A method for active and passive asset identification in industrial robot systems based on protocol specifications and asset behavior characteristics

Abstract

This invention discloses a method for active and passive asset identification in an industrial robot system based on protocol specifications and asset behavior characteristics. The method is as follows: a system operator analyzes and operates the industrial robot system to complete a complete industrial production process; the communication traffic between each asset throughout its lifecycle is replicated and collected and preprocessed to obtain the communication relationships and behaviors between the assets; asset communication behavior characteristics are extracted to train and test a passive asset identification model; the passive asset identification model is used to classify assets by criticality based on their IP addresses, and a passive asset communication information identification file is output; active asset identification utilizes the passive asset communication information identification file, constructs and sends an asset information request data packet based on the protocol specification, and obtains industrial robot system asset identification information based on the asset response data packet. This method enables lightweight, accurate, and rapid asset identification of assets within an industrial robot system.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet asset identification and relates to an industrial robot system asset identification method, specifically to an industrial robot system active and passive asset identification method based on protocol specifications and asset behavior characteristics. Background Art

[0002] Industrial robot systems are a vital component of the manufacturing industry. As the manufacturing industry continues to evolve toward intelligent systems, they are also gradually developing towards intelligent and networked systems. In this modernization process, they are increasingly integrating with the internet, thereby improving production efficiency and reducing management costs. However, in the early stages of industrial robot system design, they often lack consideration for external network connectivity. Due to their early design and long operational life, most industrial robot systems suffer from lost design plans and system management records. This leads to ambiguity in information about industrial robot models and internal software versions, making it difficult to design targeted security protection measures. Furthermore, given the high real-time and reliability requirements of industrial robot systems, using traditional asset identification technologies can further strain scarce resources and fail to meet the demands of industrial production sites. Therefore, designing asset identification methods for industrial robot systems and implementing security protection based on these methods is of great research significance.

[0003] Regarding asset identification in industrial robot systems, a suitable method is needed due to the large variety of assets in these systems and the difficulty of manual auditing. Traditional network asset identification methods used in industrial robot systems have high resource utilization and are relatively rough in their identification, failing to accurately identify assets. Therefore, a lightweight, broad-coverage, and highly accurate asset identification method is needed. Summary of the Invention

[0004] To address the difficulties of manually identifying asset information in industrial robot systems, the low efficiency and accuracy of traditional asset identification methods, and the significant resource consumption of internal assets within industrial robot systems, this paper provides an active and passive asset identification method for industrial robot systems based on protocol specifications and asset behavior characteristics. This method enables lightweight, accurate, and rapid asset identification of internal assets within industrial robot systems.

[0005] The purpose of the present invention is achieved through the following technical solutions:

[0006] A method for identifying active and passive assets of an industrial robot system based on protocol specifications and asset behavior characteristics includes the following steps:

[0007] Step S1: The system operator analyzes and operates the industrial robot system to complete a complete industrial production process;

[0008] Step S2: Using an industrial switch with a mirroring function, the full life cycle communication traffic between various assets within the industrial robot system is replicated and collected through the mirroring port;

[0009] Step S3: Preprocess the full life cycle communication traffic between the assets within the industrial robot system collected in step S2 to obtain a communication quintuple to represent the communication relationship and behavior between the assets in the system;

[0010] Step S4: Based on the communication quintuple set obtained in step S3, the communication behavior characteristics of the industrial robot system assets are extracted using a behavior feature extraction algorithm, and the asset communication behavior feature library is divided into a training library and a test library;

[0011] Step S5: Using the support vector machine algorithm to build a passive asset recognition model, and using the training library and test library of the asset communication behavior feature library to train and test the passive asset recognition model respectively;

[0012] Step S6: Using the passive asset identification model, classify the assets based on their criticality based on their IP addresses, sort the IP addresses by their criticality, and output a passive asset communication information identification file;

[0013] Step S7: Active asset identification uses the passive asset communication information identification file obtained in step S6 to construct an asset information request data packet according to the protocol specification;

[0014] Step S8: injecting the asset request data packet obtained in step S7 into the industrial robot system and monitoring the response port of the identified asset IP;

[0015] Step S9: Obtain the asset response data packet and parse it to obtain the asset identification information of the industrial robot system.

