Device network monitoring method, apparatus, device, and storage medium

Abstract

The application relates to a device network monitoring method and device, computer equipment, a storage medium and a computer program product, and relates to the technical field of information security. The method comprises the following steps: obtaining an associated data packet of a device network; in the case that the associated data packet has not accessed the device network, obtaining original data features, and monitoring the original data features through a preset white list to obtain a first monitoring result; in the case that the associated data packet has accessed the network, obtaining interaction behavior features after the associated data packet has accessed the device network, and monitoring the interaction behavior features through the white list to obtain a second monitoring result; and obtaining a monitoring result of the device network based on the first monitoring result and the second monitoring result; wherein the white list is generated based on an attack chain model corresponding to the device network, and the attack chain model is obtained based on historical attack records. The method can improve monitoring accuracy and save monitoring resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a device network monitoring method and device, computer equipment, a storage medium and a computer program product. BACKGROUND

[0002] With the rapid development of industrial Ethernet technology and computer technology, banks introduce industrial control computers into various production environments for realizing automatic production and improving production efficiency. As the core of the control function of an industrial control system, the industrial control computer connects an upper information network and a bottom production network and faces multiple security threats from the external Internet and the internal industrial control network.

[0003] Currently, in the aspect of financial industrial control security monitoring, the measures taken still remain traditional protection means such as boundary isolation, and the security monitoring of the financial industrial control device network is not accurate enough, and the monitoring resource consumption is large. SUMMARY

[0004] Therefore, it is necessary to provide a device network monitoring method, device, computer equipment, computer readable storage medium and computer program product capable of monitoring a device network in view of the above technical problems.

[0005] In a first aspect, the present application provides a device network monitoring method. The method comprises:

[0006] obtaining an associated data packet of a device network;

[0007] In the case where the associated data packet has not accessed the device network, obtaining original data features of the associated data packet, and monitoring the original data features through a preset white list to obtain a first monitoring result of the associated data packet;

[0008] In the case where the associated data packet has accessed the device network, obtaining interaction behavior features of the associated data packet after accessing the device network, and monitoring the interaction behavior features through the white list to obtain a second monitoring result of the associated data packet;

[0009] obtaining a monitoring result of the device network based on the first monitoring result and the second monitoring result; wherein the white list is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

[0010] In an embodiment, the original data features of the associated data packet are obtained by:

[0011] performing data grabbing and parsing on the associated data packet to obtain target field contents corresponding to different network levels of the associated data packet; and taking the target field contents as the original data features of the associated data packet.

[0012] In one embodiment, the target field content corresponding to different network levels of the associated data packet is obtained, including:

[0013] The length of the associated data packet is obtained from the data frame corresponding to the physical layer of the associated data packet; the source physical address, the destination physical address, and the network layer protocol of the associated data packet are obtained from the Ethernet frame corresponding to the link layer of the associated data packet; the source Internet protocol address, the destination Internet protocol address, and the transport layer protocol of the associated data packet are obtained from the Internet protocol data packet corresponding to the network layer of the associated data packet; the source port and the destination port of the associated data packet are obtained from the message corresponding to the transport layer of the associated data packet; the source address, the destination address, the source port, the destination port, and the command number corresponding to the industrial control protocol of the associated data packet are obtained from the industrial control protocol data corresponding to the application layer of the associated data packet.

[0014] The length, the source physical address, the destination physical address, and the network layer protocol, the source Internet protocol address, the destination Internet protocol address, and the transport layer protocol, the source port and the destination port, and the source address, the destination address, the source port, the destination port, and the command number corresponding to the industrial control protocol are taken as the target field content corresponding to different network levels of the associated data packet.

[0015] In one embodiment, the original data features are monitored by a preset white list, including:

[0016] The length of the associated data packet is compared with the preset maximum value in the white list, whether exceeding the preset maximum value;

[0017] In the case where the maximum value is not exceeded, the source physical address, the destination physical address, and the network layer protocol of the associated data packet are compared with the white list to determine whether they are consistent;

[0018] In the case of consistency, the source Internet protocol address, the destination Internet protocol address, and the transport layer protocol of the associated data packet are compared with the white list to determine whether they are consistent;

[0019] In the case of consistency, the source port and the destination port of the associated data packet are matched with the white list;

[0020] In the case of matching, the source address, the destination address, the source port, and the destination port corresponding to the industrial control protocol of the associated data packet are matched with the white list; in the case of matching, the type of the command number and the analysis characteristic value are obtained and matched with the white list.

[0021] In one embodiment, the interaction behavior features of the associated data packet after accessing the device network are obtained, including:

[0022] The event monitoring is performed after the associated data packet access device is connected to the network, and the activity event content after the associated data packet access device is connected to the network is obtained.

[0023] In one embodiment, the activity event content after the associated data packet access device is connected to the network is obtained, including:

[0024] The process information, system resources and operation information after the associated data packet access device is connected to the network are obtained from the event activity corresponding to the associated data packet inside the device, and the process information, system resources and operation information are taken as the activity event content.

[0025] In one embodiment, the interaction behavior feature is monitored by the white list to obtain the second monitoring result of the associated data packet, including:

[0026] The process information, system resources and operation information are compared with the white list to obtain the second monitoring result of the associated data packet.

[0027] In one embodiment, in the case that the first monitoring result is abnormal, it is determined that the monitoring result of the device network is abnormal, and the associated data packet is prevented from accessing the device network and an abnormal warning information is sent to the relevant personnel; in the case that the first monitoring result is normal and the second monitoring result is abnormal, it is determined that the monitoring result of the device network is abnormal, and the interaction behavior of the associated data packet in the device network is interrupted and an abnormal warning information is sent to the relevant personnel.

[0028] In one embodiment, the white list is constructed by the following steps, including:

[0029] Based on the historical attack records corresponding to the device network, an attack chain model corresponding to the device network is constructed; the abnormal data packet corresponding to the device network is constructed by using the attack chain model, the abnormal data packet is connected to the device network, the abnormal data feature under the condition that the abnormal data packet is not connected to the device network and the abnormal interaction behavior feature under the condition that the abnormal data packet is connected to the device network are obtained; the preset original data feature and the preset interaction behavior feature are obtained according to the abnormal data feature, the abnormal interaction behavior feature and the historical normal communication data packet; and the preset white list is constructed based on the preset original data feature and the preset interaction behavior feature.

