Industrial control equipment safety protection method and device, equipment, storage medium and product

Abstract

The invention discloses an industrial control equipment safety protection method and device, equipment, a storage medium and a product. The method comprises the following steps: acquiring equipment monitoring data of industrial control equipment sent by a data acquisition node; determining a target anomaly detection model according to the equipment type of the industrial control equipment; inputting the equipment monitoring data into a target anomaly detection model for equipment anomaly detection to obtain an anomaly detection result; if the abnormal detection result is that the equipment is abnormal, generating a safety protection strategy of the industrial control equipment according to the equipment type of the industrial control equipment; and performing safety protection on the industrial control equipment based on the safety protection strategy. According to the technical scheme of the embodiment, safety protection of the industrial control equipment is realized, the defense capability of the industrial control equipment to various safety attacks is improved, and safe and stable operation of industrial production is ensured.

Description

Technical Field

[0001] The present invention relates to the field of industrial control technology, and in particular to a method, device, equipment, storage medium and product for industrial control equipment security protection. Background Art

[0002] Industrial control systems (ICS) are widely used in key infrastructure fields such as energy, transportation, water conservancy and chemical industry, and their security is of vital importance. Traditional industrial control security protection measures are mostly passive defense mechanisms based on rules and features, such as firewalls and intrusion detection systems (IDS). These methods rely on known attack patterns and feature libraries, and lack effective detection and defense capabilities for new and unknown attack methods. Once a new type of attack appears, the protection system often cannot respond in time, resulting in the system being attacked.

[0003] Most existing security protection systems can only detect and respond after an attack occurs, but cannot predict and prevent potential security threats before an attack occurs. This post-event response method cannot effectively reduce the losses caused by security incidents to industrial production. Therefore, how to achieve security protection for industrial control equipment in industrial control systems has become an urgent problem to be solved. Summary of the invention

[0004] The present invention provides a method, device, equipment, storage medium and product for industrial control equipment security protection, so as to realize the security protection of industrial control equipment, improve the defense capability of industrial control equipment against various security attacks, and ensure the safe and stable operation of industrial production.

[0005] According to one aspect of the present invention, a method for protecting industrial control equipment security is provided, the method comprising:

[0006] Obtain equipment monitoring data of industrial control equipment sent by data acquisition nodes;

[0007] Determining a target anomaly detection model according to the device type of the industrial control device;

[0008] Inputting the device monitoring data into the target anomaly detection model to perform device anomaly detection to obtain an anomaly detection result;

[0009] If the abnormality detection result is that the device is abnormal, generating a security protection strategy for the industrial control device according to the device type of the industrial control device;

[0010] The industrial control equipment is provided with security protection based on the security protection strategy.

[0011] According to another aspect of the present invention, there is provided a safety protection device for industrial control equipment, the device comprising:

[0012] A monitoring data acquisition module is used to acquire equipment monitoring data of industrial control equipment sent by a data acquisition node;

[0013] A model determination module, used to determine a target anomaly detection model according to the device type of the industrial control device;

[0014] An anomaly detection module, used for inputting the device monitoring data into the target anomaly detection model to perform device anomaly detection and obtain an anomaly detection result;

[0015] A strategy generation module, configured to generate a security protection strategy for the industrial control device according to the device type of the industrial control device if the abnormality detection result is a device abnormality;

[0016] A security protection module is used to perform security protection on the industrial control equipment based on the security protection strategy.

[0017] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0018] at least one processor; and

[0019] a memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the industrial control equipment security protection method described in any embodiment of the present invention.

[0021] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the industrial control equipment security protection method described in any embodiment of the present invention when executed.

[0022] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the service resource scheduling method described above is implemented.

[0023] The technical solution of the embodiment of the present invention obtains the equipment monitoring data of the industrial control equipment sent by the data acquisition node; determines the target anomaly detection model according to the equipment type of the industrial control equipment; inputs the equipment monitoring data into the target anomaly detection model to perform equipment anomaly detection and obtain an anomaly detection result; if the anomaly detection result is an equipment anomaly, generates a security protection strategy for the industrial control equipment according to the equipment type of the industrial control equipment; and performs security protection on the industrial control equipment based on the security protection strategy. The above technical solution realizes the security protection of industrial control equipment, improves the defense capability of industrial control equipment against various security attacks, and ensures the safe and stable operation of industrial production. Through intelligent analysis of potential security threats and real-time anomaly detection, security protection can take measures before or in the early stages of an attack, effectively reducing the incidence and impact of security incidents.