[0016] Compared with the prior art, the present invention has the following advantages:

[0017] 1. The present invention analyzes the asset communication behavior of industrial robot systems. Based on the different tasks and importance of different assets in the industrial robot system, it prioritizes the accurate identification of key assets. An active asset identification method based on protocol specifications is used to adapt the Modbus TCP and EtherCAT protocols commonly used in industrial robot systems. The method can further expand the protocol types, thereby improving the flexibility, pertinence, and accuracy of asset identification.

[0018] 2. The present invention adopts a passive asset identification method based on asset behavior characteristics to replace the traditional active asset identification method of injecting a large number of detection packets into the system to obtain communication information. It can effectively reduce the impact of asset identification technology on the normal operation of the industrial robot system, and according to the communication characteristics of the industrial robot system, it can achieve full coverage and accurate identification of the internal assets of the industrial robot system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 The flowchart of the active and passive asset identification method of the industrial robot system based on protocol specifications and asset behavior characteristics.

[0020] Figure 2 The figure is a specific flow chart of the active and passive asset identification method for industrial robot systems based on protocol specifications and asset behavior characteristics.

[0021] Figure 3 This is the specific flow chart of the traffic preprocessing algorithm.

[0022] Figure 4 A detailed flow chart constructed for an asset information request packet. DETAILED DESCRIPTION

[0023] The technical solution of the present invention is further described below with reference to the accompanying drawings, but is not limited thereto. Any modification or equivalent replacement of the technical solution of the present invention that does not depart from the spirit and scope of the technical solution of the present invention should be included in the scope of protection of the present invention.

[0024] The present invention provides an active and passive asset identification method for an industrial robot system based on protocol specifications and asset behavior characteristics. Figure 1 As shown, the method includes the following steps:

[0025] Step S1: The system operator analyzes and operates the industrial robot system to complete a complete industrial production process;

[0026] Step S2: Copy and collect the full life cycle communication traffic between the assets within the industrial robot system and pre-process it to obtain a communication quintuple set to represent the communication relationship and behavior between the assets in the system;

[0027] Step S3: Using a behavioral feature extraction algorithm, extract the asset communication behavior features of the industrial robot system, use a support vector machine algorithm to build a passive asset recognition model, and use the training library and test library of the asset behavior communication feature library to train and test the passive asset recognition model respectively;

[0028] Step S4: Using the passive asset identification model, classify the assets based on their criticality based on their IP addresses, sort the IP addresses by their criticality, and output a passive asset communication information identification file;

[0029] Step S5: Active asset identification utilizes the passive asset communication information identification file, constructs and sends an asset information request data packet based on the protocol specification, and obtains the industrial robot system asset identification information based on the returned asset response data packet.

[0030] like Figure 2 The specific implementation steps are as follows:

[0031] Step S1: The system operator analyzes and operates the industrial robot system to complete a complete industrial production process.

[0032] In this step, the typical stages of the industrial production process of the industrial robot system obtained through comparative analysis include: the startup stage of the industrial robot system, the material handling stage, the industrial production stage, the finished product handling stage, and the end stage. Among them, the startup stage of the industrial robot system refers to the industrial robot system starting from the shutdown state, the human-machine interface (HMI) starts to display information, and the programmable logic controller (PLC), robot controller and other control devices, industrial robots, automatic guided vehicles (AGVs), industrial computers, routers and other assets start to start and establish connections with each other; the material handling stage refers to the AGV cart moving materials from the material area to the work area after the system is started; the industrial production stage refers to the process of industrial robots producing materials into finished products, which can be further divided into different work stages according to the tasks and sequence of different industrial robot systems; the finished product handling stage refers to the AGV cart moving the finished product from the work area to the finished product area after the industrial robot system completes the finished product production; the end stage refers to the HMI no longer displaying information, and the PLC and other control devices, industrial robot systems, AGVs and other assets are shut down.