[0030] In one embodiment, the preset original data feature and the preset interaction behavior feature are obtained according to the abnormal data feature, the abnormal interaction behavior feature and the historical normal communication data packet, including:

[0031] According to historical normal communication data packets of the device network, the historical normal communication data packets are accessed to the device network, normal original data features of the historical normal communication data packets in a case that the historical normal communication data packets are not accessed to the device network are obtained, and normal interaction behavior features of the historical normal communication data packets in a case that the historical normal communication data packets are accessed to the device network are obtained;

[0032] The normal original data features are compared with the abnormal data features to obtain difference data features, and the difference data features are compared with data features in the normal original data features as preset original data features;

[0033] The normal interaction behavior features are compared with the abnormal interaction behavior features to obtain difference interaction behavior features, and the difference interaction behavior features are compared with behavior features in the normal interaction behavior features as preset interaction behavior features.

[0034] In a second aspect, the present application further provides a device network monitoring device. The device comprises:

[0035] The acquisition module is configured to acquire associated data packets of the device network;

[0036] The first monitoring module is configured to acquire original data features of the associated data packets in a case that the associated data packets are not accessed to the device network, and monitor the original data features through a preset white list to obtain a first monitoring result of the associated data packets;

[0037] The second monitoring module is configured to acquire interaction behavior features of the associated data packets after the associated data packets are accessed to the device network in a case that the associated data packets are accessed to the device network, and monitor the interaction behavior features through the white list to obtain a second monitoring result of the associated data packets;

[0038] The result generation module is configured to obtain a monitoring result of the device network based on the first monitoring result and the second monitoring result.

[0039] The white list is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

[0040] In a third aspect, the present application further provides a computer device. The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0041] The acquisition module is configured to acquire associated data packets of the device network;

[0042] The first monitoring module is configured to acquire original data features of the associated data packets in a case that the associated data packets are not accessed to the device network, and monitor the original data features through a preset white list to obtain a first monitoring result of the associated data packets;

[0043] In the case that the associated data packet has accessed the device network, an interaction behavior feature of the associated data packet after accessing the device network is acquired, and the interaction behavior feature is monitored through the white list to obtain a second monitoring result of the associated data packet;

[0044] Based on the first monitoring result and the second monitoring result, a monitoring result of the device network is obtained; the white list is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

[0045] In the fourth aspect, the present application further provides a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the following steps:

[0046] An associated data packet of a device network is acquired;

[0047] In the case that the associated data packet has not accessed the device network, an original data feature of the associated data packet is acquired, and the original data feature is monitored through a preset white list to obtain a first monitoring result of the associated data packet;

[0048] In the case that the associated data packet has accessed the device network, an interaction behavior feature of the associated data packet after accessing the device network is acquired, and the interaction behavior feature is monitored through the white list to obtain a second monitoring result of the associated data packet;

[0049] Based on the first monitoring result and the second monitoring result, a monitoring result of the device network is obtained; the white list is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

[0050] In the fifth aspect, the present application further provides a computer program product. The computer program product comprises a computer program, and the computer program is executed by a processor to implement the following steps:

[0051] An associated data packet of a device network is acquired;

[0052] In the case that the associated data packet has not accessed the device network, an original data feature of the associated data packet is acquired, and the original data feature is monitored through a preset white list to obtain a first monitoring result of the associated data packet;

[0053] In the case that the associated data packet has accessed the device network, an interaction behavior feature of the associated data packet after accessing the device network is acquired, and the interaction behavior feature is monitored through the white list to obtain a second monitoring result of the associated data packet;

[0054] The monitoring result of the device network is obtained based on the first monitoring result and the second monitoring result; wherein the white list is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

[0055] The device network monitoring method, device, computer device, storage medium and computer program product can construct an attack chain model based on historical attack records, determine a white list of the device network through the attack chain model corresponding to the device network, and monitor the device network based on the white list before and after the associated data packet is accessed, thereby realizing monitoring of the device network. Compared with white list verification of all data of the network, the white list determined through the attack chain model in the present application is used for protection and monitoring of the characteristics of the attack chain model, rather than full protection and monitoring of the network, so that the device network can be accurately monitored and protected, the monitoring accuracy can be improved, and monitoring resources can be saved. BRIEF DESCRIPTION OF DRAWINGS

[0056] Figure 1 An application environment diagram of the device network monitoring method in one embodiment;

[0057] Figure 2 A flowchart of the device network monitoring method in one embodiment;

[0058] Figure 3 A flowchart of the device network monitoring method in another embodiment;

[0059] Figure 4 A structural block diagram of the device network monitoring system in one embodiment;

[0060] Figure 5 A diagram of the white list in the device network monitoring method in one embodiment;

[0061] Figure 6 A flowchart of the device network monitoring method in another embodiment;

[0062] Figure 7 A structural block diagram of the device network monitoring device in one embodiment;

[0063] Figure 8 An internal structural diagram of the computer device in one embodiment. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application is further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0065] The device network monitoring method provided by the embodiments of the present application can be applied to an application environment as shown in Figure 1 The device 102 communicates with the server 104 through a network. A data storage system can store data required to be processed by the server 104. The data storage system can be integrated on the server 104, or placed on a cloud or other network server. The server 104 obtains an associated data packet of the device 102 network. In a case where the associated data packet is not connected to the device 102 network, the server 104 obtains original data features of the associated data packet, monitors the original data features through a preset white list, and obtains a first monitoring result. In a case where the associated data packet is connected to the device 102 network, the server 104 obtains interaction behavior features after the associated data packet is connected, monitors the interaction behavior features through the preset white list, and obtains a second monitoring result. The monitoring result of the device 102 network is obtained based on the first monitoring result and the second monitoring result. The device 102 can be various industrial control devices in a banking system, such as a consultation machine, a business machine, a monitoring machine, and the like. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0066] In one embodiment, as shown in Figure 2 , a device network monitoring method is provided. The server in Figure 1 is taken as an example to illustrate the method, which includes the following steps:

[0067] In step S202, an associated data packet of a device network is obtained.