[0024] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 This is a flow chart of a method for protecting the safety of industrial control equipment provided according to the first embodiment of the present invention;

[0027] Figure 2 This is a flow chart of a method for protecting the safety of industrial control equipment provided according to Embodiment 2 of the present invention;

[0028] Figure 3 Schematic diagram of the system architecture of an industrial control equipment security protection system provided according to Embodiment 3 of the present invention;

[0029] Figure 4 This is a schematic diagram of the structure of a safety protection device for industrial control equipment provided according to a fourth embodiment of the present invention;

[0030] Figure 5 It is a structural schematic diagram of an electronic device for implementing the industrial control equipment security protection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] Embodiment 1

[0034] Figure 1 This is a flowchart of a method for protecting industrial control equipment security provided by Embodiment 1 of the present invention. This embodiment is applicable to the case where abnormal detection of industrial control equipment is performed and security protection is performed on equipment with potential security threats. The method can be performed by an industrial control equipment security protection device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device. Figure 1 As shown, the method includes:

[0035] S110, acquiring equipment monitoring data of the industrial control equipment sent by the data acquisition node.

[0036] S120: Determine a target anomaly detection model according to the device type of the industrial control device.

[0037] S130: Input the equipment monitoring data into the target anomaly detection model to perform equipment anomaly detection and obtain anomaly detection results.

[0038] S140: If the abnormality detection result is that the device is abnormal, a security protection strategy for the industrial control device is generated according to the device type of the industrial control device.

[0039] S150. Perform security protection on industrial control equipment based on security protection strategies.

[0040] Among them, industrial control equipment can be different types of equipment in industrial control systems, specifically including security equipment and control equipment, such as various types of sensors, servers and actuators.

[0041] The equipment monitoring data of industrial control equipment can be collected by collecting data from multiple data collection nodes deployed in the industrial control system. The data collection nodes are data collection agents pre-deployed in the industrial control system, which can collect various parameter data of different types of industrial control data in real time, such as equipment monitoring data.

[0042] Among them, the equipment types of industrial control equipment may include security equipment types and control equipment types; control equipment may include production-related DCS (Distributed Control System), PLC (Programmable Logic Controller) and RTU (Remote Terminal Unit), etc. Security equipment may include firewalls and antivirus walls, etc.

[0043] Furthermore, the device monitoring data corresponding to industrial control devices of different device types are different. If the device type of the industrial control device is a control type, the device monitoring data is the device operation data; if the device type of the industrial control device is a security type, the device monitoring data is the network communication flow data.

[0044] The equipment operation data may be the operation parameters of the industrial control equipment, including the equipment operation temperature, pressure, current and power, etc. The network communication flow data may be the communication flow generated between the security equipment and other equipment or hosts during operation.

[0045] Data preprocessing is performed on the data collected by the data collection nodes, such as equipment monitoring data, which can specifically include removing noise and outliers, data standardization, and feature extraction. Among them, data standardization specifically maps different types of data to a unified numerical range; feature extraction specifically extracts features that are valuable for security analysis, such as data change rate and communication frequency.

[0046] Among them, the target anomaly detection model is used to detect device anomalies of industrial control equipment, and when an equipment anomaly is detected, the input device monitoring data is converted into a device security event and output. It should be noted that due to the differences in the device characteristics of industrial control equipment of different types, the anomaly detection models of different device types are different.

[0047] Optionally, a target anomaly detection model is determined according to the device type of the industrial control device, including: if the device type of the industrial control device is a control type, the target anomaly detection model is a control device anomaly detection model; if the device type of the industrial control device is a security type, the target anomaly detection model is a security device anomaly detection model; wherein the control device anomaly detection model is obtained by pre-training a preset first detection network model using historical device operation data corresponding to multiple control devices in a historical time period; and the security device anomaly detection model is obtained by pre-training a preset second detection network model using historical network communication traffic data corresponding to multiple security devices in a historical time period.

