Attack feature filtering analysis method and system of industrial control protocol, terminal and medium

Abstract

The invention relates to an attack feature filtering analysis method and system of an industrial control protocol, a terminal and a medium, and relates to the field of network attack analysis, and the method comprises the steps: responding to a detected external attack for the industrial control protocol, and capturing the attacked information corresponding to the external attack; calculating a time interval between adjacent hit times to obtain a time interval set; calculating a mean value of the ith time interval and the (i + 1) th time interval to obtain a mean value of the ith time interval; calculating the ith associated value of the ith time interval mean value; if the ith association value is smaller than the preset threshold value, classifying the (n-i + 1) th hit time, the (n-i) th hit time and the (n-i-1) th hit time as same-frequency attacks; updating i to i + 1, and repeating the steps to obtain a same-frequency attack set; acquiring the same-frequency hit type and the same-frequency hit duration corresponding to each same-frequency attack; and obtaining a target attack type according to the same-frequency attack type and the same-frequency attack duration. The method and the device have the effect of improving the recognition accuracy of the external attack.

Description

Technical Field

[0001] The present application relates to the field of network attack analysis, and in particular to an attack feature filtering analysis method, system, terminal and medium for an industrial control protocol. Background Art

[0002] Industrial control protocols are widely used in industrial automation, energy, manufacturing and other fields. As industrial control systems are gradually connected to the Internet, they have become potential targets for cyber attacks. Therefore, how to detect and prevent potential attacks on industrial control protocols has become an increasingly urgent need.

[0003] Related technologies include industrial control modeling module, attack detection module and attack identification module: the industrial control modeling module is used to build an industrial control system structural model framework for the petrochemical and power industries; the attack detection module is used to extract corresponding attack state observations and features, including building a centralized attack detection filter model and a distributed attack detection filter model; the attack identification module is used to build a centralized attack identification filter to identify the corresponding attack set.

[0004] With respect to the above-mentioned related technologies, the inventor believes that identifying and confirming external attacks only by the type of external attacks cannot identify specific high-frequency external attacks. Summary of the invention

[0005] In order to improve the accuracy of identifying external attacks, the present application provides an attack feature filtering and analysis method, system, terminal and medium for an industrial control protocol.

[0006] In a first aspect, the present application provides an attack feature filtering and analysis method for an industrial control protocol, which adopts the following technical solution: An attack feature filtering and analysis method for an industrial control protocol, comprising: In response to detecting an external attack on the industrial control protocol, capturing attack information corresponding to the external attack, the attack information including the attack type and the attack time; Establishing a correspondence between the attack type and the attack time; Calculate the time intervals between adjacent attack times to obtain a time interval set; Executing a first calculation step, the first calculation step comprising: calculating the mean of the ith time interval and the i+1th time interval to obtain the mean of the ith time interval, the ith time interval being obtained from the n-i+1th time of being struck and the ni-th time of being struck, the i+1th time interval being obtained from the ni-th time of being struck and the ni-1th time of being struck; Executing a second calculation step, the second calculation step comprising: calculating an i-th correlation value of the i-th time interval mean; Executing a division step, wherein: when the i-th correlation value is less than a preset threshold, classifying the n-i+1-th attack time, the ni-th attack time, and the ni-1-th attack time as same-frequency attacks; Update i to i+1, repeat the first calculation step, the second calculation step and the division step to obtain a same-frequency attack set; Obtain the same-frequency attack type and same-frequency attack duration corresponding to each same-frequency attack in the same-frequency attack set; The target attack type is obtained according to the same-frequency attack type and the same-frequency attack duration.

[0007] By adopting the above technical solution, a same-frequency attack set is obtained through the temporal characteristics of external attacks, and a target attack type is generated through the same-frequency attack set. This can clarify the types and frequencies of external attacks on the industrial control protocol and improve the accuracy of identifying external attacks.

[0008] Optionally, according to the same-frequency attack type, the time interval of the same-frequency attack from morning to night is counted to obtain the accommodation time; Counting the total number of the same-frequency striking types within the time interval to obtain the accommodated number; Calculating the ratio of the number of hits accommodated to the accommodation time to obtain the level of the same-frequency hit type; The attack level is compared with a preset attack threshold to obtain the target attack type of the same-frequency attack type, and the target attack type is used to indicate the degree of danger of the same-frequency attack type.