[0068] The device can be an industrial control device for a financial industry, referred to as a financial industrial control device. The financial industrial control device is usually used in an automatic system of a financial institution, including an automatic teller machine, a card swiping terminal, a payment terminal, an automatic storage machine, and the like. The financial industrial control device network can be a network connecting the devices together, or a network connecting the devices with an external Internet and an internal upper-layer network. The associated data packet can be a data packet composed of request information and the like sent by other devices when accessing the financial industrial control device network, or a communication data packet transmitted by the external Internet, or a control data packet issued by the upper-layer network. The server can capture the communication data packet of the financial industrial control device network in real time through a mirror port of an industrial control system, or use a professional network monitoring tool to capture and analyze the data packet on the financial industrial control device network. The tool can listen to network traffic through a network card or a network device, save the captured data packet for subsequent analysis, or use a special network packet capturing device to capture and record the network communication data packet.

[0069] Step S204, in the case that the associated data packet has not accessed the device network, the original data characteristics of the associated data packet are acquired, and the original data characteristics are monitored through a preset whitelist to obtain a first monitoring result of the associated data packet.

[0070] The original data characteristics can refer to characteristics or attributes of data in the associated data packet before any processing or conversion, i.e., data characteristics or attributes of the associated data packet before the associated data packet accesses the financial industrial control device network for data interaction, such as data type, data range, etc. In the case that the associated data packet has not accessed the financial industrial control device network, i.e., the flow direction object of the associated data packet is the financial industrial control device network, the server acquires the data packet in time before it accesses the financial industrial control device network and analyzes the data packet to obtain the original data characteristics of the associated data packet. The whitelist is a network security mechanism for limiting only specific users, devices or programs to access the system, network or resource. The principle of the preset whitelist is to define the allowed access entities in advance, and only the entities in the whitelist can be authorized and allowed to access, for example, in the network security field, the preset whitelist can limit the access of specific Internet Protocol addresses or Internet Protocol address ranges at the network level, and only the Internet Protocol addresses listed in the whitelist can access the restricted resources through the firewall or router. The access of specific users or user groups can be limited at the application level, and only the users or user groups listed in the whitelist can log in, access or execute specific application programs or functions. The execution of specific programs or processes can also be limited at the program level, and only the programs or processes listed in the whitelist can be executed by the system, and other programs or processes will be blocked. The original data characteristics are monitored through the preset whitelist, and it is checked whether there is data content inconsistent with the whitelist, so as to obtain the first monitoring result.

[0071] Step S206, in the case that the associated data packet has accessed the device network, the interaction behavior characteristics of the associated data packet after accessing the device network are acquired, and the interaction behavior characteristics are monitored through the whitelist to obtain a second monitoring result of the associated data packet.

[0072] The interaction behavior can refer to a series of communication behaviors, data interaction and other activities of the associated data packet after accessing the financial industrial control device network. After the associated data packet accesses the financial industrial control device network, the server can collect and store the activity event content generated after the associated data packet accesses the financial industrial control device network through a network event monitoring tool. The server checks the collected activity event content through the whitelist to obtain the second monitoring result, which can timely discover abnormal activity events and can be prevented through related modules.

[0073] Step S208, based on the first monitoring result and the second monitoring result, a monitoring result of the device network is obtained.

[0074] The white list is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

[0075] It should be understood that if any of the first monitoring result and the second monitoring result is abnormal, the monitoring result of the financial industrial control device network is abnormal. The attack chain can refer to a series of steps or stages taken by an attacker when carrying out an attack. The attack chain model of the present application is constructed based on the attack chain idea. The server analyzes and statistics the historical attack records of the financial industrial control device network, establishes an attack chain model with a comprehensive attack mode and attack path, and obtains the weak part or link of the financial industrial control device network through the simulation attack test of the attack chain model and the financial industrial control device network, so as to determine the content that needs to be protected by the white list. The content can be, for example, the original data features corresponding to the associated data packet accessing the financial industrial control device network in the attack chain model, and the interaction behavior features corresponding to the associated data packet accessing the financial industrial control device network in the attack chain model.

[0076] As shown in Figure 6 In the device network monitoring method, the attack chain model is constructed based on the historical attack records, and the white list of the device network is determined through the attack chain model corresponding to the device network. The monitoring of the device network is realized based on the white list for the monitoring before the associated data packet accesses and the monitoring after the associated data packet accesses. Compared with the white list verification of all data of the network, the content of the white list determined by the attack chain model in the present application is for protecting the features of the attack chain model, rather than for protecting the network in whole. Therefore, the present application can accurately monitor and protect the device network, and has the effects of improving the monitoring accuracy and saving the monitoring resources.

[0077] In one embodiment, the original data features of the associated data packet are obtained by: performing data grabbing and parsing on the associated data packet to obtain target field contents corresponding to different network levels of the associated data packet. The target field contents are taken as the original data features of the associated data packet.

[0078] The process of the server performing data grabbing and parsing on the associated data packet can be to use a crawler program or a data grabbing tool to obtain original data, then to clean and pretreat the data, and then to convert the data into a readable and processable form by using appropriate parsing techniques according to the structure and format of the data. Then, according to the monitoring requirements, that is, the content requirements corresponding to the white list that needs to be monitored, the required information or target field contents are extracted from the parsed data. The information or target field contents can be specific fields, tags, keywords or other structured data, etc.

[0079] In the embodiment, by obtaining the target field content corresponding to different network levels in the associated data packet, the original data characteristics in the associated data packet can be analyzed, whether the associated data packet is abnormal can be preliminarily judged, and the network of the monitoring device can be monitored more accurately by obtaining the target field content corresponding to different network levels.

[0080] In one embodiment, obtaining the target field content corresponding to different network levels in the associated data packet includes: obtaining the length of the associated data packet from the data frame corresponding to the physical layer of the associated data packet; obtaining the source physical address, the destination physical address, and the network layer protocol of the associated data packet from the Ethernet frame corresponding to the link layer of the associated data packet; obtaining the source Internet protocol address, the destination Internet protocol address, and the transport layer protocol of the associated data packet from the Internet protocol data packet corresponding to the network layer of the associated data packet; obtaining the source port and the destination port of the associated data packet from the message corresponding to the transport layer of the associated data packet; obtaining the source address, the destination address, the source port, the destination port, and the command number corresponding to the industrial control protocol of the associated data packet from the industrial control protocol data corresponding to the application layer of the associated data packet; and taking the length, the source physical address, the destination physical address, and the network layer protocol, the source Internet protocol address, the destination Internet protocol address, and the transport layer protocol, the source port and the destination port, and the source address, the destination address, the source port, the destination port, and the command number corresponding to the industrial control protocol as the target field content corresponding to different network levels of the associated data packet.