[0048] The control device anomaly detection model and the safety device anomaly detection model are both obtained by relevant technicians pre-training the preset detection model based on the corresponding sample training data. The preset first detection model and the second detection model may be the same or different.

[0049] This embodiment provides a model training method for a control device anomaly detection model, specifically, obtaining historical operation data corresponding to multiple control devices in a historical time period. Among them, the first detection network model can be an autoencoder or an isolation forest. The historical device operation data of multiple control devices are input into the first detection network model, and the first detection network model learns the normal operation mode of multiple control devices, thereby continuously optimizing the model parameters of the first detection network model until the model training end condition is met, such as reaching a set iteration number threshold, etc., to obtain a control device anomaly detection model.

[0050] This embodiment provides a model training method for a security device anomaly detection model. Specifically, historical network communication flow data corresponding to multiple security devices in a historical time period are obtained. Among them, the second detection network model can be an autoencoder or an isolation forest. The historical network communication flow data of multiple security devices are input into the second detection network model, and the second detection network model learns the normal operation mode of multiple security devices, thereby continuously optimizing the model parameters of the second detection network model until the model training end conditions are met, such as reaching a set iteration number threshold, etc., to obtain a security device anomaly detection model.

[0051] The device monitoring data is input into the target anomaly detection model to perform device anomaly detection and obtain anomaly detection results. Specifically, if the industrial control device is a control device, the device operation data is input into the target anomaly detection model to perform device anomaly detection and obtain anomaly detection results. Among them, the anomaly detection results may include device anomaly and device normal. If the device is abnormal, the anomaly detection results also include device security events. Among them, the device security event is obtained by the target anomaly detection model converting the input device monitoring data into an event.

[0052] If the abnormal detection result is that the device is abnormal, then a security protection strategy for the industrial control device is generated according to the device type of the industrial control device. Specifically, if the industrial control device is a control device, the security protection strategy can be isolation and network segmentation, which can be to isolate the abnormal device from the normal network environment to prevent it from further spreading malicious behavior or affecting other devices, restrict the communication between the abnormal device and other devices, systems or external networks, and only allow communication with the security monitoring system or administrator; and divide the network where the control device is located into multiple isolation segments to ensure that the abnormal device cannot affect the key control system or core equipment. The security protection strategy can also be a function permission restriction strategy, which is to temporarily disable or restrict certain key functions of the abnormal device, especially operations that may bring security risks, such as modifying control parameters, accessing sensitive data, etc. The security protection strategy can also be to establish a patch repair strategy, specifically, to issue patches or update strategies to ensure that abnormal devices install security patches or repair known vulnerabilities in a timely manner.

[0053] If the anomaly detection result is an equipment anomaly, and the industrial control equipment is a security device, it is necessary to predict and trace the attack on the security device, so as to formulate a security protection strategy based on the prediction and tracing results.

[0054] In an optional embodiment, a security protection strategy for the industrial control equipment is generated based on the device type of the industrial control equipment, including: if the device type of the industrial control equipment is a security device type, obtaining the device operation log of the industrial control equipment and the device security events in the abnormal detection results; inputting the device operation log and device security events of the industrial control equipment into a pre-trained attack prediction model to obtain the attack type and attack level output by the model; and generating a security protection strategy for the industrial control equipment based on the attack type and attack level.

[0055] Among them, the device operation log may include user operation log and device operation log, etc.; the user operation log may include login information, operation information, operation status, mobile storage, device access and network external connection information, etc.; the device operation log may include device operation information, network connection information, operation information and configuration information, etc.

[0056] The attack prediction model is used to predict the types and levels of attacks that abnormal security devices may suffer, which can be obtained through pre-training by relevant technical personnel. The types of attacks can include request forgery, software viruses, malicious advertisements, side-channel attacks, identity impersonation, and configuration vulnerability attacks. The attack levels can include high, medium, and low, which are used to characterize the severity of the attack.

