Industrial control protocol abnormal behavior analysis and detection method, equipment, medium and program product

Abstract

The invention provides an industrial control protocol abnormal behavior analysis and detection method and device, a medium and a program product. The method comprises the steps of network flow collection, network flow analysis, data preprocessing, behavior baseline model construction, real-time flow access and detection and dynamic optimization of a baseline model. According to the invention, the process service behavior baseline model can be established for specific process service communication links and industrial protocols, and automatic construction and dynamic adjustment of the process service baseline model can be realized; the problems that in existing industrial control protocol abnormal behavior analysis and detection, a model is not established for a specific process service communication link, when the service changes, real-time dynamic adjustment cannot be achieved, and the abnormal detection rate is low are solved. The abnormal condition of each device in the industrial network traffic can be rapidly detected by performing abnormal behavior analysis detection on the industrial control protocol transmission traffic by using the process business behavior baseline model.

Description

Technical Field

[0001] The present invention relates to the field of industrial network security technology, and in particular to a method, device, medium and program product for analyzing and detecting abnormal behavior of an industrial control protocol. Background Art

[0002] With the deep integration of industrial automation and informatization, the security issues faced by industrial control systems are becoming increasingly severe. The communication protocols used in industrial control systems did not fully consider information security when they were designed. They have a large number of loopholes and lack the necessary security mechanisms, making them easy targets for attackers. Once exploited by attackers, major accidents may occur.

[0003] At present, most of the abnormal detection of industrial control protocols is based on whitelist technology. By manually analyzing the protocol format, a whitelist is established, and abnormal behavior detection is performed according to the generated whitelist rules. Alarms are issued for those that do not match the whitelist. This type of method does not establish statistical analysis methods for specific process business communication links and relies on manual labor and high costs. When the business changes, it is difficult to adjust dynamically, abnormal behavior detection is not timely, and detection efficiency is low. Summary of the invention

[0004] The present invention aims to provide a method, device, medium and program product for abnormal behavior analysis and detection of industrial control protocols. The method can establish a process business behavior baseline model for specific process business communication links and industrial protocols based on the address information, protocol, payload and other elements of the communicating parties in the network traffic, and can realize the automatic construction and dynamic adjustment of the process business baseline model, solving the problems of the existing industrial control protocol abnormal behavior analysis and detection that the model is not established for specific process business communication links and when the business changes, it cannot be adjusted dynamically in real time, and the abnormal detection rate is low. Using the process business behavior baseline model to perform abnormal behavior analysis and detection on the industrial control protocol transmission traffic can quickly detect the abnormal situation of each device in the industrial network traffic.

[0005] The present invention provides a method for analyzing and detecting abnormal behavior of an industrial control protocol, comprising the following steps:

[0006] S1, collect network traffic: collect normal network traffic;

[0007] S2, parsing network traffic: deeply parse the collected network traffic, filter out the network traffic containing industrial protocols, and perform session association to generate formatted data with key information;

[0008] S3, data preprocessing: performing data preprocessing on the formatted data to generate metadata;

[0009] S4, build a behavioral baseline model: automatically build a behavioral baseline model by analyzing and calculating metadata;

[0010] S5, real-time traffic access and detection: using the behavior baseline model to perform abnormal analysis and detection on real-time traffic data;

[0011] S6, dynamically optimizing the baseline model: when real-time traffic is connected, the behavior baseline model is periodically and dynamically adjusted according to the latest network traffic.

[0012] In some embodiments, in step S1, normal network traffic is collected through the switch mirror port.

[0013] In some embodiments, in step S2, the key information includes access source IP, destination IP, source MAC, destination MAC, destination port, application protocol, transport protocol and payload.

[0014] In some embodiments, in step S3, the generated original data is stored in a distributed database as basic data for subsequent processing and calling.

[0015] In some embodiments, in step S3, the data preprocessing includes removing duplicate or abnormal data by aggregation and filtering.