[0033] Step S2: Using an industrial switch with a mirroring function, the full life cycle communication traffic between various assets within the industrial robot system is replicated and collected through the mirroring port.

[0034] In this step, an industrial switch with a mirroring function is used to collect the communication traffic of each communication node of the industrial robot system for a long time during its entire life cycle. The entire life cycle includes: the startup phase of the industrial robot system, the material handling phase, the industrial production phase, the finished product handling phase, and the end phase.

[0035] In this step, traffic collection software such as Wireshark and tcpdump can be used to collect network traffic at the communication node of the industrial robot system from the mirror port of the industrial switch, mainly including: TCP / IP protocol data packets, ModbusTcp data packets, EtherCAT data packets, etc., and output them in the form of pcap files.

[0036] Step S3: Use the traffic preprocessing algorithm to preprocess the full life cycle communication traffic between the assets within the industrial robot system collected in step S2, and obtain a communication quintuple to represent the communication relationship and behavior between the assets in the system.

[0037] In this step, in order to unify the flow data format, it is necessary to preprocess the full life cycle communication traffic between the assets within the industrial robot system. The traffic information is represented by a communication quintuple. The form of the communication quintuple ft is as follows:

[0038] ft=<SrcIP,SrcPort,DstIP,DstPort,SegSize>;

[0039] Where: SrcIP is the source IP address, SrcPort is the source port number, DstIP is the destination IP address, DstPort is the destination port number, and SegSize is the data size.

[0040] like Figure 3 As shown in Figure 2, the traffic preprocessing algorithm mainly includes the following steps:

[0041] Step S31: establishing a communication quintuple based on the full life cycle communication traffic between the assets within the industrial robot system;

[0042] Step S32: parse the collected pcap file, extract the source IP, source port, destination IP, destination port and data packet size in the file, and add them to the communication quintuple;

[0043] Step S33: combining all obtained communication quintuples to form a communication quintuple set;

[0044] Step S34: Calculate the frequency of occurrence of each communication quintuple in the communication quintuple set, and select the communication quintuple with the highest frequency of occurrence as the communication quintuple of the current network segment;

[0045] Step S35: The IP addresses of the remaining communication quintuples are compared with the communication quintuple IP addresses of the current network segment in turn, and the communication quintuples of non-current network segments in the non-communication quintuple set are deleted. The IP addresses are then compared with the broadcast address IP addresses in the segment, and the communication quintuples containing the broadcast address are deleted.

[0046] Step S36: Determine whether the selected communication quintuple is the last communication quintuple. If it is the last communication quintuple, it means that the communication quintuple screening of this network segment is completed, and proceed to step S37; if it is not the last communication quintuple, return to step S35;

[0047] Step S37: Output the communication quintuple set as the industrial robot system communication quintuple set.

[0048] Step S4: Based on the communication quintuple set obtained in step S3, the communication behavior characteristics of the industrial robot system assets are extracted through the behavior feature extraction algorithm, and the asset communication behavior feature library is divided into a training library and a test library.

[0049] In this step, in order to extract the communication behavior characteristics of industrial robot system assets, a behavior feature extraction algorithm is used to mainly extract the following industrial robot system asset communication behavior characteristics:

[0050] 1. Industrial robot system asset communication retention

[0051] Before building an industrial robot system, it is necessary to determine the production process tasks. This task determines that each asset in the industrial robot system needs to complete a certain communication at a certain point in time during its entire life cycle. That is, the communication duration of each asset during the normal operation cycle of the industrial robot system is basically fixed. This feature is exploited by comprehensively considering two statistical data: the occurrence of related communications and the length of the collected messages. This is named the communication retention degree, and the communication retention degree Ck(ft i ) is defined as follows:

[0052]

[0053] Where: IAT is the set of iat, iat is the corresponding communication quintuple ft i The inter-arrival time between communication segments, The corresponding communication quintuple ft in the full life cycle message i Number of occurrences.