[0057] This embodiment also provides a model training method for an attack prediction model. Specifically, the historical operation logs and historical security events of security devices in the historical time period are obtained, and an attack prediction sample data set including the historical operation logs and historical security time of multiple security devices is generated; each sample data in the attack prediction sample data set is labeled, and the sample attack type and sample attack level of each sample data are generated to obtain the label data of each sample data. The attack prediction sample data set with sample label data is input into the preset prediction network model to obtain the predicted attack type and predicted attack level output by the model. According to the predicted attack type, predicted attack level, standard attack type and standard attack level, based on the preset loss function, the prediction network model is trained until the model training end condition is met to obtain the attack prediction model. Among them, the prediction network model can be a support vector machine or MLP (Multilayer Perceptron), etc. The loss function can be a cross entropy loss function or a mean square error loss function, etc.; the model training end condition can be that the loss value reaches a preset loss threshold or the loss value tends to be stable, and it can also be that the number of model training iterations reaches a set number threshold.

[0058] Input the equipment operation log and equipment security events of the industrial control equipment into the pre-trained attack prediction model to obtain the attack type and attack level output by the model; generate the security protection strategy of the industrial control equipment according to the attack type and attack level. Exemplarily, if the attack type is a preset attack type and the attack level meets the preset attack level, a security protection strategy for the security equipment is generated; if the attack type is not a preset attack type or the attack level does not meet the preset attack level, a security protection strategy for the security equipment is not generated.

[0059] In an optional embodiment, a security protection strategy for industrial control equipment is generated according to the attack type and attack level, including:

[0060] Step a1: If the attack level meets the preset attack tracing judgment condition, the device security event of the industrial control device is input into the pre-trained attack tracing model to obtain the attack impact range node output by the model.

[0061] Among them, the attack tracing model is used to predict the impact range of the attack, that is, to determine the affected industrial control equipment. It can be pre-trained by relevant technical personnel according to actual needs.

[0062] This embodiment also provides a method for training an attack tracing model. Specifically, traceability sample data is constructed, and the traceability sample data consists of graph structure data and its related nodes, edges and graph features. Define the feature vector of each node to represent the node feature. The node is an industrial control equipment node, and the node feature is the device attribute feature of the industrial control equipment; wherein the edge feature is the association relationship between nodes, that is, the relationship attribute of the industrial control equipment with an association relationship. The initial network model of the attack tracing model can be GNN (Graph Neural Network). The feature of the graph is the connection between nodes, which can be specifically represented by an adjacency matrix.

[0063] The initial GNN model is trained using a topological structure pre-constructed based on the association relationship between industrial control devices and device-related attribute data to learn the connection relationship characteristics between industrial control devices and the association relationship weight parameters until the model training end conditions are met, thereby obtaining a trained attack tracing model.

[0064] The device security events of the industrial control equipment are input into the pre-trained attack tracing model, and the model is used to parse the device security events. Based on the parsed device features, the associated impact nodes closely related to the device are determined to obtain the attack impact range nodes output by the model. The number of attack impact range nodes can be one or more. The attack impact range nodes can include attack initiators and attack intruders, etc.

[0065] Step a2: Generate a security protection strategy for industrial control equipment based on the attack impact range nodes, attack type and attack level.

[0066] Optionally, a security protection policy for industrial control equipment is generated based on the attack impact range node, attack type and attack level, including: if the attack level meets the policy generation conditions, selecting a target protection policy template from at least one candidate protection policy template based on the attack type; and generating a security protection policy for the industrial control equipment based on the target protection policy template according to the device-related information of the associated devices in the attack impact range node.

[0067] The policy generation condition may be preset by relevant technical personnel according to actual needs. For example, the policy generation condition may be that the attack level meets a preset level judgment condition. The preset level judgment condition may be, for example, that the attack level is intermediate or advanced.

[0068] Different attack types correspond to different protection policy templates, and different attack types can correspond to at least one protection policy template. Candidate protection policy templates are protection policy templates corresponding to different attack types, and can include network access control rule adjustment templates, device operation parameter modification templates, and emergency response program startup templates.

[0069] Among them, network access control rule adjustments may include, for example, limiting access rights of suspicious devices, blocking abnormal network connections, etc.; device operation parameter modification templates may include, for example, adjusting the control strategy of the controller to reduce risks, etc.; initiating emergency response procedures, such as isolating attacked devices and backing up critical data, etc.