[0081] The physical layer is the lowest layer in the network level and is responsible for transmitting raw bit streams. The link layer is located above the physical layer and is responsible for transmitting data frames between directly connected nodes. The data link layer usually uses physical addresses to identify network devices. The network layer is the core layer in the network level and is responsible for routing and forwarding between networks. It handles data packet routing, addressing, and grouping to ensure that data can be transmitted between different networks. The network layer uses Internet protocol addresses to identify network devices and networks. The transport layer is located above the network layer and is responsible for end-to-end data transmission. The transport layer uses port numbers to identify different applications and services. The application layer is the highest layer in the network level and is responsible for communication and data exchange between applications. The application layer uses various protocols and standards to meet different application requirements. The length of the data packet can be the value of the data packet flow. The industrial control protocol can refer to a communication protocol used for communication between devices in an industrial control system. In the embodiment, it can refer to a communication protocol used for financial industrial control devices in a financial industrial control system. In the embodiment, the server can use protocol deep parsing technology to obtain information corresponding to different network levels of the associated data packet. It should be understood that, corresponding to the white list, the target field content corresponding to different levels of the associated data packet to be obtained can be as shown above.

[0082] In the embodiment, the information corresponding to different network levels of the associated data packet is obtained, so that the information to be monitored is more refined, and the monitoring accuracy is improved.

[0083] In one embodiment, as shown in Figure 3 The original data features are monitored by the preset white list, including:

[0084] In step S302, the length of the associated data packet is compared with the preset maximum value in the white list, whether it exceeds the preset maximum value.

[0085] The server can determine the preset maximum value in combination with the traffic size of the historical data packet and the traffic size that can be carried by the financial industrial control device network, so as to avoid the financial industrial control network device from being paralyzed by malicious abnormal data packets.

[0086] In step S304, if the maximum value is not exceeded, the source physical address, the destination physical address, and the network layer protocol of the associated data packet are compared with the white list. If they are consistent, the source Internet protocol address, the destination Internet protocol address, and the transport layer protocol of the associated data packet are compared with the white list. If they are consistent, the source port and the destination port of the associated data packet are matched with the white list.

[0087] In the above comparison process, if the current step is determined to be inconsistent with the preset value in the white list, it is considered that there is an anomaly, and a warning is given. The address, protocol, and port can be completely matched and verified. If any one of them does not conform to the corresponding white list, it is considered that the corresponding address, protocol, or port is abnormal.

[0088] In step S306, if the matching is successful, the source address, the destination address, the source port, and the destination port of the associated data packet corresponding to the industrial control protocol are matched with the white list. If the matching is successful, the type of the command number and the analysis characteristic value are obtained and matched with the white list.

[0089] The analysis characteristic value can be used to represent the characteristics of the command number, so that the white list can be used for matching and verifying the characteristics.

[0090] In the embodiment, the information corresponding to different network levels of the associated data packet is verified by the white list. If any part of the information at any level is abnormal, it is considered that an anomaly occurs and a warning is given, which saves the monitoring time and improves the monitoring efficiency.

[0091] In an embodiment, the interaction behavior feature of the associated data packet after accessing the device network is obtained, including: performing event monitoring after the associated data packet accesses the device network to obtain the activity event content after the associated data packet accesses the device network. The activity event content is taken as the interaction behavior feature after the associated data packet accesses the device network.

[0092] The event monitoring can refer to a process of monitoring and recording events occurring in a system, application program or network in real time. The server can collect the activity event content occurring in the financial industrial control device network through various monitoring tools and technologies. In an embodiment, the activity event content can be process information, system resources and operation information after the associated data packet accesses the financial industrial control device network. Accordingly, the monitoring process in an embodiment can be monitoring the interaction behavior feature through the whitelist to obtain the second monitoring result of the associated data packet, including: comparing the process information, system resources and operation information with the whitelist to obtain the second monitoring result of the associated data packet. The comparison of the process information, system resources and operation information with the whitelist can be comparing the process information, system resources and operation information with the whitelist through the feature values corresponding to the pre-trained model, and the range interval of the feature values in the whitelist can be determined through the pre-trained model and the corresponding historical data.

[0093] In the above embodiment, the process information, system resources and operation information of the associated data packet after accessing the device network are monitored through the whitelist, which can timely discover abnormal activities and reduce losses caused by abnormal activities.

[0094] In an embodiment, the device network monitoring method includes: in the case that the first monitoring result is abnormal, determining that the monitoring result of the device network is abnormal, and preventing the associated data packet from accessing the device network and sending an abnormal warning information to the relevant personnel. In the case that the first monitoring result is normal and the second monitoring result is abnormal, determining that the monitoring result of the device network is abnormal, and interrupting the interaction behavior of the associated data packet in the device network and sending an abnormal warning information to the relevant personnel.

[0095] In the embodiment, the abnormal warning information is sent to the relevant personnel, so that the relevant personnel can timely understand the abnormal situation and take corresponding measures to reduce the possible losses.

[0096] In one embodiment, the white list is constructed by the following steps, including: based on the historical attack records corresponding to the device network, constructing an attack chain model corresponding to the device network. Using the attack chain model to construct the abnormal data packet corresponding to the device network, the abnormal data packet is connected to the device network, the abnormal data characteristics of the abnormal data packet not connected to the device network are obtained, and the abnormal interaction behavior characteristics of the abnormal data packet connected to the device network are obtained. According to the historical normal communication data packet of the device network, the historical normal communication data packet is connected to the device network, the normal original data characteristics of the historical normal communication data packet not connected to the device network are obtained, and the normal interaction behavior characteristics of the historical normal communication data packet connected to the device network are obtained. The normal original data characteristics corresponding to the abnormal data characteristics are compared to obtain the difference data characteristics, and the difference data characteristics corresponding to the data characteristics in the normal original data characteristics are used as the preset original data characteristics. The normal interaction behavior characteristics corresponding to the abnormal interaction behavior characteristics are compared to obtain the difference interaction behavior characteristics, and the difference interaction behavior characteristics corresponding to the behavior characteristics in the normal interaction behavior characteristics are used as the preset interaction behavior characteristics. Based on the preset original data characteristics and the preset interaction behavior characteristics, a preset white list is constructed.

