery in OT security monitoring according to an embodiment of the present disclosure.

[0018] Reference numerals in the drawings

[0019] 100: System for discovering hidden paths in OT security monitoring

[0020] 10: Central Security Monitoring Center 20: Data Collector

[0021] 30: OT Network 40: IT Network

[0022] 301: Network device 302: OT device 303: Security device

[0023] 200: Methods for discovering hidden paths in OT security monitoring

[0024] S201: Receiving IP configuration data of network connection

[0025] S202: Identify subnet

[0026] S203: Determine the safe zone

[0027] S2031: Count the number of OT devices involved in the network connection across the two identified subnets

[0028] S2032: If the number of OT devices involved in the network connection across the two identified subnets is less than a predefined threshold, it is determined that the two identified subnets belong to different security zones.

[0029] S2033: Determine different security zones based on the predefined relationship between the security zones and the subnets they contain

[0030] S204: Discovering a hidden path

[0031] S2041: If the network connection across the subnet of the first identifier and the subnet of the second identifier is not permitted by the security policy predefined in the OT network, determine the network connection as a hidden path

[0032] S2042: Determine that a network connection across a first identified subnet and a second identified subnet is a hidden path, wherein the first identified subnet belongs to a first determined security zone and the second identified subnet belongs to a second determined security zone

[0033] 101: Equipment for Hidden Path Discovery in OT Security Monitoring

[0034] 1011: at least one memory 1012: at least one processor 1013: communication module DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and thoroughly described below with reference to the drawings in the embodiments of the present disclosure. It is obvious that the described embodiments are only a part of the embodiments of the present disclosure, not all. All other embodiments obtained by those of ordinary skill in the art based on the embodiments among the embodiments of the present disclosure should be within the protection scope of the embodiments of the present disclosure.

[0036] Hereinafter, specific implementations of the embodiments of the present disclosure will be further described with reference to the accompanying drawings in the embodiments of the present disclosure.

[0037] Figure 1A system 100 for covert path discovery of an OT network is shown.

[0038] Since the hidden path analysis in this disclosure is aimed at OT networks, the methods of data acquisition and hidden path discovery are related to the structure of OT networks. Therefore, first, the common structure of OT networks will be introduced.

[0039] OT Network

[0040] like Figure 1 As shown in , the OT network 30 may include:

[0041] -OT device 302

[0042] OT devices may include industrial controllers, industrial hosts, etc. Industrial controllers may be PLCs (Programmable Logic Controllers), DCS (Distributed Control System) controllers, RTUs (Remote Terminal Units), etc. Industrial hosts may include host computers, such as workstations or servers implemented based on PCs (Personal Computers), such as engineer stations, operator stations, or servers. Industrial hosts may also include HMIs (Human Machine Interfaces). In OT networks, industrial hosts monitor and control industrial controllers. The control industrial controllers may read data from field devices (for example, read status parameters of field devices from sensors), store the data in a historical database, and send control commands to the industrial controllers according to the operator's instructions or according to preset control programs or logic. The engineer station may also configure the industrial controllers.

[0043] - Network device 301

[0044] Data can be transmitted between OT networks using network devices such as switches and routers. For example, network devices can connect industrial controllers to industrial hosts. Currently, more and more OT networks are implemented based on industrial Ethernet, and communications in OT networks can be based on TCP (Transmission Control Protocol), UDP (User Datagram Protocol), and IP (Internet Protocol).

[0045] -Safety device 303

[0046] Security devices can keep the OT network working normally and securely, preventing cyber attacks from outside the OT network, such as attacks from IT networks. As mentioned above, with industrial digitalization, OT networks are connected to IT networks, which expose the OT network to cyber attacks, malware intrusions, and other threats from IT networks. Security policies can be set on security devices to mitigate such risks. Security devices can include firewalls, antivirus software, security gateways, IDS (intrusion detection systems), etc.

[0047] Now, refer to Figure 1, the structure of the system 100 and the method of acquiring data from the OT network 30 will be introduced.

[0048] Structure of system 100

[0049] The system 100 may include a central security monitoring center 10 and at least one data collector 20. The at least one data collector 20 is connected to an OT network 30 to collect network connection data in the OT network 30 and extract IP configuration data of the network connection from the network connection data. The central security monitoring center 10 receives the IP configuration data from the data collector 20 to analyze hidden paths in security monitoring of the OT network 30.