[0054] 2. Periodicity of asset communication in industrial robot systems

[0055] The periodicity of asset communication in industrial robot systems is a prominent feature in industrial robot systems. i The periodicity of the arrival interval between each segment, the periodicity Pr(ft i ) is defined as follows:

[0056]

[0057] Where: mean is The average value, variance is The variance of .

[0058] 3. Data volume of industrial robot system communication segment

[0059] Typically, the length of the field used to issue commands is often more than 100 bytes. However, the data size of the message for the slave status check is often less than 100 bytes. This feature helps to distinguish the service status check communication used in the master. i There is a field about the data volume, and the communication segment data volume is defined as Ss(ft i ).

[0060] 4. Gap in the complexity of industrial robot system assets and functions

[0061] In industrial robot systems, there is a huge difference between operating devices and control devices in terms of the use of different network ports. This is because operating devices only provide simple periodic reporting and emergency device status control functions through fixed network ports, while control devices must communicate with many operating devices simultaneously and provide support for other services. The asset functional complexity gap is defined based on the number of different network ports used by the asset (i.e., the cardinality of the network port set). The asset functional complexity gap Cg(ft i ) is defined as follows:

[0062]

[0063] Where: Pt srcIP The network port set used by srcIP throughout its life cycle.

[0064] 5. Industrial robot system asset port dependence

[0065] In order to distinguish the relationship between control devices and field devices in industrial robot system communication, the asset port dependency feature is introduced. Most field devices use the same port, but control devices may have a dynamic port allocation mechanism, which makes the port dependency of field devices higher and the port dependency of control devices lower. The asset port dependency Np(ft i ) is defined as follows:

[0066]

[0067] Where: PU (Port,SrcIP,DstIP) Represents a triple<Port,SrcIP,DstIP> The degree to which different assets use this network port.

[0068] Step S5: Use the support vector machine algorithm to build a passive asset recognition model, and use the training library and test library of the asset communication behavior feature library to train and test the passive asset recognition model respectively.

[0069] Step S6: Using the passive asset identification model, the assets are classified according to their criticality based on the IP addresses, and the IP addresses are sorted according to their criticality, and a passive asset communication information identification file is output.

[0070] In this step, in order to filter out assets that have a greater impact on the normal operation of the industrial robot system, it is necessary to sort the criticality of the assets, and the score vector f * is defined as follows:

[0071]

[0072] According to the sorting function f * By calculating the score ranking of different asset IPs in the system, we can infer the score ranking of different asset IPs in the system to ensure that more important assets can be identified first in the next step.

[0073] Step S7: Active asset identification uses the passive asset communication information identification file obtained in step S6 to construct an asset information request data packet according to the protocol specification.

[0074] In this step, in order to accurately obtain detailed information about the assets in the industrial robot system, it is necessary to construct the asset information request data packet according to the different communication protocols used to ensure normal communication with the target asset and obtain response information.

[0075] like Figure 4 As shown, constructing an asset information request data packet mainly includes the following steps:

[0076] Step S71: Active asset identification uses the passive asset communication information identification file obtained in step S6 to obtain the IP address, MAC address, open port, and communication protocol information used by the asset to be identified;

[0077] Step S72: Determine the communication protocol used by the asset. If it is Modbus TCP, proceed to step S73; if it is EtherCAT, proceed to step S77.