[0009] By adopting the above technical solution, the level of the same-frequency attack type is obtained by the ratio of the number of accommodated and the accommodation time, and the level is compared with the preset level threshold to obtain the degree of danger of the same-frequency attack type. This helps relevant personnel understand the threat of external attacks faced by industrial control protocols.

[0010] Optionally, historical attack types within a historical period and the impact duration corresponding to the historical attack types are counted; Performing a scoring operation on the historical attack type according to the impact duration to obtain a difference score corresponding to the historical attack type; Obtaining an attack type harm value corresponding to the historical attack type; Calculate the product of the difference score and the attack type harm value to obtain the sum of the harm values ​​corresponding to each of the historical attack types; The minimum value in the sum of the harm values ​​is taken as the inertial virus type.

[0011] By adopting the above technical solution, the sum of the harm values ​​of different historical attack types in the historical period is obtained by multiplying the difference score and the harm value of the attack type, and the minimum value in the sum of the harm values ​​is taken as the inertial virus type, which is conducive to studying the characteristics of external attacks in the historical period.

[0012] Optionally, searching a preset database for a protocol improvement scheme corresponding to the inertial virus type; Comparing the differences between the protocol improvement scheme and the industrial control protocol to obtain a candidate protocol improvement scheme; Calculating the recommendation score of the candidate protocol improvement scheme; A target recommendation score and a target protocol improvement scheme corresponding to the target recommendation score are determined from the recommendation scores.

[0013] By adopting the above technical solutions, target protocol improvement solutions are generated for inertial virus types and industrial control protocols, helping relevant personnel to provide corresponding solutions for inertial virus types and improve the protection effect of industrial control protocols.

[0014] Optionally, extracting timestamp information of the inertial virus type within the historical period; generating a time feature of the inertial virus type according to the timestamp information; Extracting a unique tag of the habitual virus type; According to the time characteristics, searching the local database for the data group to be tested; The unique tag is used to perform virus detection on the data group to be tested, and a virus detection result of the data group to be tested is obtained.

[0015] By adopting the above technical solution, the data in the local database can be detected to determine whether there are habitual virus types in the local database, and the virus types with a high probability of appearing in the local database can be thoroughly checked to ensure the security of the database.

[0016] Optionally, according to the industrial control protocol and the inertial virus type, a data tampering method corresponding to the inertial virus type is obtained; Retrieving tampered data from the local database according to the data tampering method; Acquire a data tag corresponding to the tampered data, wherein the data tag includes at least one of a data source, a data type, and a data acquisition time; A secondary search is performed on the local database according to the data tag.

[0017] By adopting the above technical solution, the local database is checked for data tampering methods of inertial virus types, ensuring that the inertial virus types in the local database can be found and the security of the local database is guaranteed.

[0018] Optionally, generating an original data packet according to the data tag and the data tampering method; Obtaining an encryption method according to relevant information of the data tampering method; Using the encryption method, encrypting the original data packet to obtain an encrypted data packet; The encrypted data packet is sent to other computer devices.

[0019] By adopting the above technical solution, the original data packet is generated according to the data label and the data tampering method, and the original data packet is encrypted to obtain an encrypted data packet, which ensures that the encrypted data packet will not be stolen by external means such as inertial viruses, thereby improving the security of the entire system.

[0020] In the second aspect, the present application provides an attack feature filtering and analysis system for industrial control protocols, which adopts the following technical solutions: An attack feature filtering and analysis system for an industrial control protocol, comprising: The acquisition module is used to obtain industrial control protocols, external attacks, attack information, preset thresholds, time intervals, preset attack thresholds, impact duration, attack type damage values, preset formulas, historical time periods and local databases; A memory, used to store a program of any of the above-mentioned methods for filtering and analyzing attack characteristics of industrial control protocols; The program in the processor memory can be loaded and executed by the processor and implements any of the above-mentioned attack feature filtering and analysis methods for industrial control protocols.

[0021] By adopting the above technical solution, a same-frequency attack set is obtained through the temporal characteristics of external attacks, and a target attack type is generated through the same-frequency attack set. This can clarify the types and frequencies of external attacks on the industrial control protocol and improve the accuracy of identifying external attacks.

[0022] In a third aspect, the present application provides a smart terminal, which adopts the following technical solution: An intelligent terminal comprises: a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute any of the above-mentioned methods.

[0023] In a fourth aspect, the present application provides a computer storage medium capable of storing corresponding programs, which has the characteristics of facilitating the improvement of the recognition accuracy of external attacks, and adopts the following technical solutions: A computer-readable storage medium stores a computer program that can be loaded by a processor and executes any of the above-mentioned attack feature filtering and analysis methods for industrial control protocols.

