Vulnerability stain detection system based on industrial asset fingerprint identification

Abstract

The invention relates to the technical field of vulnerability detection, in particular to an industrial asset fingerprint identification-based vulnerability stain detection system, which comprises a data acquisition module, a data analysis module, a fingerprint identification module, a vulnerability matching module, a stain analysis module and a verification module. The flow data of each industrial asset device in operation is collected in real time to generate fingerprint information of the industrial asset device, the data collected in real time is matched with a vulnerability library according to the fingerprint information, existing known vulnerabilities are identified, and possible taint propagation paths are deduced according to network topology and taint sources by constructing a network topological graph, so that the taint propagation efficiency is improved. The method comprises the following steps: identifying affected equipment, evaluating the flow change of the affected equipment, calculating the influence degree of a taint source on a network, identifying abnormal activities in a taint propagation process, evaluating the network security risk, and adjusting a monitoring strategy and a threshold value in time according to an evaluation result to ensure the accuracy and reliability of a monitoring system.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and in particular to a vulnerability stain detection system based on industrial asset fingerprint recognition. Background Art

[0002] Industrial asset fingerprinting is a technology that identifies and describes the hardware, operating system, running software and related configuration parameters of equipment in industrial control systems. This fingerprint information can be used to remotely identify devices and help system administrators understand the specific configuration and status of the equipment. In recent years, with the widespread application of industrial control systems (ICS), device identification technology has developed rapidly, rapidly expanding from general fields to various industrial sectors, and has achieved remarkable results. Fingerprint recognition technology has been widely used in ICT systems to discover system vulnerabilities and detect attack behaviors.

[0003] The vulnerability database is a database that stores information about known vulnerabilities, including descriptions of the vulnerabilities, scope of impact, and methods of exploitation. By matching the identified device fingerprint with the information in the vulnerability database, possible security vulnerabilities in the device can be quickly discovered, providing a basis for subsequent vulnerability repair and protection work.

[0004] Unknown vulnerability taint analysis is a detection and analysis technology for unknown vulnerabilities. After discovering potential security threats, the clarmAv virus detection engine finds tainted files, i.e. virus files, and then uses log tracing analysis to find suspicious processes and other contaminated files.

[0005] A Chinese patent document with publication number CN117668854A discloses a vulnerability detection and assessment method and device based on industrial control asset fingerprint recognition. By collecting and analyzing fingerprint information of different assets, it is possible to identify assets with similar asset fingerprints, reduce the score differences caused by manual selection of different attribute values ​​under the same circumstances, improve the repeatability of vulnerability scores, and based on the principle of similarity association, infer that they may face the same or similar risks and vulnerabilities; it can be seen that the existing fingerprint library needs to be updated and maintained and there is a lag, and the flow data often contains multiple protocols and complex interaction processes, which makes the vulnerability identification in the traditional monitoring system inaccurate and it is difficult to ensure the stable operation of the power industrial control network. Summary of the invention

[0006] To this end, the present invention provides a vulnerability and taint detection system based on industrial asset fingerprint recognition, so as to overcome the problem in the prior art of lack of hierarchical anomaly detection, i.e., first analyzing the percentage of traffic change and then further analyzing the number of abnormal connections, as well as the lack of verification of the validity of the taint detection results, resulting in low accuracy of the detection system.

[0007] To achieve the above object, the present invention provides a vulnerability and stain detection system based on industrial asset fingerprint recognition, comprising: A data acquisition module is used to obtain the flow data corresponding to each industrial asset device in operation in the industrial control network environment; A data analysis module, which is connected to the data acquisition module and is used to extract key information from the flow data; A fingerprint recognition module, which is connected to the data analysis module and is used to generate fingerprint information of each industrial asset device based on key information; A vulnerability matching module, which is connected to the data parsing module and is used to match fingerprint information with a vulnerability library to identify known vulnerabilities; A taint analysis module, which is connected to the vulnerability matching module, is used to determine the taint propagation path according to the network location of the taint source and the analysis results of the associated devices connected thereto, and to monitor the flow data of each industrial asset device in real time to determine the degree of influence of the taint source on the associated devices, and to determine the risk level of the vulnerability taint according to the degree of influence; Wherein, industrial asset equipment with known vulnerabilities is identified as the taint source; The verification module is connected to the stain analysis module and is used to adjust the standard flow change percentage according to the missed recognition rate and error rate of the vulnerability stain.

