Industrial control network security risk tracing method

Abstract

The invention provides an industrial control network security risk tracing method. The method comprises the following steps: S1, data acquisition and alarm processing; s2, real-time data acquisition and analysis; s3, log analysis and vulnerability scanning; s4, malicious software analysis and network evidence obtaining; s5, obtaining evidence by the host; s6, data traces are reserved; s7, copying the data; and S8, carrying out reverse transmission. According to the industrial control network security risk tracing method provided by the invention, the information of the hardware equipment used by a user who steals the data is obtained through the data trace, then the information of the hardware equipment is copied by data copying, and finally the copied hardware information is transmitted to the equipment of which the information is stolen through reverse transmission, so that the tracing efficiency is accelerated.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control network risk tracing, and in particular, relates to an industrial control network risk tracing method. Background Art

[0002] Engineering network security refers to the use of various measures to protect computer networks from unauthorized access, destruction, abuse and leakage. It involves various stages of network system planning, design, implementation, operation and maintenance, and aims to ensure the security and reliability of network system hardware, software, data and services. The goal of engineering network security is to ensure the integrity, confidentiality, availability and traceability of the network, thereby maintaining the foundation of information construction and development, and maintaining social stability and public interests. When data theft occurs, in order to quickly uncover the whereabouts of the person who stole the data information, it is necessary to trace the risks of engineering network security. In the process of risk tracing, the hardware equipment used can be selected for tracking, thereby improving the efficiency of risk tracing. Therefore, we make improvements to this and propose a method for tracing the risks of industrial control network security. Summary of the invention

[0003] In view of this, the present invention aims to propose an industrial control network security risk tracing method, so as to provide an industrial control network security risk tracing method with high tracing efficiency.

[0004] To achieve the above object, the technical solution of the present invention is achieved as follows:

[0005] A method for tracing the security risks of industrial control networks comprises the following steps:

[0006] S1: data acquisition and alarm processing;

[0007] S2: Real-time data acquisition and analysis;

[0008] S3: log analysis and vulnerability scanning;

[0009] S4: Malware Analysis and Network Forensics;

[0010] S5: Host forensics;

[0011] S6: Data traces;

[0012] S7: Data replication;

[0013] S8: Reverse transmission.

[0014] Furthermore, the specific method of data acquisition and alarm processing in S1 is: obtain the network communication data of the industrial control network, the log data of the industrial control host and the status data of the network equipment, perform alarm processing based on these data, and obtain alarm event information, including alarm events and their associated equipment assets. At the same time, alarm rules are set according to actual business needs. When an abnormal or preset situation is triggered, the alarm mechanism will be triggered. After receiving the alarm, the staff will conduct troubleshooting and system optimization to implement corresponding measures.

[0015] Furthermore, the specific method for real-time data acquisition and analysis in S2 is: real-time industrial control network data acquisition operations are performed through the collection processing layer and preset polling rules to obtain industrial control network forwarding data, and the analysis processing layer determines whether the industrial control network forwarding data matches the fingerprint features in the preset fingerprint feature database. If they match, the corresponding first analysis result is output and a comprehensive analysis and tracing operation is performed. If they do not match, the data is input into the preset industrial control system data message analysis model to obtain the second analysis result and a comprehensive analysis and tracing operation is performed. The comprehensive analysis and tracing result is input into the preset alarm model through the display layer to perform data analysis operations to obtain corresponding alarm information.

[0016] Furthermore, the data trace includes a virtual database and a real database. The real database is a library on the device for storing data. The virtual database is used to induce erroneous data theft. When the virtual database is stolen, an alarm message will be triggered.

[0017] Furthermore, the real database includes a data level assessment unit and an automatic data segmentation unit. The data level assessment unit is used to grade the data inside the real database according to the importance. This setting can be based on the user's keyword extraction of the stored data, and the level assessment is performed on the amount of extracted keywords. The more keywords, the higher the level, and vice versa. At the same time, when transmitting data to the real database, the level of data information can be directly set. Through the data level assessment, the encryption protection level of data of different levels can be achieved; the automatic data segmentation unit is used to automatically segment data with a high confidentiality level inside the real database. According to the level of the data, the data can be directly divided into several parts. The higher the level of the data, the more parts are segmented, and vice versa. Different encryptions are performed on the segmented data.

[0018] Furthermore, the specific method of log analysis and vulnerability scanning in S3 is: analyzing the log files of the ICS industrial control system to find clues of security events; using a vulnerability scanner to scan the ICS to find potential vulnerabilities.