[0024] In summary, the present application includes at least one of the following beneficial technical effects: By obtaining the same-frequency attack set based on the temporal characteristics of external attacks, and generating the target attack type based on the same-frequency attack set, the types and frequencies of external attacks on the industrial control protocol can be clarified, thus improving the accuracy of external attack identification. The ratio of the number of containment and the containment time is used to obtain the level of the same-frequency attack type, and the level is compared with the preset level threshold to obtain the degree of danger of the same-frequency attack type. This helps relevant personnel understand the threat of external attacks faced by industrial control protocols; Generate target protocol improvement plans for inertial virus types and industrial control protocols to help relevant personnel provide corresponding solutions for inertial virus types and improve the protection effect of industrial control protocols. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a flow chart of an attack feature filtering and analysis method for an industrial control protocol provided in an embodiment of the present application.

[0026] Figure 2 It is a flowchart of a method for generating a target attack type provided in an embodiment of the present application.

[0027] Figure 3 It is a flowchart of a method for obtaining an inertial virus type provided in an embodiment of the present application.

[0028] Figure 4 It is a flow chart of an improved method for an industrial control protocol provided in an embodiment of the present application.

[0029] Figure 5 It is a flowchart of a local database detection method provided in an embodiment of the present application.

[0030] Figure 6 It is a flowchart of a local database retrieval method provided in an embodiment of the present application.

[0031] Figure 7 It is a flowchart of a data sharing method provided in an embodiment of the present application.

[0032] Figure 8 It is a structural diagram of an attack feature filtering and analysis system for an industrial control protocol provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of this application more clear, the following Figures 1 to 8 It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0034] The present application embodiment discloses a method for filtering and analyzing attack features of an industrial control protocol. Figure 1 , the method comprising: Step S101: in response to detecting an external attack on an industrial control protocol, capturing attack information corresponding to the external attack, where the attack information includes an attack type and an attack time.

[0035] Industrial control protocols are protocols used for communication between devices in industrial automation or control systems. These protocols allow different devices or systems to exchange data and work together.

[0036] The attack type is used to indicate the type of external attack. Exemplarily, the attack type includes worm virus, Trojan virus, system virus, script virus and other viruses.

[0037] External attacks include but are not limited to at least one of computer viruses, DDoS attacks, injection attacks, phishing attacks, and DNS spoofing. In some embodiments, external attacks can be obtained through methods such as communication network traffic, flags and content of data packets, system logs and events, and device behaviors, which will not be described in detail here.

[0038] Step S102: establishing a correspondence between the attack type and the attack time.

[0039] For example, the attack time is set to T j , and the attack type is recorded as T ij , then T ij Indicates that the time of attack is T j The attack type corresponding to the external attack is i.

[0040] Step S103: Calculate the time intervals between adjacent striking times to obtain a time interval set.

[0041] For example, the time of being hit is recorded as Tn, where n is a positive number greater than 1, and the time of being hit is arranged in order from the latest to the oldest. Then the time interval is Gi=T n-i+1 -T n-i , i is a positive integer less than n. That is, the difference between Tn and Tn-1 is calculated to obtain the time interval G1. The difference between Tn-1 and Tn-2 is calculated to obtain the time interval G2. Repeat the above steps to obtain the time interval set G, which is [G1, G2, ..., Gn-1].

[0042] Step S104: Execute the first calculation step, which includes: calculating the mean of the ith time interval and the i+1th time interval to obtain the mean of the ith time interval, where the ith time interval is obtained from the n-i+1th strike time and the ni-th strike time, and the i+1th time interval is obtained from the ni-th strike time and the ni-1-th strike time.

[0043] Exemplarily, if the i-th time interval is Gi and the i+1-th time interval is Gi+1, then the mean value of the i-th time interval is Pi=(Gi+Gi+1) / 2.

[0044] Step S105: executing a second calculation step, the second calculation step comprising: calculating an i-th correlation value of the mean of the i-th time interval.

[0045] For example, if the mean of the i-th time interval is P i , the i-th time interval is Gi, and the i+1-th time interval is G i+1 , then the i-th associated value is , where P=Pi.

[0046] Step S106: Execute a division step, the division step: when the i-th correlation value is less than a preset threshold, classify the n-i+1-th attack time, the ni-th attack time and the ni-1-th attack time as same-frequency attacks.

[0047] The preset threshold is a preset experience value, and relevant personnel can adjust the specific value of the preset threshold according to actual conditions.