[0050] The central security monitoring center 10 may be implemented as one or more servers that perform security monitoring on the OT network 30. It may receive data about the OT network 30 via the data collector 20, and complete security monitoring based on the data, such as threat analysis, vulnerability scanning, risk assessment, etc. In the present disclosure, the central security monitoring center 10 may receive IP configuration data via the data collector 20, and discover hidden paths among the OT network 30 and at least one IT network 40 connected to the OT network 30 based on the IP configuration data.

[0051] The data collector 20 may be connected to a SPAN (Switched Port Analyzer) port of the network device 301 in the OT network 30 to perform port mirroring so that all packets passing through the port of the network device 301 can be captured. Alternatively, the data collector 20 may be connected to a network tap to obtain packets in the OT network 30. In this way, packets flow from the OT network 30 to the network tap.

[0052] Network connection data

[0053] In this disclosure, network connection data may include but is not limited to:

[0054] - Network flow data

[0055] - IP configuration data of the network interface card installed on the OT device 302

[0056] - Log of permitted communications in the security device 303

[0057] Once the network connection data is obtained, the data collector 20 can extract the IP configuration data of the network connection from the network connection data and send it to the central security monitoring center 10, which will identify the subnet involved in the network connection. The network connection across subnets will be further identified by the central security monitoring center 10. In order to distinguish the filtered network connections, the original network connection derived from the IP configuration data is referred to as the "first network connection" here, and the network connection across the first identified subnet and the second identified subnet filtered from the first network connection is referred to as the "second network connection", where the first identified subnet belongs to the first determined security zone, and the second identified subnet belongs to the second determined security zone.

[0058] Next, for each of the above three types of network connection data, the data collector 20 will perform data collection and IP configuration data extraction. The IP configuration data may include the source IP address and destination IP address of the network connection; optionally, the IP configuration data may also include ports, protocols, subnets and other related information.

[0059] Data collection and IP configuration data extraction

[0060] - Network flow data

[0061] The data collector 20 may collect network flow data and extract IP addresses from the network flow data. Optionally, the data collector may also extract port and protocol related information. An example of the extracted information may include:

[0062] (1) Source IP address

[0063] (2) Destination IP address

[0064] (3) Source port

[0065] (4) Destination port

[0066] (5) Protocols for OT network services

[0067] (6) VLAN tag

[0068] The extracted information, ie, the IP configuration data, will be sent to the central security monitoring center 10 for further analysis. For example, based on the source IP address and the destination IP address, the central security monitoring center 10 can identify the subnet involved in the network connection.

[0069] - IP configuration data of the network interface card installed on the OT device 302

[0070] The data collector 20 may collect host network configuration information and connection information through an agent installed on the OT device 302, and then analyze how many network interface cards are installed on the OT device 302 and which of the network interface cards are active, and then extract the IP configuration data of the active network interface cards. The data collector 20 may obtain IP configuration data, such as IP address and subnet information, through an agent installed on the OT device 302. For example, the data collector may run the command "Ipconfig / all" in the OT device 302 having a Windows operating system to obtain the IP configuration data of the network interface card.

[0071] - Log of permitted communications in the security device 303

[0072] The data collector 20 may obtain a log of permitted communications in a security device 303 such as a firewall, and extract a source IP address and a destination IP address from permitted traffic in the log.

[0073] In addition, the data collector 20 may directly obtain network connection data from the network interface card in the OT device 302. For example, the data collector may run the command "netstat" on the OT device 302 installed with the Windows operating system to obtain network connection data, and the network connection data may contain the following information:

[0074] Source IP address

[0075] Destination IP address

[0076] Source Port

[0077] Destination Port

[0078] Connection Status

[0079] Based on the source IP address and the destination IP address, the central security monitoring center 10 can identify the subnet associated with the network connection. If the connection status of a network connection is "established", it means that there is communication activity.

[0080] Subnet identification and second network connection filtering

[0081] For the first network connection, the subnet identification may depend on the source IP address and the destination IP address. For a class A IP address, if the first 8 bits of the source IP address and the destination IP address are the same, the first network connection is within the subnet; otherwise, the first network connection spans two subnets. For a class B IP address, if the first 16 bits of the source IP address and the destination IP address are the same, the first network connection is within the subnet; otherwise, the first network connection spans two subnets. For a class C IP address, the subnet identification must depend on the IP address and the subnet mask. The XOR of the IP address and its subnet mask is an identifier of the subnet. If the subnet of the source IP address is the same as the destination IP address, the first network connection is within the same subnet; otherwise, the first network connection spans two subnets.