[0008] Furthermore, the taint analysis module includes a taint propagation analysis unit, a traffic monitoring unit, a taint analysis unit and a level determination unit, wherein: The taint propagation analysis unit is used to determine the device directly connected to the taint source according to the network topology, obtain a number of associated devices, and determine the taint propagation path according to the connection relationship between the associated devices; The flow monitoring unit monitors the flow data of each industrial asset device in real time to identify abnormal behavior patterns, and marks the industrial asset device identified as having abnormal behavior patterns as risky equipment; The taint analysis unit is used to analyze whether the abnormal behavior of the risk device is related to the known vulnerability, so as to determine the impact of the taint source on the associated device; The level determination unit determines the risk level of the vulnerability stain according to the impact degree.

[0009] Furthermore, the taint propagation analysis unit determines the device directly connected to the taint source according to the network topology, and obtains a plurality of associated devices, wherein: The network topology diagram is used to represent the connection relationship between various industrial asset devices; According to the network location of the pollution source, analyze the industrial assets and equipment directly connected to it, and mark the affected industrial assets and equipment as associated equipment; Among them, the affected industrial assets and equipment are determined through network protocols.

[0010] Furthermore, the flow monitoring unit monitors the flow data of each industrial asset device in real time to identify abnormal behavior patterns including: Extracting flow characteristics from the flow data, the flow characteristics including the initial flow corresponding to the beginning of a preset monitoring period, the current flow corresponding to the end of a preset monitoring period, and the connection frequency; Calculate the real-time flow change percentage within the preset monitoring period based on the initial flow and current flow; Compare the standard traffic change percentage with the real-time traffic change percentage, and determine whether to identify it as the first abnormal behavior pattern based on the comparison result: If the real-time flow rate change percentage is greater than the standard flow rate change percentage, determine the corresponding industrial asset equipment There is abnormal behavior, and the abnormal behavior is the first abnormal behavior pattern; If the real-time traffic change percentage is less than or equal to the standard traffic change percentage, the standard abnormal connection number is compared with the real-time abnormal connection number to determine whether to identify it as the second abnormal behavior pattern.

[0011] Further, the flow monitoring unit determines whether to identify the second abnormal behavior pattern, including: If the real-time abnormal connection number is greater than the standard abnormal connection number, it is determined that the corresponding industrial asset equipment has abnormal behavior, and the abnormal behavior is the second abnormal behavior mode; If the number of real-time abnormal connections is less than or equal to the number of standard abnormal connections, it is determined that the corresponding industrial asset equipment does not have abnormal behavior; Among them, the traffic monitoring unit obtains the number of real-time abnormal connections by obtaining the number of connection frequencies exceeding the standard connection range within a preset monitoring period; the abnormal behavior pattern includes a first abnormal behavior pattern and a second abnormal behavior pattern, the first abnormal behavior pattern is burst traffic, and the second abnormal behavior pattern is frequent connection.

[0012] Furthermore, the taint analysis unit analyzes whether the abnormal behavior of the risky device is related to the known vulnerability, including: If the industrial asset device corresponding to the known vulnerability is a risky device, determine the impact of the taint source on any associated device based on the connection duration and abnormal behavior pattern; If the industrial asset equipment corresponding to the known vulnerability is not a risky equipment, the industrial asset equipment corresponding to the known vulnerability is marked as a first-level tainted vulnerability equipment, and the risk level corresponding to the first-level tainted vulnerability equipment is first-level risk.

[0013] Further, determining the influence of the taint source on any associated device based on the connection duration and abnormal behavior pattern includes: Get the duration of the connection between the tainted source and any associated device; Compare the standard connection time to the connection duration: If the connection duration is less than or equal to the standard connection time, determine the impact of the taint source on any associated device based on the abnormal behavior pattern; If the connection duration is greater than the standard connection time, the industrial asset equipment corresponding to the known vulnerability will be marked as a level 4 taint vulnerability device, and the risk level corresponding to the level 4 taint vulnerability device is level 4 risk.

[0014] Further, determining the influence of the taint source on any associated device based on the abnormal behavior pattern includes: If the abnormal behavior pattern is a first-level abnormal behavior pattern, the industrial asset equipment corresponding to the known vulnerability is marked as a second-level tainted vulnerability equipment, and the risk level corresponding to the second-level tainted vulnerability equipment is a second-level risk; If the abnormal behavior pattern is a level 2 abnormal behavior pattern, the industrial asset equipment corresponding to the known vulnerability will be marked as a level 3 tainted vulnerability equipment, and the risk level corresponding to the level 3 tainted vulnerability equipment is level 3 risk.