[0078] Step S73: Using the Modbus TCP protocol, construct an MBAP message header, including: a transaction identifier, a protocol identifier, a length field, and a unit identifier, wherein the length field is calculated in step S76;

[0079] Step S74: Select the Modbus TCP function code, and use the function code 0x2B for reading the device identification code;

[0080] Step S75: Construct the Modbus TCP data area content, including: MEI type, ReadDevId code and object ID;

[0081] Step S76: Calculate the value of the data length based on the sum of the unit identifier, function code, and data area content length constructed in steps S73 to S75, and proceed to step S712;

[0082] Step S77: Using the EtherCAT protocol, construct an Ethernet frame header, including the destination address, source address, and frame type, where the frame type is fixed to 0x88a4;

[0083] Step S78: Construct an EtherCAT header, including the EtherCAT data length, reserved bits, and type. The length will be calculated in S710.

[0084] Step S79: Construct EtherCAT data, including the sub-message header and data, wherein the length field in the sub-message header will be calculated in step S710;

[0085] Step S710: Calculate the EtherCAT data length and the EtherCAT sub-message length;

[0086] Step S711: Construct EtherCAT message data, calculate the frame check sequence using the cyclic redundancy check code, and proceed to step S712;

[0087] Step S712: Perform network layer encapsulation on the constructed application layer data to obtain an asset request data packet.

[0088] Step S8: Inject the asset request data packet obtained in step S7 into the industrial robot system and monitor the response port of the identified asset IP.

[0089] Step S9: Obtain the asset response data packet and parse it to obtain relatively accurate and specific industrial robot system asset identification information.

[0090] Example:

[0091] In this embodiment, the specific implementation steps of the active and passive asset identification method for an industrial robot system based on protocol specifications and asset behavior characteristics are as follows:

[0092] Step S1: The system operator analyzes and operates the industrial robot system to complete a complete industrial production process.

[0093] Step S2: Using an industrial switch with a mirroring function, the full life cycle communication traffic between the assets within the industrial robot system is replicated and collected through the mirroring port. The full life cycle operation time of the collected industrial robot system is about 10 minutes, and about 61,800 flow information items are collected. Non-target protocol traffic (except TCP, UDP, ModbusTCP, and EtherCAT traffic data packets) is removed from the traffic, and finally about 46,200 flow information data items are obtained.

[0094] Step S3: Preprocess the collected 46,200 pieces of internal communication traffic data of the industrial robot system, extract the source IP address SrcIP, source port number SrcPort, destination IP address DstIP, destination port number DstPort, and data size SegSize in the traffic, and obtain the communication quintuple ft = <SrcIP, SrcPort, DstIP, DstPort, SegSize> to represent the communication relationship and behavior between the assets in the system.

[0095] In this step, the traffic preprocessing algorithm mainly includes the following steps:

[0096] Step S31: According to the full life cycle traffic of the industrial robot system, a communication five-tuple format such as ft = <SrcIP, SrcPort, DstIP, DstPort, SegSize> is established.

[0097] Step S32: parse the collected pcap file, extract the source IP, source port, destination IP, destination port and data packet size in the file, and add them to the communication quintuple (e.g. ft1 = <192.168.39.14,3000,192.168.39.220,53568,106>).

[0098] Step S33: Combine all the obtained communication quintuples to form the industrial robot system communication quintuple set FT 工业机器人 ={ft1, ft2, ..., ft 42}.

[0099] Step S34: Calculate the frequency of occurrence of each communication quintuple in the communication quintuple set, and select the communication quintuple with the highest frequency as the communication quintuple of this network segment. In this collection, ft1=<192.168.39.14,3000,192.168.39.220,53568,106> appears 960 times and is selected as the communication quintuple of this network segment.

[0100] Step S35: The remaining communication quintuple IPs are compared with the communication quintuple IPs of the current network segment, and the communication quintuples of non-current network segments in the non-communication quintuple set are deleted. Then, the communication quintuples are compared with the broadcast address IPs in the segment, and the communication quintuples containing the broadcast address are deleted. 20 =<192.168.0.11,1740,192.168.0.255,1742,60> is compared with ft1 and ft is deleted. 20 , ft 42 =<0.0.0.0,68,255.255.255.255,67,344> is UDP broadcast, and the related quintuple information is also deleted.