[0019] Furthermore, the malware analysis and network forensics method in S4 is: analyzing the malware on the ICS to understand its functions and behaviors, analyzing the network traffic of the ICS to find the IP address and port number of the attacker.

[0020] Furthermore, the specific method of reverse transmission in S8 is: transmitting the data transmission path to the device from which the data is stolen, and recording and retaining the hardware device through reverse transmission of the data.

[0021] Compared with the prior art, the industrial control network security risk tracing method of the present invention has the following advantages:

[0022] (1) The industrial control network security risk tracing method described in the present invention obtains the hardware device information used by the user who steals the data through data traces, then uses data replication to copy the information of the hardware device, and finally transmits the copied hardware information to the device whose information is stolen through reverse transmission, thereby accelerating the tracing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0024] Figure 1 This is a flow chart of the industrial control network security risk tracing method according to an embodiment of the present invention;

[0025] Figure 2 This is a structural block diagram of the data trace according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0027] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and the like are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first", "second", and the like may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, "multiple" means two or more.

[0028] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood by specific circumstances.

[0029] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0030] A method for tracing the security risks of industrial control networks, such as Figure 1 and Figure 2 As shown, the following steps are included:

[0031] S1: Data acquisition and alarm processing: obtain the network communication data of the industrial control network, the log data of the industrial control host, and the status data of the network equipment, and perform alarm processing based on these data to obtain alarm event information, including alarm events and their associated equipment assets. At the same time, alarm rules are set according to actual business needs. When an abnormal or preset situation is triggered, the alarm mechanism will be triggered. After receiving the alarm, the staff can perform troubleshooting and system optimization to implement corresponding measures.

[0032] S2: Real-time data acquisition and analysis. The real-time industrial control network data acquisition operation is performed through the acquisition processing layer and the preset polling rules to obtain the industrial control network forwarding data. The analysis processing layer determines whether the industrial control network forwarding data matches the fingerprint feature in the preset fingerprint feature database. If it matches, the corresponding first analysis result is output and a comprehensive analysis and tracing operation is performed. If it does not match, the data is input into the preset industrial control system data message analysis model to obtain the second analysis result and a comprehensive analysis and tracing operation is performed. The comprehensive analysis and tracing result is input into the preset alarm model through the display layer for data analysis operation to obtain the corresponding alarm information;

[0033] S3: Log analysis and vulnerability scanning. Log analysis: Analyze the log files of the ICS industrial control system to find clues of security incidents. Vulnerability scanning: Use vulnerability scanners to scan ICS to find potential vulnerabilities and further improve data security.

[0034] S4: Malware Analysis and Network Forensics, Malware Analysis: Analyze the malware on the ICS to understand its functions and behaviors, Network Forensics: Analyze the network traffic of the ICS to find the IP address and port number of the attacker, thereby improving data security and quickly finding the attacker;

[0035] S5: Host forensics: collect forensics from hosts on the ICS to find traces left by attackers. This is mainly used to obtain device information to facilitate subsequent intrusion tracking.

[0036] S6: Data traces: copy viruses to the stolen transmission data, so as to implant viruses into the data thief's device. The implanted viruses can be used to implant viruses into the hardware device that steals the data, and then collect the hardware information of the stolen device.

[0037] A virtual database and a real database are set up on the data trace. The main function of the virtual database is to induce erroneous data theft, thereby improving the data protection security of the real database;

[0038] The virtual database is used to copy a small amount of real information in the real database and supplement the disordered information. The virtual database formed in this way will have a high degree of simulation of the real database, which will induce the erroneous theft of information. When the virtual database is stolen, an alarm message will be triggered to remind the staff to respond in time, thereby protecting the data security in the real database.

[0039] The real database is a library on the device for storing data, which has internal settings for data level assessment and automatic data segmentation. The two can further improve data security through cooperation;

[0040] The data level assessment unit is used to classify the data inside the real database according to the importance. This setting can be based on the user's keyword extraction of the stored data, and the level assessment can be performed based on the amount of extracted keywords. The more keywords there are, the higher the level, and vice versa. At the same time, when transmitting data to the real database, the level of data information can be directly set. Through the assessment of data level, encryption protection levels for data of different levels can be achieved, thereby improving the security of high-level data protection.