[0070] After determining the target protection policy template according to the attack type, the device-related information of the associated devices in the attack impact range node will be filled with the target protection policy template to obtain the security protection policy of the security device. The security protection policy is sent to the corresponding security device so that the security device can perform security protection based on the corresponding security protection policy.

[0071] The technical solution of the embodiment of the present invention obtains the equipment monitoring data of the industrial control equipment sent by the data acquisition node; determines the target anomaly detection model according to the equipment type of the industrial control equipment; inputs the equipment monitoring data into the target anomaly detection model to perform equipment anomaly detection and obtain an anomaly detection result; if the anomaly detection result is an equipment anomaly, generates a security protection strategy for the industrial control equipment according to the equipment type of the industrial control equipment; and performs security protection on the industrial control equipment based on the security protection strategy. The above technical solution realizes the security protection of industrial control equipment, improves the defense capability of industrial control equipment against various security attacks, and ensures the safe and stable operation of industrial production. Through intelligent analysis of potential security threats and real-time anomaly detection, security protection can take measures before or in the early stages of an attack, effectively reducing the incidence and impact of security incidents.

[0072] Embodiment 2

[0073] Figure 2 This is a flow chart of a method for protecting the safety of industrial control equipment provided in the second embodiment of the present invention. This embodiment provides a preferred example based on the above embodiment.

[0074] like Figure 2 As shown, the method embodiment steps include:

[0075] S21, obtaining equipment monitoring data of industrial control equipment sent by the data acquisition node;

[0076] If the device type of the industrial control equipment is a control type, the device monitoring data is the device operation data; if the device type of the industrial control equipment is a security type, the device monitoring data is the network communication flow data.

[0077] S22. Determine a target anomaly detection model according to the device type of the industrial control device.

[0078] If the device type of the industrial control device is a control type, the target anomaly detection model is a control device anomaly detection model; if the device type of the industrial control device is a security type, the target anomaly detection model is a security device anomaly detection model.

[0079] S23: Input the equipment monitoring data into the target anomaly detection model to perform equipment anomaly detection and obtain anomaly detection results.

[0080] S24. If the abnormality detection result is that the device is abnormal, and the industrial control device is a control device, a security protection strategy for the control device is generated. If the abnormality detection result is that the device is abnormal, and the industrial control device is a security device, S25-S29 are executed.

[0081] S25. Obtain device operation logs of security devices and device security events in abnormal detection results.

[0082] S26. Input the device operation log and device security events of the industrial control equipment into the pre-trained attack prediction model to obtain the attack type and attack level output by the model.

[0083] S27. If the attack level meets the preset attack tracing judgment conditions, the device security event of the industrial control device is input into the pre-trained attack tracing model to obtain the attack impact range node output by the model.

[0084] S28. If the attack level meets the policy generation condition, a target protection policy template is selected from at least one candidate protection policy template according to the attack type.

[0085] S29. Generate a security protection policy for the security device based on the target protection policy template according to the device-related information of the associated device in the attack impact range node.

[0086] S30. Perform security protection on corresponding industrial control equipment based on the security protection strategy.

[0087] Embodiment 3

[0088] Figure 3 This is a schematic diagram of the system architecture of an industrial control equipment security protection system provided in Embodiment 3 of the present invention. Based on the above embodiments, this embodiment provides an example of the architecture of an industrial control equipment security protection system.

[0089] The industrial control equipment security protection system includes industrial control equipment, data acquisition preprocessing module, analysis engine module and security policy generation module. Among them, industrial control equipment comes from industrial control systems, and data acquisition agents are deployed at various key nodes of industrial control systems, including sensors, controllers, servers, etc. These agents can collect various types of data in real time, such as equipment operating parameters (including temperature, pressure and current, etc.), network communication data, equipment operation log data (including host login information, operation information, operation status, mobile storage, equipment access, network external connection data, equipment operation information, network connection information, operation information, security events and configuration information, etc.). The data acquisition preprocessing module preprocesses the collected data, including data cleaning (removing noise, outliers, etc.), data standardization (mapping different types of data to a unified numerical range) and feature extraction (extracting features that are valuable for security analysis, such as data change rate, communication frequency, etc.), so that subsequent artificial intelligence models can process them.