[0101] Step S36: Determine whether the selected communication quintuple is the last communication quintuple. If it is the last communication quintuple, it means that the screening of the communication quintuples in this network segment is completed, and proceed to S37; if it is not the last communication quintuple, return to S35.

[0102] Step S37: Output communication quintuple set FT 工业机器人 The communication quintuple set for industrial robot systems.

[0103] Step S4: Based on the communication quintuple set obtained in step S3, the communication behavior characteristics of the industrial robot system assets are extracted through the behavior feature extraction algorithm, and the asset communication behavior feature library is divided into a training library and a test library.

[0104] Taking ft1 as an example, the communication retention degree Ck(ft1) of the industrial robot system asset, the periodicity Pr(ft1) of the industrial robot system asset communication, the data volume Ss(ft1) of the industrial robot system asset communication segment, the functional complexity gap Cg(ft1) of the industrial robot system asset, and the port dependency Np(ft1) of the industrial robot system asset are extracted and saved in the asset behavior feature library.

[0105] Step S5: Use the support vector machine algorithm to build a passive asset recognition model, and use the training library and test library of the asset communication behavior feature library to train and test the passive asset recognition model respectively.

[0106] Step S6: Using the passive asset identification model, the assets are classified according to their criticality based on the IP addresses, and the IP addresses are sorted according to their criticality, and a passive asset communication information identification file is output.

[0107] Taking ft1 as an example, calculate the asset criticality score of the industrial robot system After calculation, the industrial robot system assets are sorted according to the scores and saved in the passive asset communication information identification file.

[0108] Step S7: Active asset identification uses the passive asset communication information identification file obtained in step S6 to construct an asset information request data packet according to the protocol specification. The specific steps for constructing the asset information request data packet are as follows:

[0109] Step S71: Active asset identification uses the passive asset communication information identification file obtained in step S6 to obtain the IP address, MAC address, open port, and communication protocol information of the asset to be identified. For example, the asset IP address is 192.168.39.14, the MAC address is 02:07:32:7f:34:54, the open ports are 80 and 3000, and the protocols used include TCP and Modbus TCP.

[0110] Step S72: Determine the communication protocol used by the asset. If it is Modbus TCP, proceed to step S73; if it is EtherCAT, proceed to step S77.

[0111] Step S73: Using the Modbus TCP protocol, construct an MBAP message header, including: a transaction identifier, a protocol identifier, a length field, and a unit identifier. The length field is calculated in step S76. The transaction identifier can be set to "0x000x00", the protocol identifier is fixed to "0x000x00", and the unit identifier is "0x01".

[0112] Step S74: Select the Modbus TCP function code, and use the function code 0x2B for reading the device identification code;

[0113] Step S75: Construct the Modbus TCP data area content, which includes: MEI type, ReadDevId code and object ID. The MEI type can be set to "0x0E", the ReadDevId code to "0x01 / 0x02", etc., and the object ID is "0x01" to "0xFF";

[0114] Step S76: Calculate the value of the data length based on the sum of the unit identifier, function code, and data area content length constructed in steps S73 to S75, and proceed to step S712;

[0115] Step S77: Using the EtherCAT protocol, an Ethernet frame header is constructed, including the destination address, source address, and frame type. The frame type is fixed to 0x88a4, and the source address is "0x000x300x6C 0x000x000x02".

[0116] Step S78: Construct an EtherCAT header, which includes the EtherCAT data length, reserved bits, and type. The length will be calculated in S710. The reserved bits in the EtherCAT header are fixed to 1, and the type data bits are fixed to "0001".