[0097] Among them, the abnormal data characteristics can be the data characteristics extracted and analyzed from all data in the abnormal data packet; the abnormal interaction behavior characteristics can be all activity event contents generated after the abnormal data packet is connected to the financial industrial control device; the normal original data characteristics can be all data characteristics obtained based on the historical normal communication data packet; the normal interaction behavior characteristics can be all activity event contents after the historical normal communication data packet is connected to the financial industrial control device network; the above-mentioned feature acquisition method can refer to the acquisition method in the foregoing embodiments, which will not be described here. Therefore, comparing the abnormal data characteristics with the normal original data characteristics can filter out the different data characteristics, which are the specific abnormal data characteristics, and the part of the normal original data characteristics corresponding to the data characteristics can be filtered out as the preset original data characteristics. Similarly, the preset interaction behavior characteristics can be obtained by comparing and filtering the abnormal interaction behavior characteristics and the normal interaction behavior characteristics; and the preset white list can be constructed according to the preset original data and the preset interaction behavior characteristics.

[0098] In this embodiment, the attack chain model is constructed by the historical attack records, the abnormal data packet is constructed by the attack chain model corresponding to the device network, and the different related characteristics that may be attack abnormal characteristics are obtained by comparing the abnormal data packet and the historical normal data packet before and after connecting to the device network. The historical normal characteristics corresponding to the attack abnormal characteristics are used to construct the white list; the white list construction method of the present application can determine the places that need to be protected by the white list according to the attack chain model, which can save monitoring resources and improve monitoring efficiency compared with the whole network protection.

[0099] In one specific embodiment, this application can be applied to financial industrial control equipment, and its system architecture framework is as follows: Figure 4 As shown, in this system architecture, the attack chain preset module is mainly used to set the attack chain stage model and generate a whitelist rule base for each stage of the attack chain. The attack chain feature acquisition module is responsible for maintaining the data acquisition configuration function, such as the acquisition time period, and is responsible for automatically acquiring the feature attributes of each stage of the attack chain according to the acquisition configuration requirements and storing them in the feature database. The automated monitoring module adopts an abnormal behavior-based detection method and achieves automated monitoring based on whitelist security detection technology. It promptly detects abnormal attack behaviors by matching the feature attributes automatically acquired in the feature acquisition stage with the expected whitelist rule base. The proactive early warning module is used to predict the security status of financial industrial control equipment in real time. The proactive response module enables timely decision-making when suspicious attack behavior precursors appear. The event logging module provides the ability to trace industrial control security events; the network monitoring process for financial industrial control equipment may include:

[0100] The associated data packet of the financial industrial control device network is acquired; wherein the industrial control system mirror port is used to capture the industrial control network communication data packet in real time, and then the packet capturing technology and protocol deep analysis technology are used to automatically realize the collection of the characteristic data in the network access stage of the industrial control device, and the key target field content is extracted from the physical layer to the application layer in the case where the associated data packet is not connected to the financial industrial control device network: the length of the associated data packet is acquired from the data frame corresponding to the physical layer of the associated data packet; the capture time and length of the data packet can be parsed from the data frame of the physical layer; the source physical address, the destination physical address and the network layer protocol of the associated data packet are acquired from the Ethernet frame corresponding to the link layer of the associated data packet; the source physical address, the destination physical address and the network layer protocol type can be parsed from the Ethernet frame of the data link layer. Since the communication channel in the industrial control system is single and the protocol used is single, the upper layer protocol type field value is parsed from the Ethernet frame of the data link layer, if the field value is 0x0800, that is, the Internet Protocol version 4 protocol, the network layer Internet Protocol data packet is continued to be parsed. If not, the upper layer protocol field type is recorded. The source Internet Protocol address, the destination Internet Protocol address and the transport layer protocol of the associated data packet are acquired from the Internet Protocol data packet corresponding to the network layer of the associated data packet; the source Internet Protocol address, the destination Internet Protocol address and the upper layer protocol type of the protocol are parsed from the network layer Internet Protocol data packet, if the upper layer protocol number is 06 (transmission control protocol), the transmission control protocol message of the transport layer is continued to be parsed. If not, the upper layer protocol field type is recorded. The source port and the destination port of the associated data packet are acquired from the message corresponding to the transport layer of the associated data packet; the source address, the destination address, the source port, the destination port and the command number corresponding to the industrial control protocol of the associated data packet are acquired from the industrial control protocol data corresponding to the application layer of the associated data packet. The industrial control protocol of the application layer can be parsed, and based on the pre-defined characteristic data model of the network access financial industrial control device stage corresponding to the industrial control protocol, the destination address, the destination port, the source address, the source port and the command number of the industrial control protocol are extracted. The content of the application layer protocol data field is parsed according to the value of the command number.

[0101] In the automatic monitoring module of the industrial control equipment, the monitoring rule in the stage of actively monitoring the access of the associated data packet to the financial industrial control equipment based on the white list is: comparing the length of the associated data packet with the preset maximum value in the white list, whether it exceeds the preset maximum value, if it exceeds, warning, it may be a malicious deformed data packet constructed by an attacker. In the case where the maximum value is not exceeded, the source physical address, the destination physical address and the network layer protocol of the associated data packet are compared with the white list to see if they are consistent; in the case of consistency, the source Internet protocol address, the destination Internet protocol address and the transport layer protocol of the associated data packet are compared with the white list to see if they match; in the case of matching, the source port and the destination port of the associated data packet are matched with the white list; wherein, if the above-mentioned source physical address, destination physical address, source Internet protocol address, destination Internet protocol address, source port and destination port do not meet the requirements of the white list, there may be a newly accessed worker node or communication using other ports, which needs to be warned. In the case of matching, the source address, the destination address, the source port and the destination port of the associated data packet corresponding to the industrial control protocol are matched with the white list; in the case of matching, the type of command number and the analysis characteristic value are obtained and matched with the white list to obtain the first monitoring result of the associated data packet.