[0082] Next, the second network connection is further screened from the first network connection to obtain network connections spanning subnets in different security zones.

[0083] In the present disclosure, hidden path discovery is based on security zone analysis. The main idea is that if there is a network connection across two subnets belonging to different security zones in the OT network 30 and at least one connected IT network 40, and the network management system or security monitoring is unaware of the existence of the network connection, then the network connection will be determined as a hidden path. Next, a detailed description will be given to introduce two optional schemes for hidden path identification. Typically, a security zone contains at least one subnet, and a subnet belongs to only one specific security zone.

[0084] Solution 1. Safe zone determination and hidden path identification

[0085] In solution 1, according to the security policy in the OT network 30, there is no restriction on the communication between the two subnets. Next, for each two identified subnets, the central security monitoring center 10 may count the number of OT devices 302 involved in the first network connection across the two subnets. If the number of OT devices 302 involved in the first network connection across the two subnets is less than a predefined threshold, the central security monitoring center 10 may determine that the two subnets belong to different security zones.

[0086] For example, for a first network connection with subnet A having an address of "192.168.123.0" and subnet B having an address of "192.168.234.0", a source IP address of "192.168.123.6" and a destination IP address of "192.168.234.3", the subnet masks of the source IP address and the destination IP address are both "255.255.255.0", which means that the OT device 302 involved in the network connection belongs to subnet A and subnet B, respectively (for example, more than one network interface card is installed on the specific OT device 302). Then, the number of OT devices 302 involved in the first network connection across subnet A and subnet B can be increased by 2. Alternatively, if one specific OT device 302 involves several first network connections across subnet A and subnet B, the number of the specific OT device 302 can be added for each first network connection.

[0087] According to the security policy in the OT network 30, there is no restriction on the communication between the two subnets. In such a case, if the number of OT devices 302 involved in the first network connection across subnet A and subnet B is not less than a predefined threshold, subnet A and subnet B will be determined to belong to the same security zone. For example, there are 10 OT devices 302 in subnet A and 10 OT devices 302 in subnet B. If the number of OT devices 302 involved in the network connection across the two subnets is less than 8, it can be determined that the two subnets belong to different security zones.

[0088] It should be noted that although there may not be many OT devices 302 involved in the first network connection across two specific subnets, the two specific subnets may be in the same security zone as another subnet, and the central security monitoring center 10 can determine that the two specific subnets are in the same security zone. For example, according to the above-mentioned method of counting OT devices 302, subnet A and subnet B are in the same security zone, and subnet B and subnet C are in the same security zone. Although there are not many OT devices involved in the first connection across subnets A and C for subnets A and C, it can still be determined that subnets A and C belong to the same security zone as subnet B.

[0089] Using the determined security zone, the central security monitoring center 10 can determine the second network connection as a hidden path if the second network connection is not permitted by the security policy predefined in the OT network 30. As described above, the second network connection spans subnets belonging to different security zones. For example, an OT device 302 having two network interface cards connects to the IT network 40, and the OT network 30 will be considered as an abnormal network connection that is not defined in the security policy of the security device 303.

[0090] For scenario 1, although there is no clear definition of security zones, given that covert paths are often potential and not clearly defined, security zones can be determined by the frequency of communication across subnets combined with the applicable restriction rules for network communication. The more OT devices 302 are involved in the communication across two subnets, the less likely it is that the two subnets belong to different security zones.

[0091] Solution 2: Predefined safe zone and hidden path identification

[0092] Unlike solution 1, in solution 2, the security zone is predefined. That is, whether the subnets belong to the same security zone is predefined. Preferably, the information of the security zone and the included subnets can be stored in a DB, and when a hidden path is found, the information can be read from the DB.

[0093] When discovering a hidden path, if the second network connection crosses subnets belonging to different security zones according to a predefined relationship, the central security monitoring center 10 can determine the second network connection as a hidden path. As described above, the second network connection crosses subnets belonging to different security zones. Using predefined security zones, discovering hidden paths becomes easier.

[0094] For both Scheme 1 and Scheme 2, the central security monitoring center 10 may collect security policies from the security devices 303 via the data collector 20 connected to the network devices 301. Allowed IP addresses and / or subnet information and denied IP addresses and / or subnet information may be explicitly defined in the security policy.