[0090] The anomaly detection model is used to analyze the data processed by the data acquisition preprocessing module to predict whether there are anomalies in the industrial control equipment. The anomaly detection model can use unsupervised learning algorithms, such as autoencoders or isolation forests, to analyze the preprocessed data and learn the normal operating mode of each industrial control device in the industrial control system. By comparing the difference between real-time data and normal modes, the abnormalities of device and network behavior can be identified. For example, when the data collected by the industrial control equipment changes that do not conform to the normal production process, the model can detect it in time.

[0091] The attack prediction model is used to predict the attack type and severity of security devices. Supervised learning algorithms, such as neural networks or support vector machines, can be used to learn and predict potential security threats by combining historical security event data and the characteristics of known attack types. The model takes the current network communication data and device operation log data of industrial control equipment and security events as input, and outputs the possibility and type of security attacks. For example, when behavioral features similar to known attack patterns are detected in network communications, the model can predict the type of attack that may occur and assess its severity.

[0092] The attack tracing model is used to determine the attack impact range of abnormal security devices. Specifically, the attack tracing model can be trained using technologies such as graph neural networks to analyze the network topology and communication relationships of industrial control equipment and trace the source of the attack. By analyzing the attack path and the propagation trajectory of the attack behavior in the network, the initiator and intrusion point of the attack can be determined, providing a basis for subsequent security response.

[0093] According to the analysis results of the analysis engine module, the corresponding security policy is automatically generated. When an anomaly is detected or a potential threat is predicted, the security policy generation module will formulate targeted security protection strategies based on the attack type, severity and possible impact range. Security protection strategies can include adjusting network access control rules (such as limiting access rights of suspicious devices, blocking abnormal network connections, etc.), modifying the operating parameters of the device (such as adjusting the control strategy of the controller to reduce risks), and initiating emergency response procedures (such as isolating attacked devices, backing up key data, etc.). The security policy generation module sends the generated security protection strategy to the relevant security devices and control devices in the industrial control system in real time to achieve active security protection.

[0094] Establish an adaptive learning and updating mechanism so that the relevant models in the entire industrial control equipment security protection system can continuously learn and adapt to changes in industrial control equipment and emerging security threats. When a new security incident occurs or the system is upgraded or adjusted, the system will automatically collect new data and use this data to update and optimize the model in the analysis engine module. At the same time, maintain information sharing with external security intelligence sources, such as security research institutions, industry security alliances, etc., to obtain the latest attack types and security trend information in a timely manner, and integrate this information into the model training and update process to further improve the system's defense capabilities against new attacks.

[0095] The data sent by the data acquisition preprocessing module to the analysis engine module can be encrypted data to ensure the security of data transmission. The policy format conversion unit is used to encode the security protection policy generated by the security policy generation unit to obtain an automated script, and send it to the policy processing unit of the industrial control device, which decodes it into control instructions that can be executed by the device.

[0096] This embodiment uses the intelligent analysis engine to predict potential security threats and detect anomalies in real time, so that the system can take measures before or in the early stages of an attack, changing the passive situation of traditional security protection and effectively reducing the incidence and impact of security incidents. The data acquisition preprocessing module can process complex and diverse data types in industrial control equipment, and the analysis engine module can learn the dynamic change rules of the system, so that the system can adapt to the complex and changeable operating environment, avoiding the problem of security policy failure caused by factors such as changes in production processes and equipment updates. The security policy generation module formulates targeted security policies based on the specific circumstances of the attack, avoiding the problems of over-protection or under-protection that may be caused by traditional general security policies, and improving the accuracy and effectiveness of security protection. The adaptive learning and update mechanism ensures that the system can continuously learn new security knowledge and respond to new security challenges, so that it can maintain effective protection of industrial control systems for a long time and adapt to the ever-changing network security attack environment.