[0015] Furthermore, the verification module adjusts the standard flow change percentage according to the real-time missed recognition rate of the vulnerability stain, including: Calculate the real-time missed recognition rate at level 3 risk and level 2 risk within the preset verification cycle. Determine the real-time missed recognition rate based on the allowed missed recognition rate: If the real-time missed recognition rate is less than or equal to the allowed missed recognition rate, the standard flow change percentage will not be adjusted; If the real-time missed recognition rate is greater than the allowable missed recognition rate, the standard flow change percentage is adjusted; Among them, the standard flow change percentage is adjusted to the corrected flow change percentage, the corrected flow change percentage is the product of the standard flow change percentage and the correction step length, the correction step length is the difference between 1 and the correction degree, and the correction degree is the ratio of the part of the real-time missed recognition rate that exceeds the allowable missed recognition rate to the real-time missed recognition rate.

[0016] Furthermore, the fingerprint recognition module generates fingerprint information of each industrial asset device based on key information, including: Define fingerprint characteristics of fingerprint information, including: device type, software version, device manufacturer, and network behavior pattern of the device; Generate fingerprint information of the device based on key information and fingerprint features; Use hash algorithm to encrypt fingerprint information; The generated fingerprint information is stored in the fingerprint database.

[0017] Compared with the prior art, the beneficial effect of the present invention lies in that, by collecting the flow data of each industrial asset equipment in operation in real time, the industrial assets running in the network are identified and their fingerprint information is generated. Through fingerprint recognition, the devices running in the network and their types are quickly identified, thereby providing a basis for subsequent security analysis and vulnerability detection, that is, the real-time collected data is matched with the vulnerability library according to the fingerprint information to identify existing known vulnerabilities, and by constructing a network topology map, according to the network topology and the taint source, the possible taint propagation path is inferred, the affected devices are identified, and the flow changes of the affected devices are evaluated, and the degree of influence of the taint source on the network is calculated to identify abnormal activities in the taint propagation process, evaluate network security risks, and adjust the monitoring strategy and threshold in time according to the evaluation results to ensure the accuracy and reliability of the monitoring system, help network administrators quickly locate affected devices, perform troubleshooting and repair, and improve the efficiency and accuracy of network security management.

[0018] Furthermore, by first analyzing the percentage of traffic change, burst traffic can be quickly identified. Since some devices may have frequent connections during normal operation, but if the traffic change is within the normal range, these connections can be considered normal. Therefore, when the percentage of traffic change is normal, the number of connections is analyzed again, that is, possible major problems are first identified through traffic changes, and then the number of connections is used to further confirm whether there are other types of abnormal behaviors. This hierarchical detection method can improve the overall efficiency and accuracy of the system, effectively reduce the possibility of false alarms, thereby avoiding unnecessary alarms, and concentrating resources for in-depth analysis when traffic is abnormal, and reducing the frequency of monitoring the number of connections when traffic is normal, thereby optimizing resource utilization, providing a more comprehensive security situation awareness, and better understanding of dynamic changes in the network environment.

[0019] Furthermore, by calculating and evaluating the missed detection rate, and adjusting the percentage of standard traffic change according to the missed detection rate of the vulnerability stain, the performance of the monitoring mechanism can be effectively evaluated, and the monitoring standards can be dynamically adjusted according to the evaluation results to more flexibly adapt to changes in the network environment and ensure that the monitoring standards are always consistent with the actual situation. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a structural schematic diagram of a vulnerability and stain detection system based on industrial asset fingerprint recognition according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a stain analysis module according to an embodiment of the present invention; Figure 3 It is a flowchart of several associated devices of the taint propagation analysis unit according to an embodiment of the present invention; Figure 4This is a flow chart of a fingerprint recognition module according to an embodiment of the present invention generating fingerprint information of each industrial asset device based on key information. DETAILED DESCRIPTION

[0021] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0022] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0023] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0024] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0025] See also Figure 1 As shown, it is a structural schematic diagram of a vulnerability and stain detection system based on industrial asset fingerprint recognition according to an embodiment of the present invention. The present invention provides a vulnerability and stain detection system based on industrial asset fingerprint recognition, including: A data acquisition module is used to obtain the flow data corresponding to each industrial asset device in operation in the industrial control network environment; A data analysis module, which is connected to the data acquisition module and is used to extract key information from the flow data; A fingerprint recognition module, which is connected to the data analysis module and is used to generate fingerprint information of each industrial asset device based on key information; A vulnerability matching module, which is connected to the data parsing module and is used to match fingerprint information with a vulnerability library to identify known vulnerabilities; A taint analysis module, which is connected to the vulnerability matching module, is used to determine the taint propagation path according to the network location of the taint source and the analysis results of the associated devices connected thereto, and to monitor the flow data of each industrial asset device in real time to determine the degree of influence of the taint source on the associated devices, and to determine the risk level of the vulnerability taint according to the degree of influence; Wherein, industrial asset equipment with known vulnerabilities is identified as the taint source; The verification module is connected to the stain analysis module and is used to adjust the standard flow change percentage according to the missed recognition rate and error rate of the vulnerability stain.