[0048] When the i-th correlation value is less than the preset threshold, it is considered that the correlation between the n-i+1-th attack time, the ni-th attack time and the ni-1-th attack time is poor, and the n-i+1-th attack time, the ni-th attack time and the ni-1-th attack time should not be classified as the same-frequency attack.

[0049] Same-frequency attacks refer to external attacks in the same attack round.

[0050] Step S107: Update i to i+1, repeat the first calculation step, the second calculation step and the division step to obtain a same-frequency attack set.

[0051] Exemplarily, i is updated to i+1, and the first calculation step, the second calculation step, and the division step are repeated until i=n, ​​to obtain a same-frequency attack set.

[0052] Step S108: Obtain the same-frequency attack type and same-frequency attack duration corresponding to each same-frequency attack in the same-frequency attack set.

[0053] The same frequency attack type refers to the type of the same frequency attack. The same frequency attack type is the same as the attack type in step S101.

[0054] The duration of the same-frequency attack refers to the duration of the same-frequency attack. For example, the attack time of each same-frequency attack in the same-frequency attack set is obtained. The earliest attack time and the latest attack time are counted, and the difference between the earliest attack time and the latest attack time is calculated to obtain the duration of the same-frequency attack.

[0055] Step S109: Obtain the target attack type according to the same-frequency attack type and the same-frequency attack duration.

[0056] The target attack type is used to indicate the degree of danger of the same frequency attack type.

[0057] By adopting the above technical solution, a same-frequency attack set is obtained through the temporal characteristics of external attacks, and a target attack type is generated through the same-frequency attack set. This can clarify the types and frequencies of external attacks on the industrial control protocol and improve the accuracy of identifying external attacks.

[0058] In the following embodiments, a method for obtaining the target attack type will be described, and the target attack type will be used to indicate the degree of danger of the same-frequency attack type, so as to remind relevant personnel to take corresponding measures against external attacks of the target attack type. Therefore, the embodiment of the present application discloses a method for generating the target attack type. Figure 2 , the method comprising: Step S201: according to the same-frequency attack type, the time interval of the same-frequency attack from morning to night is counted to obtain the accommodation time.

[0059] Exemplarily, the same-frequency external attack corresponding to the same-frequency attack type and the attack time corresponding to the same-frequency external attack are obtained. The earliest attack time and the latest attack time are taken from the aforementioned attack times. The difference between the latest attack time and the earliest attack time is calculated to obtain the accommodation time.

[0060] Step S202: Count the total number of the same-frequency striking types within the time interval to obtain the accommodated number.

[0061] Exemplarily, within a time interval, the number of external attacks of the same frequency attack type is counted to obtain the accommodated number.

[0062] In some other embodiments, the same frequency external attack corresponding to the same frequency attack type and the attack time corresponding to the same frequency external attack are obtained, and the number of external attacks with the same frequency attack type between the earliest attack time and the latest attack time is counted to obtain the accommodated number.

[0063] Step S203: Calculate the ratio of the number of accommodated hits to the accommodation time to obtain the level of the same-frequency hit type.

[0064] The level of damage is used to indicate the degree of damage caused by the same-frequency attack type.

[0065] Step S204: Compare the attack level and the preset attack threshold to obtain the target attack type of the same-frequency attack type, where the target attack type is used to indicate the danger level of the same-frequency attack type.

[0066] Optionally, the target attack type includes a common attack type and a high-risk attack type. When the attack level is greater than a preset attack level threshold, the target attack type is a high-risk attack type; when the attack level is less than the preset attack level threshold, the target attack type is a peripheral common attack type.

[0067] By adopting the above technical solution, the level of the same-frequency attack type is obtained by the ratio of the number of accommodated and the accommodation time, and the level is compared with the preset level threshold to obtain the degree of danger of the same-frequency attack type. This helps relevant personnel understand the threat of external attacks faced by industrial control protocols.

[0068] In the following embodiments, external attacks can be summarized to determine which types of viruses the industrial control protocol is susceptible to attack, and obtain the inertial virus type. This is helpful for relevant personnel to take corresponding countermeasures according to the inertial virus type. Therefore, the embodiment of the present application discloses a method for obtaining the inertial virus type. Figure 3 , the method comprising: Step S301: Count the historical attack types and the impact durations corresponding to the historical attack types within a historical period.

[0069] The historical attack type is the attack type corresponding to the external attack within the historical period.