[0102] In the case where the associated data packet has accessed the financial industrial control equipment network, the process information, system resources and operation information of the associated data packet after accessing the financial industrial control equipment network are obtained from the event activities corresponding to the associated data packet in the financial industrial control equipment. The characteristic data of the industrial control equipment can be automatically collected based on the characteristic data index of the constructed intrusion industrial control equipment implementation damage stage using WMI technology. The extended class tool defined by WMI and the event monitoring function provided by WMI are used to automatically collect process information, system resources, operation information of power supply and equipment in the industrial control equipment, etc. The collection results are stored in the corresponding disk file in the form of a list. WMI is a Microsoft system management technology, and its full name is Windows Management Instrumentation, which is Microsoft system management specification.

[0103] The process information, system resources and operation information are compared with the white list to obtain the second monitoring result of the associated data packet. The process information, system resources and operation information can be matched with the corresponding white list rule to determine whether they are consistent with the expected value. If they are not consistent with the expected value, it is determined that the associated data packet after accessing the financial industrial control equipment network is abnormal, and a warning is given. Through the abnormal detection in this stage, whether the financial industrial control equipment has performance bottleneck, whether the necessary system patch is updated, whether the process is a Trojan process or the process is maliciously opened and closed, whether the financial industrial control equipment has opened unnecessary services, whether the industrial control data has been maliciously tampered with, etc. can be found.

[0104] Based on the first monitoring result and the second monitoring result, a monitoring result of the financial industrial control device network is obtained. In the case that the first monitoring result is abnormal, it is determined that the monitoring result of the financial device network is abnormal, and the associated data packets are prevented from accessing the financial industrial control device network and an abnormal warning information is sent to the relevant personnel. In the case that the first monitoring result is normal and the second monitoring result is abnormal, it is determined that the monitoring result of the financial industrial control device network is abnormal, and the interaction behavior of the associated data packets in the financial industrial control device network is interrupted and an abnormal warning information is sent to the relevant personnel. The active warning module can provide real-time warning information and visual display for the administrator, and the active response module can timely organize the abnormal network communication behavior. The security visualization module can be divided into abnormal display of data and abnormal display of internal assets of the industrial control device.

[0105] In the active warning module, according to the white list, the warning rules of each stage of the attack chain can be set. For example, some of the warning rules of the financial industrial control device can be described as: [Action: Alert / Deny] [T_name: not in filename] [T_path: not equal T_name.filepath] [T_hash: not equal T_name.hash], wherein Action represents the warning action, Alert represents the execution of the warning action, Deny represents the non-execution of the warning action, T_name represents the collected industrial control device file name, not in filename represents that the industrial control device file name is not in the list, T_path represents the path of the industrial control device file, not equal T_name.filepath represents that the path of the industrial control device file is inconsistent with the file path corresponding to the collected industrial control device file name, T_hash represents the metric value of the industrial control device file, and not equal T_name.hash represents that the metric value of the industrial control device file is inconsistent with the metric value corresponding to the collected industrial control device file name. The event recording module provides the traceability of the industrial control security events.

[0106] The attack chain model corresponding to the financial industrial control device network is constructed based on historical attack records corresponding to the financial industrial control device network. The abnormal data packet corresponding to the financial industrial control device network is constructed using the attack chain model, the abnormal data packet is connected to the financial industrial control device network, the abnormal data characteristics of the abnormal data packet without connecting to the financial industrial control device network are obtained, and the abnormal interaction behavior characteristics of the abnormal data packet connecting to the financial industrial control device network are obtained. According to the historical normal communication data packet of the financial industrial control device network, the historical normal communication data packet is connected to the financial industrial control device network, the normal original data characteristics of the historical normal communication data packet without connecting to the financial industrial control device network are obtained, and the normal interaction behavior characteristics of the historical normal communication data packet connecting to the financial industrial control device network are obtained. The normal original data characteristics corresponding to the abnormal data characteristics are compared to obtain the difference data characteristics, and the difference data characteristics corresponding to the data characteristics in the normal original data characteristics are taken as the preset original data characteristics. The normal interaction behavior characteristics corresponding to the abnormal interaction behavior characteristics are compared to obtain the difference interaction behavior characteristics, and the difference interaction behavior characteristics corresponding to the behavior characteristics in the normal interaction behavior characteristics are taken as the preset interaction behavior characteristics. The preset white list is constructed based on the preset original data characteristics and the preset interaction behavior characteristics.

[0107] Part of the preset original data characteristics corresponding to the white list can be as shown in Figure 5 The basic part can be represented by [sequence number 1, source physical address, destination physical address, source Internet protocol, destination Internet protocol, source port, destination port]; the industrial control protocol feature part can be represented by [sequence number 2, industrial control protocol source address, industrial control protocol source port, industrial control protocol destination address, industrial control protocol destination port, command number, sequence number 1]; and the command analysis part can be represented by [sequence number 3, data, sequence number 2].

[0108] Based on the whitelist constructed by the foregoing method, a whitelist updating method is provided, each record in the normal communication data packet set is scanned, and each record is operated as follows: first, length information of the data packet is acquired and compared with a preset length value, if the length information is greater than the preset length value, the length of the data packet is updated to the preset length value; then, values of a characteristic index source physical address, a destination physical address, a source internet protocol, a destination internet protocol, a source port and a destination port are acquired, and are matched with the whitelist corresponding to the partial preset original data characteristics, if the rule does not exist, the characteristic index values are recorded to the basic characteristic whitelist; a judgment on an application layer protocol type is continued; based on the industrial control protocol type, characteristic indexes of the industrial control protocol application layer are acquired, including values of the source address and the source port of the industrial control protocol, the destination address and the destination port of the industrial control protocol and the command number, if the industrial control protocol whitelist does not have the rule, the rule is updated to the industrial control protocol whitelist; finally, a command type of the command number is judged, data contents (such as device status, data length, etc.) of a data field are acquired according to the command number, if the command analysis characteristic whitelist does not have the rule, the rule is updated. In this way, the construction of the corresponding protocol whitelist is automatically completed. Based on the expert experience rule, characteristic data contents after the normal communication data packet accesses the financial industrial control device network are collected, and the construction of the characteristic data index whitelist in this stage is completed.

[0109] It should be understood that, although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless explicitly stated herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0110] Based on the same inventive concept, the embodiments of the present application also provide a device network monitoring apparatus for implementing the device network monitoring method as described above. The implementation scheme for solving the problem provided by the apparatus is similar to the implementation scheme described in the foregoing method, and therefore the specific limitations in one or more device network monitoring apparatus embodiments provided below can refer to the limitations of the device network monitoring method described above, which will not be described herein again.