[0026] The data analysis module in this embodiment adopts the mirror traffic technology to copy the traffic data of a specific port to the analysis device, clean and format the collected traffic data, filter out irrelevant control information and invalid data packets, convert the data packets into a unified format, and extract key information, which includes source IP, target IP, protocol type, data packet size, timestamp, etc.; matching of known vulnerabilities refers to comparing the device features collected in real time with the information in the known vulnerability library to identify whether the device has known security vulnerabilities; only through accurate fingerprint recognition can vulnerability matching be effectively performed. Through fingerprint recognition, the device type and version in the network can be quickly identified, thereby narrowing the scope of vulnerability matching and improving detection efficiency. Fingerprint recognition can update device information in real time to ensure the accuracy and timeliness of vulnerability matching, and with the update of the device or the application of patches, changes in fingerprint information can help to identify new vulnerabilities in a timely manner.

[0027] By collecting the flow data of each industrial asset device in operation in real time, the industrial assets running in the network are identified and their fingerprint information is generated. Through fingerprint recognition, the devices running in the network and their types can be quickly identified, thus providing a basis for subsequent security analysis and vulnerability detection, that is, the real-time collected data is matched with the vulnerability library according to the fingerprint information to identify existing known vulnerabilities. By building a network topology map, the possible taint propagation path is inferred according to the network topology and taint source, the affected devices are identified, and the flow changes of the affected devices are evaluated. The impact of the taint source on the network is calculated to identify abnormal activities during the taint propagation process and evaluate network security risks. According to the evaluation results, the monitoring strategy and threshold are adjusted in time to ensure the accuracy and reliability of the monitoring system, help network administrators quickly locate affected devices, troubleshoot and repair, and improve the efficiency and accuracy of network security management.

[0028] See also Figure 2 As shown, it is a schematic diagram of the structure of the stain analysis module of an embodiment of the present invention; Specifically, the taint analysis module includes a taint propagation analysis unit, a traffic monitoring unit, a taint analysis unit, and a level determination unit, wherein: The taint propagation analysis unit is used to determine the device directly connected to the taint source according to the network topology, obtain a number of associated devices, and determine the taint propagation path according to the connection relationship between the associated devices; The flow monitoring unit monitors the flow data of each industrial asset device in real time to identify abnormal behavior patterns, and marks the industrial asset device identified as having abnormal behavior patterns as risky equipment; The taint analysis unit is used to analyze whether the abnormal behavior of the risk device is related to the known vulnerability, so as to determine the impact of the taint source on the associated device; The level determination unit determines the risk level of the vulnerability stain according to the impact degree.

[0029] The taint propagation path in this embodiment is the industrial asset device on the same network segment. For example, in an industrial control system, industrial asset device A is the taint source. Industrial asset device A is a PLC (programmable logic controller) running outdated software and known to have security vulnerabilities. Device B is a sensor directly connected to device A, device C is a monitoring system connected to device B, and device D is a management server connected to device C. At the beginning of the attack, the attacker successfully invaded the PLC by exploiting the known vulnerability of industrial asset device A. The taint propagation path is: device A (taint source) → device B → device C → device D; by constructing a network topology, a network topology diagram is used to represent the connection relationship between devices, including switches, routers, and terminal devices; by monitoring the behavior of the device, any abnormal or unusual activities can be discovered in a timely manner. By analyzing the behavior pattern of the device and combining the propagation path of the taint source, potential unknown vulnerabilities can be identified; See also Figure 3 As shown, it is a flow chart of several associated devices of the taint propagation analysis unit according to an embodiment of the present invention; Specifically, the taint propagation analysis unit determines the device directly connected to the taint source according to the network topology, and obtains several associated devices including: Step S101, using a network topology diagram to represent the connection relationship between various industrial asset devices; Step S102, analyzing the industrial asset equipment directly connected to the pollution source according to the network location thereof, and marking the affected industrial asset equipment as associated equipment; Among them, the affected industrial assets and equipment are analyzed through network protocols.

[0030] In this embodiment, topology construction is performed by parsing ARP requests and responses, identifying the IP address and MAC address of the device, and obtaining the connection relationship between the devices through the MAC address table of the switch; the taint source is identified by determining its position in the network topology based on the known taint source IP address; based on the network topology, the devices directly connected to the taint source (such as the devices under the same switch port) are identified, and the IP addresses, MAC addresses, device types and other information of these devices are recorded; the communication through the TCP / IP protocol is monitored, the device exchanging data with the taint source is identified, the TCP connection information is parsed, and the source and target IP addresses are identified.