[0070] Impact duration refers to the time from the occurrence of an external attack of a historical attack type to the repair of the damage caused by the external attack.

[0071] Exemplarily, historical external attacks within a historical period are counted, and the attack types corresponding to the historical external attacks are obtained to obtain the historical attack types. The impact duration of each historical external attack is counted. The sum of the impact durations of the same historical attack type is calculated to obtain the impact duration corresponding to the historical attack type.

[0072] Step S302: scoring the historical attack types according to the impact duration to obtain the difference scores corresponding to the historical attack types.

[0073] Exemplarily, when the impact duration is 0, the difference score corresponding to the historical attack type is set to 1; when the impact duration is greater than 0 and less than 3 minutes, the difference score corresponding to the historical attack type is set to 1.5; when the impact duration is greater than 3 minutes, the difference score corresponding to the historical attack type is set to 2.5.

[0074] Step S303: Obtain the attack type damage value corresponding to the historical attack type.

[0075] The attack type harm value is used to represent the preset harm degree of the historical attack type. Exemplarily, in the preset mapping relationship, the attack type harm value corresponding to the historical attack type is retrieved. The preset mapping relationship is preset.

[0076] Step S304: Calculate the product of the difference score and the attack type harm value to obtain the sum of the harm values ​​corresponding to each historical attack type.

[0077] Exemplarily, for the same historical attack type, the product of the difference score of each historical external attack and the attack type harm value is calculated to obtain the harm value of a single historical external attack; the harm values ​​of the single historical external attacks are summed to obtain the total harm value.

[0078] Step S305: taking the minimum value in the sum of the damage values ​​as the inertial virus type.

[0079] Inertial virus type refers to the virus type that is most harmful in historical periods.

[0080] By adopting the above technical solution, the sum of the harm values ​​of different historical attack types in the historical period is obtained by multiplying the difference score and the harm value of the attack type, and the minimum value in the sum of the harm values ​​is taken as the inertial virus type, which is conducive to studying the characteristics of external attacks in the historical period.

[0081] In the following embodiments, when it is determined that the industrial control protocol is vulnerable to external attacks of the inertial virus type, the industrial control protocol can be upgraded for the inertial virus type to ensure the security of the industrial control protocol. Therefore, the embodiment of the present application discloses a method for improving the industrial control protocol. Figure 4 , the method comprising: Step S401: searching a preset database for a protocol improvement solution corresponding to the inertial virus type.

[0082] The preset database is used to store the correspondence between the inertial virus type and the protocol improvement scheme. Exemplarily, a candidate protocol improvement scheme is set. A scheme is selected from the candidate protocol improvement schemes according to the attack point of the inertial virus type to obtain the correspondence between the inertial virus type and the protocol improvement scheme.

[0083] In some other embodiments, a processing record corresponding to the inertial virus type is retrieved from the historical records, a processing scheme for the inertial virus type is obtained according to the processing record, and a clustering process is performed on the processing scheme to obtain a protocol improvement scheme corresponding to the inertial virus type.

[0084] Step S402: Compare the differences between the protocol improvement scheme and the industrial control protocol to obtain a candidate protocol improvement scheme.

[0085] Exemplarily, the difference between the industrial control protocol and the protocol improvement scheme is retrieved with reference to the protocol improvement scheme. If the aforementioned difference exists, the protocol improvement scheme is used as a candidate protocol improvement scheme. If the aforementioned difference does not exist, the protocol improvement scheme is discarded and is not used as a candidate protocol improvement scheme.

[0086] Step S403: Calculate the recommendation score of the candidate protocol improvement solution.

[0087] Optionally, obtain each improvement point in the candidate protocol improvement plan. Perform feature extraction operations on the improvement points to obtain the improvement features corresponding to each improvement point. Call the scoring model, perform scoring operations on the improvement features, and obtain the sub-recommendation scores corresponding to each improvement point. Calculate the sum of the sub-recommendation scores corresponding to each improvement point to obtain the recommendation score.

[0088] Step S404: Determine a target recommendation score and a target protocol improvement plan corresponding to the target recommendation score from the recommendation scores.

[0089] In some embodiments, the maximum value among the recommendation scores is selected to obtain the target recommendation score.

[0090] In some embodiments, a recommendation score greater than a preset score threshold is used as a target recommendation score.

[0091] By adopting the above technical solutions, target protocol improvement solutions are generated for inertial virus types and industrial control protocols, helping relevant personnel to provide corresponding solutions for inertial virus types and improve the protection effect of industrial control protocols.