[0111] In one embodiment, as shown in Figure 7 a device network monitoring apparatus is provided, which includes an acquisition module 701, a first monitoring module 702, a second monitoring module 703 and a result generation module 704, wherein:

[0112] The acquisition module 701 is configured to acquire an association data packet of a device network.

[0113] The first monitoring module 702 is configured to acquire original data features of the association data packet in a case where the association data packet has not accessed the device network, and monitor the original data features through a preset white list to obtain a first monitoring result of the association data packet.

[0114] The second monitoring module 703 is configured to acquire interaction behavior features of the association data packet after the association data packet has accessed the device network, and monitor the interaction behavior features through the white list to obtain a second monitoring result of the association data packet.

[0115] The result generation module 704 is configured to obtain a monitoring result of the device network based on the first monitoring result and the second monitoring result.

[0116] The white list is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

[0117] In an embodiment, the first monitoring module 702 is further configured to perform data grabbing and parsing on the association data packet to acquire target field contents of the association data packet corresponding to different network levels; and take the target field contents as the original data features of the association data packet.

[0118] In an embodiment, the first monitoring module 702 is further configured to acquire a length of the association data packet from a data frame corresponding to a physical layer of the association data packet; acquire a source physical address, a destination physical address and a network layer protocol of the association data packet from an Ethernet frame corresponding to a link layer of the association data packet; acquire a source Internet protocol address, a destination Internet protocol address and a transport layer protocol of the association data packet from an Internet protocol data packet corresponding to a network layer of the association data packet; acquire a source port and a destination port of the association data packet from a message corresponding to a transport layer of the association data packet; acquire a source address, a destination address, a source port, a destination port and a command number corresponding to an industrial control protocol of the association data packet from industrial control protocol data corresponding to an application layer of the association data packet; and take the length, the source physical address, the destination physical address and the network layer protocol, the source Internet protocol address, the destination Internet protocol address and the transport layer protocol, the source port and the destination port, and the source address, the destination address, the source port, the destination port and the command number corresponding to the industrial control protocol as the target field contents of the association data packet corresponding to different network levels.

[0119] In one embodiment, the first monitoring module 702 is further configured to compare the length of the associated data packet with a preset maximum value in the whitelist, and determine whether the length exceeds the preset maximum value; in the case where the length does not exceed the maximum value, compare the source physical address, the destination physical address and the network layer protocol of the associated data packet with the whitelist, and determine whether they are consistent; in the case where they are consistent, compare the source Internet protocol address, the destination Internet protocol address and the transport layer protocol of the associated data packet with the whitelist, and determine whether they are consistent; in the case where they are consistent, compare the source port and the destination port of the associated data packet with the whitelist; in the case where they are consistent, compare the source address, the destination address, the source port and the destination port of the associated data packet corresponding to the industrial protocol with the whitelist; in the case where they are consistent, obtain the type of the command number and the analysis characteristic value, and filter and match them with the whitelist.

[0120] In one embodiment, the second monitoring module 703 is further configured to monitor events after the associated data packet accesses the device network, and obtain the activity event content after the associated data packet accesses the device network; and the activity event content is used as the interaction behavior feature after the associated data packet accesses the device network.

[0121] In one embodiment, the second monitoring module 703 is further configured to obtain the process information, the system resource and the operation information after the associated data packet accesses the device network from the event activity corresponding to the associated data packet generated inside the device; and the process information, the system resource and the operation information are used as the activity event content.

[0122] In one embodiment, the second monitoring module 703 is further configured to compare the process information, the system resource and the operation information with the whitelist, and obtain the second monitoring result of the associated data packet.

[0123] In one embodiment, the device network monitoring apparatus further comprises a response warning module, which is configured to determine that the monitoring result of the device network is abnormal in the case where the first monitoring result is abnormal, and prevent the associated data packet from accessing the device network and send an abnormal warning information to the relevant personnel; and in the case where the first monitoring result is normal and the second monitoring result is abnormal, determine that the monitoring result of the device network is abnormal, interrupt the interaction behavior of the associated data packet in the device network, and send an abnormal warning information to the relevant personnel.

[0124] In an embodiment, the device network monitoring apparatus further comprises a construction module configured to construct an attack chain model corresponding to the device network based on historical attack records corresponding to the device network; use the attack chain model to construct an abnormal data packet corresponding to the device network, access the abnormal data packet to the device network, obtain an abnormal data feature when the abnormal data packet is not accessed to the device network, and an abnormal interaction behavior feature when the abnormal data packet is accessed to the device network; according to the historical normal communication data packet of the device network, access the historical normal communication data packet to the device network, obtain a normal original data feature when the historical normal communication data packet is not accessed to the device network, and a normal interaction behavior feature when the historical normal communication data packet is accessed to the device network; compare the normal original data feature corresponding to the abnormal data feature to obtain a difference data feature, and use the difference data feature corresponding to the data feature in the normal original data feature as a preset original data feature; compare the normal interaction behavior feature corresponding to the abnormal interaction behavior feature to obtain a difference interaction behavior feature, and use the difference interaction behavior feature corresponding to the behavior feature in the normal interaction behavior feature as a preset interaction behavior feature. Based on the preset original data feature and the preset interaction behavior feature, a preset white list is constructed.

[0125] The modules in the device network monitoring apparatus described above can be realized by software, hardware, and combinations thereof, in whole or in part. The modules described above can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the modules.

[0126] In an embodiment, a computer device is provided, which can be a server, and the internal structure diagram thereof can be as shown in Figure 7 The computer device comprises a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The database of the computer device is configured to store data generated in the network monitoring process. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with external terminals through network connection. The computer program is executed by the processor to implement a device network monitoring method.

[0127] Those skilled in the art can understand that Figure 7 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0128] In one embodiment, a computer device is also provided, including a memory and a processor, the memory storing a computer program, and the processor implementing the steps in the above method embodiments when executing the computer program.

[0129] In one embodiment, a computer readable storage medium is provided, storing a computer program, and the computer program is executed by a processor to implement the steps in the above method embodiments.

[0130] In one embodiment, a computer program product is provided, including a computer program, and the computer program is executed by a processor to implement the steps in the above method embodiments.