[0031] Specifically, the flow monitoring unit monitors the flow data of each industrial asset device in real time to identify abnormal behavior patterns including: Extracting flow characteristics from the flow data, the flow characteristics including the initial flow corresponding to the beginning of a preset monitoring period, the current flow corresponding to the end of a preset monitoring period, and the connection frequency; Calculate the real-time flow change percentage within the preset monitoring period based on the initial flow and current flow; Compare the standard traffic change percentage with the real-time traffic change percentage, and determine whether to identify it as the first abnormal behavior pattern based on the comparison result: If the real-time flow rate change percentage is greater than the standard flow rate change percentage, determine the corresponding industrial asset equipment There is abnormal behavior, and the abnormal behavior is the first abnormal behavior pattern; If the real-time traffic change percentage is less than or equal to the standard traffic change percentage, the standard abnormal connection number is compared with the real-time abnormal connection number to determine whether it is identified as a second abnormal behavior pattern; The real-time flow change percentage is the ratio of the flow change to the initial flow.

[0032] Specifically, comparing the standard abnormal connection number with the real-time abnormal connection number to determine whether to identify the second abnormal behavior pattern includes: If the real-time abnormal connection number is greater than the standard abnormal connection number, it is determined that the corresponding industrial asset equipment has abnormal behavior, and the abnormal behavior is the second abnormal behavior mode; If the number of real-time abnormal connections is less than or equal to the number of standard abnormal connections, it is determined that the corresponding industrial asset equipment does not have abnormal behavior; Among them, the number of connection frequencies exceeding the standard connection range within a preset monitoring period is obtained to obtain the real-time abnormal connection number; the abnormal behavior pattern includes a first abnormal behavior pattern and a second abnormal behavior pattern, the first abnormal behavior pattern is burst traffic, and the second abnormal behavior pattern is frequent connection.

[0033] In this embodiment, network traffic monitoring tools (such as Wireshark, tcpdump) are used to capture traffic data in real time; the preset monitoring period is the set traffic monitoring period, the length of which can be adjusted according to specific monitoring requirements and network environment, and can be set to 10 minutes; the standard traffic change percentage indicates the expected value of the traffic change of industrial asset equipment in a specific monitoring period under normal circumstances, and the set standard traffic change percentage is 20%; the standard abnormal connection number is set to 10 times, indicating that under normal circumstances, the number of connections of the device in the monitoring period should not exceed 10 times; by analyzing the traffic changes in the monitoring period, it is determined whether the connection behavior of the device is abnormal, as well as the abnormality level. For example, at the start time of monitoring (for example, 10:00), the device traffic is recorded as 1000MB, and at the end time of monitoring (for example, 10:10), the device traffic is recorded as The traffic volume is 1150MB, and the traffic change is the difference between the current traffic volume and the initial traffic volume (1150MB-1000MB=150MB); the real-time traffic change percentage = (traffic change / initial traffic volume)×100%=(150MB / 1000MB)×100%=15%. The real-time traffic change percentage (15%) is less than the standard traffic change percentage (20%), so the device is not identified as having abnormal behavior during this monitoring period; if in real-time connection monitoring, at the end of the monitoring (for example, 10:10), the number of device connections is recorded as 15 times, the real-time abnormal connection number = the number of connections during the monitoring period - the standard abnormal connection number = 15 times - 10 times = 5 times, the real-time abnormal connection number (15 times) is greater than the standard abnormal connection number (10 times), so it can be determined that the device has abnormal behavior, and the abnormal behavior is the second abnormal behavior mode (frequent connection).

[0034] By first analyzing the percentage of traffic change, burst traffic can be quickly identified. Since some devices may have frequent connections during normal operation, but if the traffic change is within the normal range, these connections can be considered normal. Therefore, when the percentage of traffic change is normal, the number of connections is analyzed again, that is, possible major problems are first identified through traffic changes, and then the number of connections is used to further confirm whether there are other types of abnormal behaviors. This hierarchical detection method can improve the overall efficiency and accuracy of the system, effectively reduce the possibility of false alarms, thereby avoiding unnecessary alarms, and concentrating resources for in-depth analysis when traffic is abnormal, and reducing the frequency of monitoring the number of connections when traffic is normal, thereby optimizing resource usage, providing a more comprehensive security situation awareness, and better understanding of dynamic changes in the network environment.