[0041] The automatic data segmentation unit is used to automatically segment data with a high confidentiality level inside the real database. According to the level of the data, the data can be directly segmented into several parts. The higher the level of the data, the more segments there are, and vice versa. At the same time, different encryptions are performed on the segmented data. In this way, when data theft is carried out, a long theft process is required due to the large amount of data. In this way, as the theft time increases, the staff will have enough time to discover that the data has been stolen, which is convenient for the staff to respond effectively, thereby improving the protection and security of the data.

[0042] S7: Data replication, which replicates information on the device through which the stolen data passes, and is used to directly replicate the hardware device information of the stolen data;

[0043] S8: Reverse transmission, which transmits the data transmission path to the device where the data is stolen. Through the reverse transmission of data, records can be retained for the hardware device, which facilitates the user's subsequent quick tracking, improves data rescue efficiency and speeds up tracing efficiency, thereby reducing security risks after data leakage.

[0044] This solution obtains the hardware device information used by the user who steals the data through data traces, then uses data replication to copy the information of the hardware device, and finally transmits the copied hardware information to the device whose information is stolen through reverse transmission, thereby speeding up the tracing efficiency.

[0045] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for tracing the security risks of industrial control networks, characterized by: The steps include: S1: data acquisition and alarm processing; S2: Real-time data acquisition and analysis; S3: log analysis and vulnerability scanning; S4: Malware Analysis and Network Forensics; S5: Host forensics; S6: Data traces; S7: Data replication; S8: Reverse transmission.

2. The method for tracing the security risk of an industrial control network according to claim 1 is characterized by: The specific method of data acquisition and alarm processing in S1 is: obtain the network communication data of the industrial control network, the log data of the industrial control host and the status data of the network equipment, perform alarm processing based on these data, and obtain alarm event information, including alarm events and their associated equipment assets. At the same time, set alarm rules according to actual business needs. When an abnormal or preset situation is triggered, the alarm mechanism will be triggered. After receiving the alarm, the staff will conduct troubleshooting and system optimization to implement corresponding measures.

3. The method for tracing the security risk of an industrial control network according to claim 1 is characterized by: The specific method for real-time data acquisition and analysis in S2 is: perform real-time industrial control network data acquisition operations through the acquisition processing layer and preset polling rules to obtain industrial control network forwarding data, and the analysis processing layer determines whether the industrial control network forwarding data matches the fingerprint features in the preset fingerprint feature database. If they match, the corresponding first analysis result is output and a comprehensive analysis and tracing operation is performed. If they do not match, the data is input into the preset industrial control system data message analysis model to obtain the second analysis result and a comprehensive analysis and tracing operation is performed. The comprehensive analysis and tracing result is input into the preset alarm model through the display layer to perform data analysis operations to obtain corresponding alarm information.

4. The method for tracing the security risk of an industrial control network according to claim 1, characterized in that: The data trace includes a virtual database and a real database. The real database is a library on the device for storing data, and the virtual database is used to induce erroneous data theft. When the virtual database is stolen, an alarm message will also be triggered.

5. The method for tracing the security risk of an industrial control network according to claim 4 is characterized by: The real database includes a data level assessment unit and an automatic data segmentation unit. The data level assessment unit is used to grade the data inside the real database according to the importance. The setting can be based on the user's keyword extraction of the stored data, and the level assessment is performed on the amount of extracted keywords. The more keywords, the higher the level, and vice versa. At the same time, when transmitting data to the real database, the level of data information can be directly set. Through the data level assessment, the encryption protection level of data of different levels can be achieved; the automatic data segmentation unit is used to automatically segment the data with a high confidentiality level inside the real database. According to the level of the data, the data can be directly divided into several parts. The higher the level of the data, the more parts are divided, and vice versa. Different encryptions are performed on the divided data.

6. The method for tracing the security risk of an industrial control network according to claim 1 is characterized by: The specific method of log analysis and vulnerability scanning in S3 is: analyzing the log files of the ICS industrial control system to find clues of security events; using a vulnerability scanner to scan the ICS to find potential vulnerabilities.

7. The method for tracing the security risk of an industrial control network according to claim 1 is characterized by: The malware analysis and network forensics method in S4 is: analyzing the malware on the ICS to understand its functions and behaviors, analyzing the network traffic of the ICS, and finding the IP address and port number of the attacker.

8. The method for tracing the security risk of an industrial control network according to claim 1 is characterized by: The specific method of reverse transmission in S8 is: the data transmission path is sent to the device whose data is stolen, and through the reverse transmission of the data, records are kept for the hardware device.

Images