[0095] The central security monitoring center 10 may notify the network administrator of the discovered covert path so as to block the covert path or allow the traffic to pass through a security device 303, such as a firewall.

[0096] In an embodiment of the present disclosure, network connection data can be collected from the OT network in a timely manner via a data collector. Using the network connection data, the network connection can be derived and the subnet involved in the network connection can be obtained. Based on whether the subnet involved in the network connection belongs to the same security zone, as many potential hidden paths between different security zones as possible can be identified. Missing possible hidden paths can be avoided.

[0097] Now, refer to Figure 2 , a method 200 for discovering hidden paths in OT security monitoring will be described. Figure 2 As shown in , the process may include the following steps:

[0098] S201 : Receiving IP configuration data of a network connection among the OT network 30 and at least one IT network 40 connected to the OT network 30 from at least one data collector 20 connected to the OT network 30 .

[0099] Optionally, the IP configuration data may be obtained by at least one data collector 20 from collected network flow data.

[0100] Alternatively, the IP configuration data may include IP configuration data of a network interface card installed on the OT device 302 in the OT network 30 .

[0101] Alternatively, the IP configuration data may be obtained by at least one data collector 20 from a permitted communication log in at least one security device 303 in the OT network.

[0102] S202: Identify subnets in the OT network 30 and at least one IT network 40 based on the IP configuration data.

[0103] S203: Determine different security zones in the OT network 30 and at least one IT network 40 based on the identified subnets.

[0104] S204: Discover at least one covert path that crosses identified subnets belonging to determined different security zones.

[0105] Optionally, step S203 may also include two sub-steps S2031 and S2032. In sub-step S2031, if there is no restriction on the communication between the two subnets according to the security policy in the OT network 30, the number of OT devices 302 involved in the network connection across the two subnets will be counted, and in sub-step S2032, if the number of OT devices 302 involved in the network connection across the two subnets is less than a predefined threshold, it can be determined that the two subnets belong to different security zones. Therefore, step S204 may also include sub-step S2041, in which it can be determined that if the network connection across the first identified subnet and the second identified subnet is not permitted by the security policy predefined in the OT network 30, then the network connection is a hidden path.

[0106] Optionally, step S203 may further include sub-step S2033. In sub-step S2033, different security zones may be determined according to a predefined relationship between a security zone and a subnet contained therein. Therefore, step S204 may further include sub-step S2042. In sub-step S2042, it may be determined that a network connection across a subnet of a first identification and a subnet of a second identification is a covert path, wherein the subnet of the first identification belongs to a first determined security zone and the subnet of the second identification belongs to a second determined security zone. Here, "first" and "second" are used to distinguish two different items.

[0107] Other alternative embodiments of the method 200 may be referenced from the above details of the system 100 .

[0108] Now, refer to Figure 3, we will introduce the equipment 101 for hidden path discovery in OT security monitoring. Figure 3 As shown in , the device 101 may include: at least one memory 1011, which is configured to store computer-executable instructions; and at least one processor 1012, which is coupled to the at least one memory 1011 and is configured to execute the method 200 when the computer-executable instructions are executed. Optionally, the device 101 may also include a communication module 1013, and the device 101 may receive network connection data in the OT network 30 and logs of the security device 303 via the communication module.

[0109] In addition, another device for hidden path discovery in OT security monitoring is provided. The device can be implemented as software installed on a central OT security monitoring server and includes a module for executing the method 200 .

[0110] A computer program product is provided. The computer program product is tangibly stored on a controller-readable medium and contains computer-executable instructions, wherein the computer-executable instructions, when executed, cause at least one processor to perform the method 200 .

[0111] A computer-readable storage medium is provided. The computer-readable medium stores computer-executable instructions thereon, wherein the computer-executable instructions, when executed, cause at least one processor to perform the method 200 .

[0112] It should be noted that, depending on implementation requirements, the components / steps described in the embodiments of the present disclosure may be divided into more components / steps, or two or more components / steps or partial operations of components / steps may be combined into novel components / steps to achieve the objectives of the embodiments of the present disclosure.