[0117] Step S79: Construct EtherCAT data, including a sub-message header and data, wherein the length field in the sub-message header will be calculated in step S710;

[0118] Step S710: Calculate the EtherCAT data length and the EtherCAT sub-message length;

[0119] Step S711: Construct EtherCAT message data, calculate the frame check sequence using the cyclic redundancy check code, and proceed to step S712;

[0120] Step S712: Perform network layer encapsulation on the constructed application layer data to obtain an asset request data packet.

[0121] Step S8: injecting the asset request data packet obtained in step S7 into the industrial robot system and monitoring the response port of the identified asset IP;

[0122] Step S9: Obtain the asset response data packet and parse it to obtain relatively accurate and specific industrial robot system asset identification information.

Claims

1. A method for identifying active and passive assets in an industrial robot system based on protocol specifications and asset behavior characteristics, characterized by The method comprises the following steps: Step S1: The system operator analyzes and operates the industrial robot system to complete a complete industrial production process; Step S2: Using an industrial switch with a mirroring function, the full life cycle communication traffic between various assets within the industrial robot system is replicated and collected through the mirroring port; Step S3: Preprocess the full life cycle communication traffic between the assets within the industrial robot system collected in step S2 to obtain a communication quintuple to represent the communication relationship and behavior between the assets in the system; Step S4: Based on the communication quintuple set obtained in step S3, the communication behavior characteristics of the industrial robot system assets are extracted using a behavior feature extraction algorithm, and the asset communication behavior feature library is divided into a training library and a test library; Step S5: Using the support vector machine algorithm to build a passive asset recognition model, and using the training library and test library of the asset communication behavior feature library to train and test the passive asset recognition model respectively; Step S6: Using the passive asset identification model, classify the assets based on their criticality based on their IP addresses, sort the IP addresses by their criticality, and output a passive asset communication information identification file; Step S7: Active asset identification uses the passive asset communication information identification file obtained in step S6 to obtain the IP address, MAC address, open port, and communication protocol information of the asset to be identified, and constructs an asset information request data packet according to the communication protocol specification used; Step S8: injecting the asset request data packet obtained in step S7 into the industrial robot system and monitoring the response port of the identified asset IP; Step S9: Obtain the asset response data packet and parse it to obtain the asset identification information of the industrial robot system.

2. The active and passive asset identification method for an industrial robot system based on protocol specifications and asset behavior characteristics according to claim 1 is characterized in that In step S1 , typical stages of an industrial production process include: a startup stage of an industrial robot system, a material handling stage, an industrial production stage, a finished product handling stage, and an end stage.

3. The method for identifying active and passive assets of an industrial robot system based on protocol specifications and asset behavior characteristics according to claim 1 is characterized in that In step S2, the entire life cycle includes: the startup phase of the industrial robot system, the material handling phase, the industrial production phase, the finished product handling phase, and the end phase.

4. The method for identifying active and passive assets of an industrial robot system based on protocol specifications and asset behavior characteristics according to claim 1 is characterized in that In step S2, traffic collection software is used to collect network traffic at the communication node of the industrial robot system from the mirror port of the industrial switch, including: TCP / IP protocol data packets, Modbus TCP data packets, and EtherCAT data packets, and output them in the form of a pcap file.

5. The method for identifying active and passive assets of an industrial robot system based on protocol specifications and asset behavior characteristics according to claim 1 is characterized in that The specific steps of S3 are as follows: Step S31: establishing a communication quintuple based on the full life cycle communication traffic between the assets within the industrial robot system; Step S32: parse the collected pcap file, extract the source IP, source port, destination IP, destination port and data packet size in the file, and add them to the communication quintuple; Step S33: combining all obtained communication quintuples to form a communication quintuple set; Step S34: Calculate the frequency of occurrence of each communication quintuple in the communication quintuple set, and select the communication quintuple with the highest frequency of occurrence as the communication quintuple of the current network segment; Step S35: The IP addresses of the remaining communication quintuples are compared with the communication quintuple IP addresses of the current network segment in turn, and the communication quintuples of non-current network segments in the non-communication quintuple set are deleted. The IP addresses are then compared with the broadcast address IP addresses in the segment, and the communication quintuples containing the broadcast address are deleted. Step S36: Determine whether the selected communication quintuple is the last communication quintuple. If it is the last communication quintuple, it means that the communication quintuple screening of this network segment is completed, and proceed to step S37; if it is not the last communication quintuple, return to step S35; Step S37: Output the communication quintuple set as the industrial robot system communication quintuple set.