[0016] In some embodiments, in step S4, automatically establishing a behavior baseline model includes:

[0017] Set the flow baseline sampling period;

[0018] Extract metadata within the sampling period from the distributed database;

[0019] Using an aggregation algorithm, the metadata is grouped according to three features: application protocol, source IP address, and destination IP address;

[0020] The grouped data are clustered using the K-means++ algorithm. The optimal number of clusters K is determined by calculating the silhouette coefficient for different K values. For each data point j, the silhouette coefficient is calculated as Among them, b(j) is the average distance from each data point to the nearest cluster, and a(j) is the average distance from each data point j to other data in the same cluster;

[0021] Select the K value that maximizes the silhouette coefficient, initialize K centroids, and perform data calculation and iterative optimization. If the preset maximum number of iterations is reached, stop the iteration and establish a behavioral baseline model.

[0022] In some embodiments, in step S6, periodically dynamically adjusting the behavior baseline model according to the latest network traffic includes:

[0023] Initialize an empty set C; when real-time traffic is accessed, use the behavioral baseline model to detect it. If the data flow cannot be correctly classified into any cluster, it is judged as abnormal data and an alarm is generated. If it is normal data, the data flow is added to set C;

[0024] At the beginning of each preset cycle, the data in set C are added to the behavioral baseline model for recalculation and analysis, and the model parameters of the behavioral baseline model are adjusted using the elbow rule; the sum of squared errors SSE corresponding to different K values ​​is calculated, and the calculation formula of SSE is: Where n is the total number of data, k is the number of clusters, and x jm is the value of data point j on feature m, u k is the value of the center of the kth cluster on feature m; find the point where the rate of decrease of the sum of squared errors (SSE) begins to slow down to redetermine the optimal number of clusters K of the data set and optimize the clustering effect of the behavioral baseline model; and periodically update the behavioral baseline model by continuously collecting new traffic data.

[0025] In a second aspect, the present invention further provides an electronic device, comprising:

[0026] at least one processor; and a memory communicatively coupled to the at least one processor;

[0027] The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the instructions stored in the memory, so that the at least one processor performs the method.

[0028] In a third aspect, the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store instructions, and when the instructions are executed, the above method is implemented.

[0029] In a fourth aspect, the present invention further provides a computer program product, which, when called by a computer, enables the computer to execute the above method.

[0030] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0031] 1. The present invention establishes a process business behavior baseline model for specific process business communication links and industrial protocols, which can effectively reduce data dimensions, improve processing speed, more effectively identify communication paths and traffic sources, and promptly discover communication anomalies of each device in the industrial control network.

[0032] 2. The present invention can automatically establish a baseline model of process business behavior without relying on manual analysis to extract protocol features, and is applicable to all industrial control protocols.

[0033] 3. In the present invention, when the business changes, no manual intervention is required, and the behavior baseline model is dynamically adjusted automatically.

[0034] 4. The present invention can monitor network traffic in real time, promptly detect abnormal attack behaviors in industrial protocol data and defend against them, thereby improving the efficiency and accuracy of industrial network traffic anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 The present invention provides a flowchart of a method for analyzing and detecting abnormal behavior of an industrial control protocol in an embodiment of the present invention.

[0036] Figure 2 The flowchart of dynamically adjusting the behavior baseline model in an embodiment of the present invention.

[0037] Figure 3 The present invention is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0039] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] Example

[0041] like Figure 1 As shown, this embodiment proposes a method for analyzing and detecting abnormal behavior of an industrial control protocol, including the following steps:

[0042] S1, collecting network traffic: collecting normal network traffic. In some embodiments, normal network traffic can be collected through a switch mirror port.

[0043] S2, parse network traffic: perform in-depth analysis on the collected network traffic, filter out network traffic containing industrial protocols, perform session association, and generate formatted data with key information; the key information includes access source IP, destination IP, source MAC, destination MAC, destination port, application protocol, transport protocol, payload, etc.

[0044] S3, data preprocessing: preprocess the formatted data to generate metadata

[0045] In some embodiments, the generated original data is stored in a distributed database as basic data for subsequent processing and calling;

[0046] In some embodiments, the data preprocessing includes removing duplicate or abnormal data by aggregation, filtering, etc.

[0047] S4, build a behavioral baseline model: automatically build a behavioral baseline model by analyzing and calculating metadata.