[0097] Embodiment 4

[0098] Figure 4 The schematic diagram of the structure of a security protection device for industrial control equipment provided in the fourth embodiment of the present invention. The security protection device for industrial control equipment provided in the embodiment of the present invention can be applied to the situation where abnormality detection is performed on industrial control equipment and security protection is performed on equipment with potential security threats. The security protection device for industrial control equipment can be implemented in the form of hardware and / or software, such as Figure 4 As shown, the device specifically includes: a monitoring data acquisition module 401, a model determination module 402, an anomaly detection module 403 and a strategy generation module 404. Among them,

[0099] The monitoring data acquisition module 401 is used to acquire the equipment monitoring data of the industrial control equipment sent by the data acquisition node;

[0100] A model determination module 402 is used to determine a target anomaly detection model according to the device type of the industrial control device;

[0101] Anomaly detection module 403, used for inputting the device monitoring data into the target anomaly detection model to perform device anomaly detection and obtain anomaly detection results;

[0102] A policy generation module 404 is used to generate a security protection policy for the industrial control device according to the device type of the industrial control device if the abnormality detection result is a device abnormality;

[0103] The security protection module 405 is used to perform security protection on the industrial control equipment based on the security protection strategy.

[0104] The technical solution of the embodiment of the present invention obtains the equipment monitoring data of the industrial control equipment sent by the data acquisition node; determines the target anomaly detection model according to the equipment type of the industrial control equipment; inputs the equipment monitoring data into the target anomaly detection model to perform equipment anomaly detection and obtain an anomaly detection result; if the anomaly detection result is an equipment anomaly, generates a security protection strategy for the industrial control equipment according to the equipment type of the industrial control equipment; and performs security protection on the industrial control equipment based on the security protection strategy. The above technical solution realizes the security protection of industrial control equipment, improves the defense capability of industrial control equipment against various security attacks, and ensures the safe and stable operation of industrial production. Through intelligent analysis of potential security threats and real-time anomaly detection, security protection can take measures before or in the early stages of an attack, effectively reducing the incidence and impact of security incidents.

[0105] Optionally, the policy generation module 404 includes:

[0106] A security event acquisition unit, configured to acquire a device operation log of the industrial control device and a device security event in the abnormality detection result if the device type of the industrial control device is a security device type;

[0107] An attack prediction unit, used to input the device operation log and device security events of the industrial control device into a pre-trained attack prediction model to obtain the attack type and attack level output by the model;

[0108] A policy generating unit is used to generate a security protection policy for the industrial control device according to the attack type and attack level.

[0109] Optionally, a policy generation unit includes:

[0110] An attack range determination subunit, for inputting the device security event of the industrial control device into a pre-trained attack tracing model to obtain an attack impact range node output by the model if the attack level meets a preset attack source tracing judgment condition;

[0111] The strategy generation subunit is used to generate a security protection strategy for the industrial control device according to the attack impact range node, the attack type and the attack level.

[0112] Optionally, a policy generation subunit is used to:

[0113] If the attack level satisfies the policy generation condition, selecting a target protection policy template from at least one candidate protection policy template according to the attack type;

[0114] According to the device-related information of the associated devices in the attack impact range node, based on the target protection policy template, a security protection policy for the industrial control device is generated.

[0115] Optionally, if the device type of the industrial control device is a control type, the device monitoring data is device operation data; if the device type of the industrial control device is a security type, the device monitoring data is network communication traffic data.

[0116] Optionally, the model determination module 402 is specifically configured to:

[0117] If the device type of the industrial control device is a control type, the target anomaly detection model is a control device anomaly detection model;

[0118] If the device type of the industrial control device is a security type, the target anomaly detection model is a security device anomaly detection model;

[0119] Among them, the control device anomaly detection model uses the historical device operation data corresponding to multiple control devices in the historical time period to pre-train the preset first detection network model; the safety device anomaly detection model uses the historical network communication traffic data corresponding to multiple safety devices in the historical time period to pre-train the preset second detection network model.

[0120] The industrial control equipment security protection device provided in the embodiment of the present invention can execute the industrial control equipment security protection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0121] Embodiment 5

[0122] Figure 5 A schematic diagram of an electronic device 50 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0123] like Figure 5 As shown, the electronic device 50 includes at least one processor 51, and a memory connected to the at least one processor 51 in communication, such as a read-only memory (ROM) 52, a random access memory (RAM) 53, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 51 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 52 or the computer program loaded from the storage unit 58 to the random access memory (RAM) 53. In the RAM 53, various programs and data required for the operation of the electronic device 50 can also be stored. The processor 51, the ROM 52, and the RAM 53 are connected to each other via a bus 54. An input / output (I / O) interface 55 is also connected to the bus 54.