[0131] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0132] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0133] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0134] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A method of monitoring a network of devices, the method comprising: The method comprises: acquiring an associated data packet of a device network; in the case that the associated data packet has not accessed the device network, acquiring original data features of the associated data packet, and monitoring the original data features through a preset whitelist to obtain a first monitoring result of the associated data packet; in the case that the associated data packet has accessed the device network, acquiring interaction behavior features of the associated data packet after accessing the device network, and monitoring the interaction behavior features through the whitelist to obtain a second monitoring result of the associated data packet; based on the first monitoring result and the second monitoring result, obtaining a monitoring result of the device network; wherein the whitelist is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

2. The method of claim 1, wherein, The acquisition of the original data features of the associated data packet comprises: data grabbing and parsing of the associated data packet to acquire target field contents of the associated data packet corresponding to different network levels; the target field contents are taken as the original data features of the associated data packet.

3. The method of claim 2, wherein, The acquisition of the target field contents of the associated data packet corresponding to different network levels comprises: acquiring a length of the associated data packet from a data frame corresponding to a physical layer of the associated data packet; acquiring a source physical address, a destination physical address and a network layer protocol of the associated data packet from an Ethernet frame corresponding to a link layer of the associated data packet; acquiring a source Internet protocol address, a destination Internet protocol address and a transport layer protocol of the associated data packet from an Internet protocol data packet corresponding to a network layer of the associated data packet; acquiring a source port and a destination port of the associated data packet from a message corresponding to a transport layer of the associated data packet; acquiring a source address, a destination address, a source port, a destination port and a command number corresponding to an industrial control protocol of the associated data packet from industrial control protocol data corresponding to an application layer of the associated data packet; the length, the source physical address, the destination physical address and the network layer protocol, the source Internet protocol address, the destination Internet protocol address and the transport layer protocol, the source port and the destination port, and the source address, the destination address, the source port, the destination port and the command number corresponding to the industrial control protocol are taken as the target field contents of the associated data packet corresponding to different network levels.

4. The method of claim 3, wherein, The monitoring of the original data features through the preset whitelist comprises: comparing the length of the associated data packet with a preset maximum value in the whitelist, whether exceeding the preset maximum value; in the case that the maximum value is not exceeded, comparing the source physical address, the destination physical address and the network layer protocol of the associated data packet with the whitelist to see whether they are consistent; in the case of consistency, comparing the source Internet protocol address, the destination Internet protocol address and the transport layer protocol of the associated data packet with the whitelist to see whether they are consistent; in the case of consistency, matching the source port and the destination port of the associated data packet with the whitelist. In the case of matching, the source address, the destination address, the source port and the destination port of the associated data packet corresponding to the industrial control protocol are matched with the white list; in the case of matching, the type of the command number and the analysis characteristic value are obtained and matched with the white list.

5. The method of claim 1, wherein, The interaction behavior characteristics of the associated data packet after accessing the device network include: Event monitoring is performed on the associated data packet after accessing the device network to obtain activity event content of the associated data packet after accessing the device network; and the activity event content is taken as the interaction behavior characteristics of the associated data packet after accessing the device network.

6. The method of claim 5, wherein, The activity event content of the associated data packet after accessing the device network includes: Process information, system resources and operation information of the associated data packet after accessing the device network are obtained from event activities generated by the associated data packet in the device; The process information, system resources and operation information are taken as the activity event content.

7. The method of claim 6, wherein, The second monitoring result of the associated data packet is obtained by monitoring the interaction behavior characteristics by the white list, including: The process information, system resources and operation information are compared with the white list to obtain the second monitoring result of the associated data packet.

8. The method according to any one of claims 1 to 7, characterized in that, The method includes: In the case of abnormal first monitoring result, it is determined that the monitoring result of the device network is abnormal, and the associated data packet is prevented from accessing the device network and an abnormal warning information is sent to relevant personnel; In the case of normal first monitoring result and abnormal second monitoring result, it is determined that the monitoring result of the device network is abnormal, and the interaction behavior of the associated data packet in the device network is interrupted and an abnormal warning information is sent to relevant personnel.

9. The method of claim 1, wherein, The white list is constructed by the following steps, including: Based on the historical attack records corresponding to the device network, an attack chain model corresponding to the device network is constructed; Using the attack chain model, an abnormal data packet corresponding to the device network is constructed, the abnormal data packet is accessed to the device network, the abnormal data characteristics of the abnormal data packet not accessing the device network and the abnormal interaction behavior characteristics of the abnormal data packet accessing the device network are obtained; According to the abnormal data characteristics, the abnormal interaction behavior characteristics and the historical normal communication data packet, preset original data characteristics and preset interaction behavior characteristics are obtained; Based on the preset original data characteristics and the preset interaction behavior characteristics, the preset white list is constructed.

10. The method of claim 9, wherein, According to the abnormal data characteristics, the abnormal interaction behavior characteristics and the historical normal communication data packet, preset original data characteristics and preset interaction behavior characteristics are obtained, including: According to the historical normal communication data packet of the device network, the historical normal communication data packet is accessed to the device network, the normal original data characteristics of the historical normal communication data packet not accessing the device network and the normal interaction behavior characteristics of the historical normal communication data packet accessing the device network are obtained; The normal original data features corresponding to the abnormal data features are compared to obtain distinguished data features, and the distinguished data features corresponding to the data features in the normal original data features are taken as the preset original data features; The normal interaction behavior features corresponding to the abnormal interaction behavior features are compared to obtain distinguished interaction behavior features, and the distinguished interaction behavior features corresponding to the behavior features in the normal interaction behavior features are taken as the preset interaction behavior features.

11. A device network monitoring apparatus characterized by comprising: The device comprises: An acquisition module configured to acquire an associated data packet of a device network; A first monitoring module configured to, in a case where the associated data packet has not accessed the device network, acquire original data features of the associated data packet, and monitor the original data features through a preset white list to obtain a first monitoring result of the associated data packet; A second monitoring module configured to, in a case where the associated data packet has accessed the device network, acquire interaction behavior features of the associated data packet after the associated data packet has accessed the device network, and monitor the interaction behavior features through the white list to obtain a second monitoring result of the associated data packet; A result generation module configured to obtain a monitoring result of the device network based on the first monitoring result and the second monitoring result; The white list is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

12. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 10.

13. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 10.

Images