[0092] In the following embodiments, after the inertial virus type is identified, in order to ensure the security of the local database, a comprehensive check of the local database can be performed according to the inertial virus type to prevent the inertial virus type from entering the local database. Therefore, the embodiment of the present application discloses a method for detecting a local database. Figure 5 , the method comprising: Step S501: extracting timestamp information of habitual virus types within a historical period.

[0093] The timestamp information includes the time when the habitual virus type entered the computer system or the time when the habitual virus type attacked the computer system.

[0094] In some embodiments, after data or information enters the computer system, the computer system will record the entry time of the data or information and use the entry time as timestamp information.

[0095] Step S502: Generate a time feature of the inertial virus type according to the timestamp information.

[0096] Exemplarily, the content in the timestamp information is filled into the time feature template to obtain the time feature. For example, the time feature template is a feature vector with a length of 5, and the time feature template records the time when the inertial virus type enters the computer system.

[0097] Step S503: extracting a unique label of the habitual virus type.

[0098] The unique tag is used to represent the unique characteristics of the inertia virus type. The unique tag is only available to the inertia virus type, and the unique tag can uniquely identify the inertia virus type.

[0099] Exemplarily, a unique tag corresponding to the habitual virus type is retrieved from the database.

[0100] Exemplarily, according to the inertial virus type, a virus type common label corresponding to the inertial virus type is extracted, and the type common label is used to represent the common characteristics of the inertial virus type. The difference between the type common label and the inertial virus type is compared to obtain a unique label.

[0101] Step S504: searching the local database for the data group to be tested according to the time feature.

[0102] Exemplarily, a candidate data group that is consistent with the time feature is retrieved from a local database, and a legality check is performed on the candidate data group to obtain a data group to be tested.

[0103] Step S505: Perform virus detection on the data group to be tested using the unique tag to obtain a virus detection result of the data group to be tested.

[0104] Exemplarily, it is detected whether a unique tag appears in the data group to be tested. If so, the virus detection result of the data group to be tested is set as the data group is abnormal. If not, the virus detection result of the data group to be tested is set as the data group is normal.

[0105] By adopting the above technical solution, the data in the local database can be detected to determine whether there are habitual virus types in the local database, and the virus types with a high probability of appearing in the local database can be thoroughly checked to ensure the security of the database.

[0106] In the following embodiments, in some scenarios, the inertial virus type may have tampered with the data in the local database. At this time, it is necessary to check the local database according to the characteristics of the inertial virus type to determine whether there is data or information tampered with by the inertial virus type. Therefore, the embodiment of the present application discloses a method for searching the local database. Figure 6 , the method comprising: Step S601: According to the industrial control protocol and the inertial virus type, a data tampering method corresponding to the inertial virus type is obtained.

[0107] In some embodiments, some inertial virus types can lurk in the computer system for a long time and persist and damage through the inherent characteristics of the computer system. Therefore, for this situation, according to the existing industrial control protocol and virus type analysis, identify the means by which the virus may tamper with the data. For example, the inertial virus type disrupts the normal operation of the system by modifying sensor data, control instructions, alarm signals, etc.

[0108] Exemplarily, the working mode of the inertial virus type is obtained. According to the working mode and the industrial control protocol, an inertial virus behavior model is generated, and the inertial virus behavior model is used to simulate the behavior of the inertial virus type in the industrial control protocol. Based on the simulation results of the inertial virus behavior model, the data tampering method is obtained.

[0109] Step S602: According to the data tampering method, the tampered data is retrieved in the local database.

[0110] Optionally, various types of data in a local database are obtained. Various types of data are processed according to the data tampering method to obtain data tampering results. Tampered data consistent with the data tampering results are retrieved from the local database.

[0111] For example, if the inertial virus type tampers with the real-time data of certain sensors, the system will retrieve the value records of these sensors from the database and determine whether the current data is abnormal by comparing the historical data or the preset normal value range. At the same time, frequent changes in data or large deviations from expectations are also important signs of tampering. Therefore, through accurate database retrieval, suspected tampered data can be quickly identified and provide clues for subsequent processing.

[0112] Step S603: Obtain a data tag corresponding to the tampered data, where the data tag includes at least one of a data source, a data type, and a data acquisition time.

[0113] The data source is used to indicate which device, sensor, or system module the data comes from.

[0114] The data type describes the specific form of the data, such as temperature, pressure, humidity, current, voltage and other different types of data.

[0115] Step S604: Perform a secondary search on the local database according to the data tags.