[0048] In some embodiments, based on the obvious periodicity of process business traffic, a process business behavior baseline model for specific process business communication links and industrial protocols is automatically established according to a preset period. First, a traffic baseline sampling period is set, and metadata within the sampling period is extracted from a distributed database. The metadata is grouped according to the three features of application protocol, source IP address, and destination IP address using an aggregation algorithm. The grouped data is clustered using the K-means++ algorithm. The optimal number of clusters K is determined by calculating the silhouette coefficient of different K values. For each data point j, the silhouette coefficient is calculated as follows: Among them, b(j) is the average distance from each data point to the nearest cluster, a(j) is the average distance from each data point j to other data in the same cluster. The larger the silhouette coefficient, the better the clustering effect. Select the K value that maximizes the silhouette coefficient, initialize K centroids, and perform data calculation and iterative optimization. If the preset maximum number of iterations is reached, stop the iteration and establish a behavioral baseline model.

[0049] S5, real-time traffic access and detection: use the behavior baseline model to perform abnormal analysis and detection on the real-time traffic data. If the real-time traffic data cannot match any cluster, it is determined to be abnormal data and an alarm is issued.

[0050] S6, dynamically optimize the baseline model: when real-time traffic is accessed, the behavior baseline model is periodically and dynamically adjusted according to the latest network traffic to adapt to changes in network behavior and maintain the timeliness and accuracy of the behavior baseline model.

[0051] In some embodiments, Figure 2As shown, first initialize an empty set C. When real-time traffic is accessed, the behavioral baseline model is used for detection. If the data stream cannot be correctly classified into any cluster, it is judged as abnormal data and an alarm is generated. If it is normal data, the data stream is added to the set C. At the beginning of each preset cycle, the data in the set C is added to the behavioral baseline model for recalculation and analysis. The model parameters of the behavioral baseline model are adjusted using the elbow rule, and the sum of squared errors SSE corresponding to different K values ​​is calculated. The smaller the calculated SSE, the better the clustering effect. The calculation formula of SSE is Where n is the total number of data, k is the number of clusters, and x jm is the value of data point j on feature m, u k is the value of the center of the kth cluster on feature m. Find the point where the SSE starts to decrease slowly to redetermine the optimal number of clusters K of the data set and optimize the clustering effect of the behavior baseline model. By continuously collecting new traffic data and periodically updating the behavior baseline model, the continuous dynamic optimization of the process business behavior baseline model can be achieved.

[0052] Based on the same technical concept, the embodiment of the present application also provides an electronic device, which can implement the method flow of abnormal behavior analysis and detection of industrial control protocols provided in the above embodiment of the present application. In one embodiment, the electronic device can be a server, or a terminal device or other electronic device. Figure 3 As shown, the electronic device may include:

[0053] At least one processor, and a memory connected to the at least one processor. The specific connection medium between the processor and the memory is not limited in the embodiment of the present application. Figure 3 The example in this article is that the processor and memory are connected through a bus. Figure 3 The connections between other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into address bus, data bus, control bus, etc. Figure 3 In the diagram, only one thick line is used, but this does not mean that there is only one bus or only one type of bus. Alternatively, a processor can also be called a controller, and there is no limitation on the name.

[0054] In an embodiment of the present application, the memory stores instructions that can be executed by at least one processor. By executing the instructions stored in the memory, at least one processor can execute the method for analyzing and detecting abnormal behavior of an industrial control protocol discussed above. The processor can implement Figure 3 The functions of each module in the device shown.

[0055] Among them, the processor is the control center of the device, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory and calling data stored in the memory, various functions of the device and processing data.

[0056] In an optional design, the processor may include one or more processing units, and the processor may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor. In some embodiments, the processor and the memory may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0057] The processor may be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method for analyzing and detecting abnormal behavior of an industrial control protocol disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0058] As a non-volatile computer-readable storage medium, the memory can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory can include at least one type of storage medium, for example, it can include flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), programmable read-only memory (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), magnetic memory, disk, CD, etc. The memory is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0059] By designing and programming the processor, the code corresponding to the method for analyzing and detecting abnormal behavior of an industrial control protocol introduced in the above embodiment can be fixed into the chip, so that the chip can perform the steps of the method for analyzing and detecting abnormal behavior of an industrial control protocol in the above embodiment when running. How to design and program the processor is a technology well known to those skilled in the art and will not be described in detail here.

[0060] Based on the same inventive concept, an embodiment of the present application also provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes a method for analyzing and detecting abnormal behavior of an industrial control protocol discussed above.