[0113] The above method according to the embodiment of the present disclosure may be implemented in hardware or firmware, or implemented as software or computer code that can be stored in a recording medium (e.g., CD ROM, RAM, floppy disk, hard disk or disk), or implemented as a computer code downloaded from a network, initially stored in a remote recording medium or a non-temporary machine-readable medium and to be stored in a local recording medium, so that the method described herein can be processed by such software stored on the recording medium using a general-purpose computer, a dedicated processor or programmable or dedicated hardware (e.g., ASIC or FPGA). It is understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM or flash memory) that can store or receive software or computer code. When a computer, a processor or hardware accesses and executes the software or computer code, the method for generating a checksum described herein is implemented. In addition, when a general-purpose computer accesses a code for implementing the method for generating a checksum shown in this article, the execution of the code converts the general-purpose computer into a dedicated computer configured to execute the method for generating a checksum shown in this article.

[0114] As will be appreciated by those skilled in the art, the various example units and method steps described in conjunction with the embodiments disclosed herein may be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the functions for each specific application, but such implementations should not be considered to exceed the scope of the embodiments disclosed herein.

[0115] The above embodiments are only used to illustrate the embodiments of the present disclosure and are not intended to limit the embodiments of the present disclosure. A person skilled in the art may further make various changes and modifications without departing from the spirit and scope of the embodiments of the present disclosure. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present disclosure, and the patent protection scope of the embodiments of the present disclosure shall be limited by the attached claims.

Claims

1. A method (200) for discovering hidden paths in OT security monitoring, comprising: - receiving (S201) from at least one data collector (20) connected to the OT network (30) IP configuration data of a network connection among the OT network (30) and at least one IT network (40) connected to the OT network (30); - identifying (S202) subnets in the OT network (30) and the at least one IT network (40) based on the IP configuration data; - determining (S203) different security zones in the OT network (30) and the at least one IT network (40) based on the identified subnets; - discovering (S204) at least one covert path across a first identified subnet and a second identified subnet, wherein the first identified subnet belongs to a first determined security zone and the second identified subnet belongs to a second determined security zone.

2. The method (200) according to claim 1, wherein the IP configuration data is obtained by the at least one data collector (20) from network flow data collected in the ot network (30).

3. The method (200) of claim 1, wherein the IP configuration data comprises IP configuration data of a network interface card installed on an OT device (302) in the OT network (30).

4. The method (200) of claim 1, wherein the IP configuration data is obtained by the at least one data collector (20) from a log of permitted communications in at least one security device (303) in the OT network (30).

5. The method according to claim 1, wherein - Determining (S203) different security zones in the OT network (30) and the at least one IT network (40) based on the identified subnets includes: For each two identified subnets, if there is no restriction on communication between the two identified subnets according to the security policy in the OT network (30), then - Counting the number of OT devices (302) involved in the network connection across the two identified subnets (S2031); - if the number of OT devices (302) involved in the network connection across the two identified subnets is less than a predefined threshold, determining (S2032) that the two identified subnets belong to different security zones; - discovering (S204) at least one covert path across the first identified subnet and the second identified subnet comprises: - If the network connection across the first identified subnet and the second identified subnet is not permitted by the security policy predefined in the OT network (30), determining (S2041) the network connection as a covert path.

6. The method (200) of claim 1, wherein - Determining (S203) different security zones in the OT network (30) and the at least one IT network (40) based on the identified subnets includes: - determining (S2033) different security zones according to a predefined relationship between a security zone and a subnet it contains; - discovering (S204) at least one covert path across the first identified subnet and the second identified subnet comprises: - Determining (S2042) that a network connection across the first identified subnet and the second identified subnet is a covert path, wherein the first identified subnet belongs to the first determined security zone and the second identified subnet belongs to the second determined security zone.

7. A device (101) for discovering hidden paths in OT security monitoring, comprising: - at least one memory (1011) configured to store computer executable instructions; - at least one processor (1012) coupled to said at least one memory (1011) and configured, upon execution of said computer executable instructions, to perform a method according to any one of claims 1 to 6.

8. A system (100) for discovering hidden paths in OT security monitoring, comprising: - at least one data collector (20) connected to the OT network (30), the at least one data collector being configured to obtain IP configuration data of network connections among the OT network (30) and at least one IT network (40) connected to the OT network (30); - a central security monitoring center (10) connected to said at least one data collector (20), wherein said central security monitoring center (10) comprises a device (101) according to claim 7.

9. A computer program product stored on a device-readable medium and comprising computer-executable instructions, wherein the computer-executable instructions, when executed, cause at least one processor to perform the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having computer-executable instructions stored thereon, wherein the computer-executable instructions, when executed, cause at least one processor to perform the method according to any one of claims 1 to 6.

Images