[0116] Furthermore, the local database is searched again using the data tags to obtain suspected problematic data with consistent data tags. The suspected problematic data is tested according to the data tampering method to determine whether the suspected problematic data is tampered with by the inertial virus type.

[0117] By adopting the above technical solution, the local database is checked for data tampering methods of inertial virus types, ensuring that the inertial virus types in the local database can be found and the security of the local database is guaranteed.

[0118] In the following embodiments, after the computer device determines the impact of the inertial virus type, the characteristics of the inertial virus type can be sent to other computer systems to improve the security of other computer systems, thereby improving the security of the entire computer system. Therefore, the embodiment of the present application discloses a data sharing method. Figure 7 , the method comprising: Step S701: Generate an original data packet according to the data label and the data tampering method.

[0119] Optionally, a data tag and a data tampering method are added to the compressed packet to obtain the original data packet.

[0120] Step S702: Obtain the encryption method according to the relevant information of the data tampering method.

[0121] Identifying the way data is tampered is crucial to the selection of encryption methods. For example, if the tampering method is to inject false data into sensor data, using symmetric encryption may be sufficient to prevent external illegal tampering. However, if the tampering method is more complex, such as tampering with control instructions or involving complex attack modes, more complex encryption algorithms, such as asymmetric encryption or hybrid encryption technology, are required to ensure the security of data transmission.

[0122] Step S703: Use an encryption method to encrypt the original data packet to obtain an encrypted data packet.

[0123] Exemplarily, a security key is selected according to the encryption method, and the security key is shared between the current computer system and other computer systems. According to the selected encryption method, the current computer system applies a corresponding algorithm to encrypt the original data packet. For example, if AES (Advanced Encryption Standard) symmetric encryption is used, the system will use the specified key to encrypt the data and generate an encrypted data packet. After the encryption is completed, the system will generate an encrypted data packet containing the ciphertext.

[0124] Furthermore, after obtaining the encrypted data packet, verification information may be attached to the encrypted data packet, such as the type of encryption algorithm, key length, hash value, etc., to ensure the integrity and security of the encrypted data packet during transmission.

[0125] Step S704: Send the encrypted data packet to other computer devices.

[0126] The encrypted data packet can be sent by wired transmission or wireless transmission.

[0127] By adopting the above technical solution, the original data packet is generated according to the data label and the data tampering method, and the original data packet is encrypted to obtain an encrypted data packet, which ensures that the encrypted data packet will not be stolen by external means such as inertial viruses, thereby improving the security of the entire system.

[0128] Based on the same inventive concept, the present application embodiment provides an attack feature filtering and analysis system for an industrial control protocol, please refer to Figure 8 ,include: The acquisition module 801 is used to acquire industrial control protocols, external attacks, attack information, preset thresholds, time intervals, preset attack thresholds, impact duration, attack type damage values, preset formulas, historical time periods and local databases; Memory 802, used to store the program of any one of the above-mentioned methods for filtering and analyzing attack characteristics of industrial control protocols; Processor 803, the program in the memory can be loaded and executed by the processor and implement any of the above-mentioned attack feature filtering and analysis methods for industrial control protocols.

[0129] By adopting the above technical solution, a same-frequency attack set is obtained through the temporal characteristics of external attacks, and a target attack type is generated through the same-frequency attack set. This can clarify the types and frequencies of external attacks on the industrial control protocol and improve the accuracy of identifying external attacks.

[0130] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0131] An embodiment of the present application provides a computer-readable storage medium storing a computer program that can be loaded by a processor and execute an attack feature filtering and analysis method for an industrial control protocol.

[0132] Computer storage media include, for example, various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0133] Based on the same inventive concept, an embodiment of the present application provides an intelligent terminal, including a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute an attack feature filtering and analysis method of an industrial control protocol.

[0134] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0135] The above are all preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Any feature disclosed in this specification (including the abstract and drawings), unless otherwise stated, can be replaced by other equivalent or alternative features with similar purposes. That is, unless otherwise stated, each feature is only an example of a series of equivalent or similar features.