6. The method for identifying active and passive assets of an industrial robot system based on protocol specifications and asset behavior characteristics according to claim 1 or 5, characterized in that The communication quintuple The form is as follows: ； Where: is the source IP address, is the source port number, is the destination IP address, is the destination port number, is the data size.

7. The method for identifying active and passive assets of an industrial robot system based on protocol specifications and asset behavior characteristics according to claim 6 is characterized in that In step S4, the industrial robot system asset communication behavior characteristics include: industrial robot system asset communication maintenance degree , Periodicity of asset communication in industrial robot systems , Data volume of industrial robot system communication segment , the gap in the complexity of industrial robot system assets and functions and industrial robot system asset port dependency .

8. The method for identifying active and passive assets of an industrial robot system based on protocol specifications and asset behavior characteristics according to claim 7 is characterized in that The communication retention degree The definition is as follows: Where: for A collection of is the corresponding communication quintuple The inter-arrival time between communication segments, For the corresponding communication quintuple in the full life cycle message Number of occurrences; Periodicity The definition is as follows: Where: for The average value of for variance; Asset Functional Complexity Gap The definition is as follows: Where: for The set of network ports used throughout the life cycle, for The set of network ports used throughout the lifecycle; Asset port dependency The definition is as follows: Where: Represents a triple The degree of use of the network port by different assets in Represents a triple The degree to which different assets use this network port.

9. The method for identifying active and passive assets of an industrial robot system based on protocol specifications and asset behavior characteristics according to claim 7 is characterized in that In step S6, in order to filter out assets that have a greater impact on the normal operation of the industrial robot system, it is necessary to sort the criticality of the assets, and the score vector is defined as follows: According to the sorting function The calculation can be used to infer the score ranking of different asset IPs in the system.

10. The method for identifying active and passive assets of an industrial robot system based on protocol specifications and asset behavior characteristics according to claim 1 is characterized in that The specific steps of step S7 are as follows: Step S71: Active asset identification uses the passive asset communication information identification file obtained in step S6 to obtain the IP address, MAC address, open port, and communication protocol information used by the asset to be identified; Step S72: Determine the communication protocol used by the asset. If it is Modbus TCP, proceed to step S73; if it is EtherCAT, proceed to step S77. Step S73: Using the Modbus TCP protocol, constructing an MBAP message header, including: a transaction identifier, a protocol identifier, a length field, and a unit identifier; Step S74: Select the Modbus TCP function code, and use the function code 0x2B for reading the device identification code; Step S75: Construct the Modbus TCP data area content, including: MEI type, ReadDevId code and object ID; Step S76: Calculate the value of the data length based on the sum of the unit identifier, function code, and data area content length constructed in steps S73 to S75, and proceed to step S712; Step S77: Using the EtherCAT protocol, construct an Ethernet frame header, including the destination address, source address, and frame type, where the frame type is fixed to 0x88a4; Step S78: Construct an EtherCAT header, including EtherCAT data length, reserved bits, and type; Step S79: Construct EtherCAT data, including sub-message header and data; Step S710: Calculate the EtherCAT data length and the EtherCAT sub-message length; Step S711: Construct EtherCAT message data, calculate the frame check sequence using the cyclic redundancy check code, and proceed to step S712; Step S712: Perform network layer encapsulation on the constructed application layer data to obtain an asset request data packet.

Images