[0035] Specifically, the taint analysis unit analyzes whether the abnormal behavior of the risk device is related to the known vulnerability, including: If the industrial asset device corresponding to the known vulnerability is a risky device, determine the impact of the taint source on any associated device based on the connection duration and abnormal behavior pattern; If the industrial asset equipment corresponding to the known vulnerability is not a risky equipment, the industrial asset equipment corresponding to the known vulnerability is marked as a first-level tainted vulnerability equipment, and the risk level corresponding to the first-level tainted vulnerability equipment is first-level risk.

[0036] The first-level risk in this embodiment indicates that the security status of the industrial asset equipment is relatively good, the existing vulnerabilities have not been exploited, and no abnormal activities have been detected. In this case, the duration of the preset monitoring period is reduced, and the equipment is regularly monitored in time to ensure that there will be no security problems in the future; the second-level risk indicates that there is a certain security risk. Although the traffic is abnormal, it has not yet been confirmed whether it is malicious activity; the third-level risk indicates that there is a higher security risk. Burst traffic and frequent connections may indicate an ongoing attack or abnormal activity. At this time, in-depth analysis is required immediately to identify the source of the traffic and take defensive measures (such as blocking suspicious IPs, limiting the number of connections, etc.) when necessary; the fourth-level risk indicates that there is a serious security risk. Burst traffic, frequent connections and long connection duration may indicate an ongoing attack or a serious security incident. At this time, emergency response measures need to be taken immediately, including isolating the affected equipment and conducting a comprehensive security audit and analysis to prevent data leakage or service interruption.

[0037] Specifically, the impact of the taint source on any associated device is determined based on the connection duration and abnormal behavior patterns, including: Get the duration of the connection between the tainted source and any associated device; Compare the standard connection time to the connection duration: If the connection duration is less than or equal to the standard connection time, determine the impact of the taint source on any associated device based on the abnormal behavior pattern; If the connection duration is greater than the standard connection time, the industrial asset equipment corresponding to the known vulnerability will be marked as a level 4 taint vulnerability device, and the risk level corresponding to the level 4 taint vulnerability device is level 4 risk.

[0038] In this embodiment, the connection duration indicates the length of time to establish a connection between two devices, from the time the connection is established to the time the connection is closed. A long connection duration indicates abnormal activity, which may be continuous malicious data transmission or a denial of service attack (DoS), in which the attacker consumes resources by maintaining the connection. Therefore, the impact of the vulnerability on network performance is evaluated based on the connection duration. A longer connection duration affects the response speed and resource utilization of the network. The standard connection time is set to 5 minutes, which is an important benchmark for judging whether the device connection behavior is normal.

[0039] Specifically, the influence of the taint source on any associated device is determined based on the abnormal behavior pattern, including: If the abnormal behavior pattern is a level 1 abnormal behavior pattern, the industrial asset equipment corresponding to the known vulnerability is marked as a level 2 tainted vulnerability equipment, and the risk level corresponding to the level 2 tainted vulnerability equipment is level 2 risk; If the abnormal behavior pattern is a level 2 abnormal behavior pattern, the industrial asset equipment corresponding to the known vulnerability will be marked as a level 3 tainted vulnerability equipment, and the risk level corresponding to the level 3 tainted vulnerability equipment is level 3 risk.

[0040] Specifically, the verification module adjusts the standard flow change percentage according to the real-time missed recognition rate of the vulnerability stain, including: Calculate the real-time missed recognition rate at level 3 risk and level 2 risk within the preset verification cycle. Determine the real-time missed recognition rate based on the allowed missed recognition rate: If the real-time missed recognition rate is less than or equal to the allowed missed recognition rate, the standard flow change percentage will not be adjusted; If the real-time missed recognition rate is greater than the allowable missed recognition rate, the standard flow change percentage is adjusted; Among them, the standard flow change percentage is adjusted to the corrected flow change percentage, the corrected flow change percentage is the product of the standard flow change percentage and the correction step length, the correction step length is the difference between 1 and the correction degree, and the correction degree is the ratio of the part of the real-time missed recognition rate that exceeds the allowable missed recognition rate to the real-time missed recognition rate.

[0041] In this embodiment, the preset verification period can be set to 30 minutes or 60 minutes, and the allowed miss recognition rate is 10%; for example, the preset verification period is set to 60 minutes. Within 1 hour, the number of actual existing vulnerabilities detected by the system is 20, the number of vulnerabilities identified is 15, the actual number of normal activities is 1000, and the number of false recognitions is 5. The miss recognition rate = the number of missed anomalies / the actual number of existing anomalies, the number of missed anomalies = the actual number of existing vulnerabilities - the number of identified The number of vulnerabilities = 20-15 = 5, the miss rate = 5 / 20 = 0.25 (i.e. 25%), the real-time miss rate (25%) is greater than the allowable miss rate (10%), so the standard flow change percentage needs to be adjusted, the correction step is 1-(real-time miss rate-allowable miss rate) / real-time miss rate, correction step = 1-(25%-10%) / 25% = 1-0.6 = 0.4, the corrected flow change percentage = standard flow change percentage × correction step = 20% × 0.4 = 8%.