[0061] In some optional embodiments, the present application also provides various aspects of a method for analyzing and detecting abnormal behavior of an industrial control protocol, which can also be implemented in the form of a program product, which includes a program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of a method for analyzing and detecting abnormal behavior of an industrial control protocol according to various exemplary embodiments of the present application described above in this specification.

[0062] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of a unit described above can be further divided into multiple units to be embodied. In addition, although the operation of the method of the present application is described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step for execution, and / or one step can be decomposed into multiple steps for execution.

[0063] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0064] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a server, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0065] Program code for performing the operations of the present application may be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0066] Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0067] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0068] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0069] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for analyzing and detecting abnormal behavior of industrial control protocols, characterized in that: The steps include: S1, collect network traffic: collect normal network traffic; S2, parsing network traffic: deeply parse the collected network traffic, filter out the network traffic containing industrial protocols, and perform session association to generate formatted data with key information; S3, data preprocessing: performing data preprocessing on the formatted data to generate metadata; S4, build a behavioral baseline model: automatically build a behavioral baseline model by analyzing and calculating metadata; S5, real-time traffic access and detection: using the behavior baseline model to perform abnormal analysis and detection on real-time traffic data; S6, dynamically optimizing the baseline model: when real-time traffic is connected, the behavior baseline model is periodically and dynamically adjusted according to the latest network traffic.

2. The method for analyzing and detecting abnormal behavior of industrial control protocols according to claim 1, characterized in that: In step S1, normal network traffic is collected through the switch mirror port.

3. The method for analyzing and detecting abnormal behavior of industrial control protocols according to claim 1, characterized in that: In step S2, the key information includes access source IP, destination IP, source MAC, destination MAC, destination port, application protocol, transport protocol and payload.

4. The method for analyzing and detecting abnormal behavior of industrial control protocols according to claim 1, characterized in that: In step S3, the generated original data is stored in a distributed database as basic data for subsequent processing and calling.

5. The method for analyzing and detecting abnormal behavior of industrial control protocols according to claim 1, characterized in that: In step S3, the data preprocessing includes removing duplicate or abnormal data through aggregation and filtering.

6. The method for analyzing and detecting abnormal behavior of industrial control protocols according to claim 1, characterized in that: In step S4, the automatically establishing a behavior baseline model includes: Set the flow baseline sampling period; Extract metadata within the sampling period from the distributed database; Using an aggregation algorithm, the metadata is grouped according to three features: application protocol, source IP address, and destination IP address; The grouped data are clustered using the K-means++ algorithm. The optimal number of clusters K is determined by calculating the silhouette coefficient for different K values. For each data point j, the silhouette coefficient is calculated as Among them, b(j) is the average distance from each data point to the nearest cluster, and a(j) is the average distance from each data point j to other data in the same cluster; Select the K value that maximizes the silhouette coefficient, initialize K centroids, and perform data calculation and iterative optimization. If the preset maximum number of iterations is reached, stop the iteration and establish a behavioral baseline model.

7. The method for analyzing and detecting abnormal behavior of industrial control protocols according to claim 1, characterized in that: In step S6, periodically dynamically adjusting the behavior baseline model according to the latest network traffic includes: Initialize an empty set C; when real-time traffic is accessed, use the behavioral baseline model for detection. If the data flow cannot be correctly classified into any cluster, it is judged as abnormal data and an alarm is generated. If it is normal data, the data flow is added to set C; At the beginning of each preset cycle, the data in set C are added to the behavioral baseline model for recalculation and analysis, and the model parameters of the behavioral baseline model are adjusted using the elbow rule; the sum of squared errors SSE corresponding to different K values ​​is calculated, and the calculation formula of SSE is: Where n is the total number of data, k is the number of clusters, and x jm is the value of data point j on feature m, u k is the value of the center of the kth cluster on feature m; find the point where the rate of decrease of the sum of squared errors (SSE) begins to slow down to redetermine the optimal number of clusters K of the data set and optimize the clustering effect of the behavioral baseline model; and periodically update the behavioral baseline model by continuously collecting new traffic data.

8. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method as described in any one of claims 1 to 7 by executing the instructions stored in the memory.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 7 is implemented.

10. A computer program product, characterized in that When the computer program product is called by a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

Images