Claims

1. A method for filtering and analyzing attack features of industrial control protocols, characterized in that: The method comprises: In response to detecting an external attack on the industrial control protocol, capturing attack information corresponding to the external attack, the attack information including the attack type and the attack time; Establishing a correspondence between the attack type and the attack time; Calculate the time intervals between adjacent attack times to obtain a time interval set; Executing a first calculation step, the first calculation step comprising: calculating the mean of the ith time interval and the i+1th time interval to obtain the mean of the ith time interval, the ith time interval being obtained from the n-i+1th time of being struck and the ni-th time of being struck, the i+1th time interval being obtained from the ni-th time of being struck and the ni-1th time of being struck; Executing a second calculation step, the second calculation step comprising: calculating an i-th correlation value of the i-th time interval mean; Executing a division step, wherein: when the i-th correlation value is less than a preset threshold, classifying the n-i+1-th attack time, the ni-th attack time, and the ni-1-th attack time as same-frequency attacks; Update i to i+1, repeat the first calculation step, the second calculation step and the division step to obtain a same-frequency attack set; Obtain the same-frequency attack type and same-frequency attack duration corresponding to each same-frequency attack in the same-frequency attack set; The target attack type is obtained according to the same-frequency attack type and the same-frequency attack duration.

2. The attack feature filtering and analysis method of the industrial control protocol according to claim 1 is characterized in that: The obtaining of the target attack type according to the same-frequency attack type and the same-frequency attack duration includes: According to the same-frequency attack type, the time interval of the same-frequency attack from morning to night is counted to obtain the accommodation time; Counting the total number of the same-frequency striking types within the time interval to obtain the accommodated number; Calculating the ratio of the number of hits accommodated to the accommodation time to obtain the level of the same-frequency hit type; The attack level is compared with a preset attack threshold to obtain the target attack type of the same-frequency attack type, and the target attack type is used to indicate the degree of danger of the same-frequency attack type.

3. The attack feature filtering and analysis method of the industrial control protocol according to claim 2 is characterized in that: The method further comprises: Count the historical attack types within the historical period and the impact duration corresponding to the historical attack types; Performing a scoring operation on the historical attack type according to the impact duration to obtain a difference score corresponding to the historical attack type; Obtaining an attack type harm value corresponding to the historical attack type; Calculate the product of the difference score and the attack type harm value to obtain the sum of the harm values ​​corresponding to each of the historical attack types; The minimum value in the sum of the harm values ​​is taken as the inertial virus type.

4. The attack feature filtering and analysis method of the industrial control protocol according to claim 3 is characterized in that: The method further comprises: Retrieving a protocol improvement scheme corresponding to the inertial virus type in a preset database; Comparing the differences between the protocol improvement scheme and the industrial control protocol to obtain a candidate protocol improvement scheme; Calculating the recommendation score of the candidate protocol improvement scheme; A target recommendation score and a target protocol improvement scheme corresponding to the target recommendation score are determined from the recommendation scores.

5. The attack feature filtering and analysis method of the industrial control protocol according to claim 3 is characterized in that: The method further comprises: Extracting timestamp information of the habitual virus type within the historical period; generating a time feature of the inertial virus type according to the timestamp information; Extracting a unique tag of the habitual virus type; According to the time characteristics, searching the local database for the data group to be tested; The unique tag is used to perform virus detection on the data group to be tested, and a virus detection result of the data group to be tested is obtained.

6. The attack feature filtering and analysis method of industrial control protocol according to claim 5 is characterized in that: The method further comprises: According to the industrial control protocol and the inertial virus type, obtaining a data tampering method corresponding to the inertial virus type; Retrieving tampered data from the local database according to the data tampering method; Acquire a data tag corresponding to the tampered data, wherein the data tag includes at least one of a data source, a data type, and a data acquisition time; A secondary search is performed on the local database according to the data tag.

7. The attack feature filtering and analysis method of industrial control protocol according to claim 6 is characterized in that: The method further comprises: Generate an original data packet according to the data label and the data tampering method; Obtaining an encryption method according to relevant information of the data tampering method; Using the encryption method, encrypting the original data packet to obtain an encrypted data packet; The encrypted data packet is sent to other computer devices.

8. An attack feature filtering and analysis system for an industrial control protocol, used to execute the attack feature filtering and analysis method for an industrial control protocol as claimed in any one of claims 1 to 7, characterized in that: The system comprises: The acquisition module is used to obtain industrial control protocols, external attacks, attack information, preset thresholds, time intervals, preset attack thresholds, impact duration, attack type damage values, preset formulas, historical time periods and local databases; A memory, used to store a program of the attack feature filtering and analysis method of the industrial control protocol; The program in the memory can be loaded and executed by the processor and implement the attack feature filtering and analysis method of the industrial control protocol.

9. An intelligent terminal, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored which can be loaded by a processor and execute the method according to any one of claims 1 to 7.

Images