[0042] By calculating and evaluating the missed detection rate and adjusting the percentage change of standard traffic according to the missed detection rate of vulnerability stains, the performance of the monitoring mechanism can be effectively evaluated. The monitoring standards can be dynamically adjusted according to the evaluation results to more flexibly adapt to changes in the network environment and ensure that the monitoring standards are always consistent with the actual situation.

[0043] See also Figure 4 As shown, it is a schematic diagram of a process of generating fingerprint information of each industrial asset device based on key information by a fingerprint recognition module according to an embodiment of the present invention; Specifically, the fingerprint recognition module generates fingerprint information of each industrial asset device based on key information, including: Step S201, defining fingerprint features of fingerprint information, including: device type, software version, device manufacturer, and network behavior pattern of the device; Step S202, generating fingerprint information of the device according to the key information and fingerprint features; Step S203, encrypting the fingerprint information using a hash algorithm; Step S204: storing the generated fingerprint information in a fingerprint database.

[0044] In this embodiment, the device types include PLC, sensors, monitoring systems, etc., the network behavior patterns include common traffic patterns, connection frequencies, etc., the hash algorithm is SHA-256, and the fingerprint information is encrypted using the hash algorithm to ensure the uniqueness and security of the data. The generated fingerprint information is stored in the fingerprint database to facilitate subsequent device identification and security analysis.

[0045] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0046] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A vulnerability and stain detection system based on industrial asset fingerprint recognition, characterized in that: include, A data acquisition module is used to obtain the flow data corresponding to each industrial asset device in operation in the industrial control network environment; A data analysis module, which is connected to the data acquisition module and is used to extract key information from the flow data; A fingerprint recognition module, which is connected to the data analysis module and is used to generate fingerprint information of each industrial asset device based on key information; A vulnerability matching module, which is connected to the data parsing module and is used to match fingerprint information with a vulnerability library to identify known vulnerabilities; A taint analysis module, which is connected to the vulnerability matching module, is used to determine the taint propagation path according to the network location of the taint source and the analysis results of the associated devices connected thereto, and to monitor the flow data of each industrial asset device in real time to determine the degree of influence of the taint source on the associated devices, and to determine the risk level of the vulnerability taint according to the degree of influence; Wherein, industrial asset equipment with known vulnerabilities is identified as the taint source; The verification module is connected to the stain analysis module and is used to adjust the standard flow change percentage according to the missed recognition rate and error rate of the vulnerability stain.

2. The vulnerability and stain detection system based on industrial asset fingerprint recognition according to claim 1 is characterized in that: The taint analysis module includes a taint propagation analysis unit, a traffic monitoring unit, a taint analysis unit, and a level determination unit, wherein: The taint propagation analysis unit is used to determine the device directly connected to the taint source according to the network topology, obtain a number of associated devices, and determine the taint propagation path according to the connection relationship between the associated devices; The flow monitoring unit monitors the flow data of each industrial asset device in real time to identify abnormal behavior patterns, and marks the industrial asset device identified as having abnormal behavior patterns as risky equipment; The taint analysis unit is used to analyze whether the abnormal behavior of the risk device is related to the known vulnerability, so as to determine the impact of the taint source on the associated device; The level determination unit determines the risk level of the vulnerability stain according to the impact degree.

3. The vulnerability and stain detection system based on industrial asset fingerprint recognition according to claim 2 is characterized in that: The taint propagation analysis unit determines the device directly connected to the taint source according to the network topology, and obtains a number of associated devices, wherein: The network topology diagram is used to show the connection relationship between various industrial assets and equipment; According to the network location of the pollution source, analyze the industrial assets and equipment directly connected to it, and mark the affected industrial assets and equipment as associated equipment; Among them, the affected industrial assets and equipment are determined through network protocols.

4. The vulnerability and stain detection system based on industrial asset fingerprint recognition according to claim 2 is characterized in that: The flow monitoring unit monitors the flow data of each industrial asset device in real time to identify abnormal behavior patterns including: Extracting flow characteristics from the flow data, the flow characteristics including the initial flow corresponding to the beginning of a preset monitoring period, the current flow corresponding to the end of a preset monitoring period, and the connection frequency; Calculate the real-time flow change percentage within the preset monitoring period based on the initial flow and current flow; Compare the standard traffic change percentage with the real-time traffic change percentage, and determine whether to identify it as the first abnormal behavior pattern based on the comparison result: If the real-time flow rate change percentage is greater than the standard flow rate change percentage, determine the corresponding industrial asset equipment There is abnormal behavior, and the abnormal behavior is the first abnormal behavior pattern; If the real-time traffic change percentage is less than or equal to the standard traffic change percentage, the standard abnormal connection number is compared with the real-time abnormal connection number to determine whether to identify it as the second abnormal behavior pattern.