[0124] A number of components in the electronic device 50 are connected to the I / O interface 55, including: an input unit 56, such as a keyboard, a mouse, etc.; an output unit 57, such as various types of displays, speakers, etc.; a storage unit 58, such as a disk, an optical disk, etc.; and a communication unit 59, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 59 allows the electronic device 50 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0125] The processor 51 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 51 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 51 executes the various methods and processes described above, such as the industrial control equipment security protection method.

[0126] In some embodiments, the industrial control equipment security protection method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 58. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 50 via the ROM 52 and / or the communication unit 59. When the computer program is loaded into the RAM 53 and executed by the processor 51, one or more steps of the industrial control equipment security protection method described above can be performed. Alternatively, in other embodiments, the processor 51 can be configured to execute the industrial control equipment security protection method in any other appropriate manner (for example, by means of firmware).

[0127] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0128] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0129] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0130] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0131] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0132] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0133] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0134] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for protecting the safety of industrial control equipment, characterized in that: include: Obtain equipment monitoring data of industrial control equipment sent by data acquisition nodes; Determining a target anomaly detection model according to the device type of the industrial control device; Inputting the device monitoring data into the target anomaly detection model to perform device anomaly detection to obtain an anomaly detection result; If the abnormality detection result is that the device is abnormal, generating a security protection strategy for the industrial control device according to the device type of the industrial control device; The industrial control equipment is provided with security protection based on the security protection strategy.

2. The method according to claim 1, characterized in that Generating a security protection strategy for the industrial control device according to the device type of the industrial control device includes: If the device type of the industrial control device is a security device type, obtaining a device operation log of the industrial control device and a device security event in the abnormal detection result; Inputting the device operation log and device security events of the industrial control device into the pre-trained attack prediction model to obtain the attack type and attack level output by the model; A security protection strategy for the industrial control device is generated according to the attack type and attack level.

3. The method according to claim 2, characterized in that Generating the security protection strategy of the industrial control device according to the attack type and attack level includes: If the attack level meets the preset attack source tracing judgment condition, the device security event of the industrial control device is input into the pre-trained attack source tracing model to obtain the attack impact range node output by the model; A security protection strategy for the industrial control device is generated according to the attack impact range nodes, the attack type and the attack level.

4. The method according to claim 3, characterized in that Generating the security protection strategy of the industrial control device according to the attack impact range node, the attack type and the attack level includes: If the attack level satisfies the policy generation condition, selecting a target protection policy template from at least one candidate protection policy template according to the attack type; According to the device-related information of the associated devices in the attack impact range node, based on the target protection policy template, a security protection policy for the industrial control device is generated.

5. The method according to claim 1, characterized in that If the device type of the industrial control device is a control type, the device monitoring data is device operation data; if the device type of the industrial control device is a security type, the device monitoring data is network communication flow data.

6. The method according to claim 5, characterized in that The step of determining a target anomaly detection model according to the device type of the industrial control device includes: If the device type of the industrial control device is a control type, the target anomaly detection model is a control device anomaly detection model; If the device type of the industrial control device is a security type, the target anomaly detection model is a security device anomaly detection model; Among them, the control device anomaly detection model uses the historical device operation data corresponding to multiple control devices in the historical time period to pre-train the preset first detection network model; the safety device anomaly detection model uses the historical network communication traffic data corresponding to multiple safety devices in the historical time period to pre-train the preset second detection network model.

7. A safety protection device for industrial control equipment, characterized in that: include: A monitoring data acquisition module is used to acquire equipment monitoring data of industrial control equipment sent by a data acquisition node; A model determination module, used to determine a target anomaly detection model according to the device type of the industrial control device; An anomaly detection module, used for inputting the device monitoring data into the target anomaly detection model to perform device anomaly detection and obtain an anomaly detection result; A strategy generation module, configured to generate a security protection strategy for the industrial control device according to the device type of the industrial control device if the abnormality detection result is a device abnormality; A security protection module is used to perform security protection on the industrial control equipment based on the security protection strategy.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the industrial control equipment security protection method described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the industrial control equipment security protection method described in any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the industrial control equipment security protection method according to any one of claims 1 to 6.

Images