5. The vulnerability and stain detection system based on industrial asset fingerprint recognition according to claim 4 is characterized in that: The flow monitoring unit determines whether to identify the second abnormal behavior pattern, including: If the real-time abnormal connection number is greater than the standard abnormal connection number, it is determined that the corresponding industrial asset equipment has abnormal behavior, and the abnormal behavior is the second abnormal behavior mode; If the number of real-time abnormal connections is less than or equal to the number of standard abnormal connections, it is determined that the corresponding industrial asset equipment does not have abnormal behavior; Among them, the traffic monitoring unit obtains the number of real-time abnormal connections by obtaining the number of connection frequencies exceeding the standard connection range within a preset monitoring period; the abnormal behavior pattern includes a first abnormal behavior pattern and a second abnormal behavior pattern, the first abnormal behavior pattern is burst traffic, and the second abnormal behavior pattern is frequent connection.

6. The vulnerability and stain detection system based on industrial asset fingerprint recognition according to claim 2 is characterized in that: The taint analysis unit analyzes whether the abnormal behavior of the risk device is related to the known vulnerability, including: If the industrial asset device corresponding to the known vulnerability is a risky device, determine the impact of the taint source on any associated device based on the connection duration and abnormal behavior pattern; If the industrial asset equipment corresponding to the known vulnerability is not a risky equipment, the industrial asset equipment corresponding to the known vulnerability is marked as a first-level tainted vulnerability equipment, and the risk level corresponding to the first-level tainted vulnerability equipment is first-level risk.

7. The vulnerability and stain detection system based on industrial asset fingerprint recognition according to claim 6 is characterized in that: Determine the impact of the taint source on any associated device based on connection duration and abnormal behavior patterns, including: Get the duration of the connection between the tainted source and any associated device; Compare the standard connection time to the connection duration: If the connection duration is less than or equal to the standard connection time, determine the impact of the taint source on any associated device based on the abnormal behavior pattern; If the connection duration is greater than the standard connection time, the industrial asset equipment corresponding to the known vulnerability will be marked as a level 4 taint vulnerability device, and the risk level corresponding to the level 4 taint vulnerability device is level 4 risk.

8. The vulnerability and stain detection system based on industrial asset fingerprint recognition according to claim 7 is characterized in that: Determine the impact of the taint source on any associated device based on abnormal behavior patterns, including: If the abnormal behavior pattern is a first-level abnormal behavior pattern, the industrial asset equipment corresponding to the known vulnerability is marked as a second-level tainted vulnerability equipment, and the risk level corresponding to the second-level tainted vulnerability equipment is a second-level risk; If the abnormal behavior pattern is a level 2 abnormal behavior pattern, the industrial asset equipment corresponding to the known vulnerability will be marked as a level 3 tainted vulnerability equipment, and the risk level corresponding to the level 3 tainted vulnerability equipment is level 3 risk.

9. The vulnerability and stain detection system based on industrial asset fingerprint recognition according to claim 1 is characterized in that: The verification module adjusts the standard flow change percentage according to the real-time leakage rate of the vulnerability stain, including: Calculate the real-time missed recognition rate at level 3 risk and level 2 risk within the preset verification cycle. Determine the real-time missed recognition rate based on the allowed missed recognition rate: If the real-time missed recognition rate is less than or equal to the allowed missed recognition rate, the standard flow change percentage will not be adjusted; If the real-time missed recognition rate is greater than the allowable missed recognition rate, the standard flow change percentage is adjusted; Among them, the standard flow change percentage is adjusted to the corrected flow change percentage, the corrected flow change percentage is the product of the standard flow change percentage and the correction step length, the correction step length is the difference between 1 and the correction degree, and the correction degree is the ratio of the part of the real-time missed recognition rate that exceeds the allowable missed recognition rate to the real-time missed recognition rate.

10. The vulnerability and stain detection system based on industrial asset fingerprint recognition according to claim 1 is characterized in that: The fingerprint recognition module generates fingerprint information of each industrial asset device based on key information, including: Define fingerprint characteristics of fingerprint information, including: device type, software version, device manufacturer, and network behavior pattern of the device; Generate fingerprint information of the device based on key information and fingerprint features; Use hash algorithm to encrypt fingerprint information; The generated fingerprint information is stored in the fingerprint database.

Images