Traffic anomaly analysis and detection method, system and device based on industrial control network, and medium

Abstract

The invention provides a flow anomaly analysis and detection method, system and device based on an industrial control network, and a medium, and the method comprises the steps: carrying out the collection and analysis, data preprocessing, data calculation and analysis, and persistent storage of the flow data of a process business network of an industrial control system; a network flow behavior baseline model is automatically generated according to a process service communication condition, a flow threshold sensitivity dynamic adjustment mechanism can be utilized, learning and self-optimization can be performed from new flow data, and the network flow behavior baseline model becomes more intelligent and accurate as time goes on, and can better adapt to continuous evolution of network threats; the network traffic behavior baseline model is used for carrying out real-time network traffic dynamic detection, the traffic abnormal condition of each device in the network is found in time, an alarm is given, and the problems that in the prior art, a statistical analysis means is not established for a specific process service communication link, threshold setting is lack of accuracy, and threshold adjustment is difficult are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control network security, and in particular to a method, system, device and medium for analyzing and detecting traffic anomalies based on an industrial control network. Background Art

[0002] The Industrial Internet has injected new vitality into modern industry and improved production efficiency, but it has also brought more security threats. In recent years, many industrial control intrusion incidents have occurred at home and abroad, which have seriously affected industrial production safety and made industrial control security issues more prominent. The increasing complexity and scale of industrial control network traffic have not only brought convenience and efficiency, but also brought new challenges and risks, such as the spread of malware and denial of service attacks. The importance of traffic anomaly detection in industrial control networks has become increasingly prominent in the field of network security, and has become a key link in maintaining the security and stability of the network environment. Network traffic anomaly analysis and detection aims to identify and analyze abnormal behaviors in the network, which may indicate potential network attacks, security threats or abnormal system activities. Through effective anomaly analysis and detection methods, these threats can be discovered and responded to in a timely manner to reduce potential security risks and losses.

[0003] Traditional traffic anomaly analysis and detection methods for industrial control networks mainly perform simple fixed threshold detection on process business traffic, and do not establish statistical analysis methods for specific process business communication links. When business traffic fluctuates, the threshold range is difficult to accurately determine. Even if the threshold is determined, it is difficult to adjust the threshold when the business changes. Summary of the invention

[0004] The present invention aims to provide a method, system, device and medium for analyzing and detecting abnormal traffic based on industrial control networks. The method can establish a traffic behavior baseline model for specific process business communication links and industrial protocols according to the address information, protocol, bandwidth and other conditions of the communicating parties in the network traffic, and realize the automatic construction and update of the traffic baseline model, solving the problems of the existing process business traffic analysis and detection technology that the statistical analysis means are not established for specific process business communication links, the threshold setting lacks accuracy, and the threshold adjustment is difficult. Using the network traffic behavior baseline model to perform abnormal analysis and detection on real-time traffic data can quickly detect the abnormal traffic of each device in the industrial network traffic.

[0005] The present invention provides a method for analyzing and detecting abnormal flow in an industrial control network, comprising the following steps:

[0006] S100, collects network traffic;

[0007] S200, performing in-depth analysis and session association on the collected network traffic to generate formatted data;

[0008] S300, preprocessing the formatted data generated by the analysis, removing duplicate or abnormal data by aggregation, filtering, etc., and generating metadata to be stored in a distributed database as basic data;

[0009] S400, based on the obvious periodicity of process business traffic, automatically establish a network traffic behavior baseline model for specific process business communication links and industrial protocols according to a preset period, automatically adjust according to real-time traffic, and periodically update and optimize the network traffic behavior baseline model;

[0010] S500, uses a baseline model of network traffic behavior to perform anomaly analysis and detection on real-time traffic data;

[0011] S600, when the real-time traffic data violates the network traffic behavior baseline model, the system automatically triggers a response alarm mechanism and generates an alarm message.

[0012] Furthermore, in step S200, through deep analysis, the traffic containing industrial protocols is screened out, and session association is performed to extract key network traffic information such as access source IP, destination IP, source MAC, destination MAC, destination port, application protocol, transmission protocol, traffic byte count, session duration, etc., and generate formatted data.

[0013] Furthermore, in step S400, a network traffic behavior baseline model is established, specifically in the following manner: first, a traffic baseline sampling period is set, metadata within the sampling period is extracted from a distributed database, and an aggregation algorithm is used to aggregate and group the network traffic metadata according to the three features of application protocol, source IP address, and destination IP address. Each group is a set of multiple metadata F = {f 1 , f 2… f n}, calculate different metadata f in the same group iThe average traffic bytes per second Xi, Xi = Ki / Ti, Ki represents the traffic bytes of metadata, Ti represents the session duration of metadata, the traffic threshold of each packet = max(X1, X2…Xi), and the detection period of each packet = max(T1, T2…Ti). After analysis and calculation, each piece of data is concatenated with fields such as application protocol, source and destination address, and encrypted to generate a unique identification number ID, and the data set with the ID is persistently stored in a distributed database. The data structure of the network traffic behavior baseline model includes basic network information (source IP address, destination IP address, source MAC address, destination MAC address, application protocol, transmission protocol) and network traffic information (traffic threshold, average traffic bytes, detection period).

[0014] Furthermore, in step S400, the network traffic behavior baseline model is periodically updated and optimized, specifically in the following manner: initialize an empty set M and an average traffic threshold sensitivity X, the preset value of X is 10%, and depends on the traffic changes caused by process business changes. The network traffic behavior baseline model is used to analyze and detect real-time traffic, and an alarm is generated if the data flow is abnormal data. For data flows whose data flow thresholds are within the traffic threshold sensitivity X, they are added to the set M. At the beginning of each preset cycle, the data in the set M is added to the network traffic behavior baseline model for recalculation and analysis. If the network traffic behavior baseline model already exists in the distributed database, it will be automatically updated based on the unique identification ID of the data, and step S400 is repeated. The network traffic behavior baseline model is periodically updated using the traffic threshold sensitivity dynamic adjustment mechanism, thereby achieving continuous dynamic optimization of the network traffic behavior baseline model.

[0015] Furthermore, in step S500, the use of the network traffic behavior baseline model to perform abnormal analysis and detection on real-time traffic data includes:

[0016] S510, abnormal network communication behavior information detection: analyze and detect according to the source and destination IP, source and destination MAC, application protocol and corresponding port in the process business communication link;

[0017] S520, instantaneous time traffic detection: by calculating the average traffic bytes of real-time sessions and comparing them with the network traffic behavior baseline model, abnormal behaviors of sudden changes in traffic rates in industrial control networks can be discovered;

[0018] S530, flow detection per unit time: detects malicious behaviors such as flow exceeding the threshold and long period of no messages. If multiple sessions fall in the same detection interval, the sessions are merged and the average flow byte count is calculated based on the merged session flow size and session duration. If the flow threshold of the network flow behavior baseline model is exceeded, it indicates that there is a flow anomaly. If there is no flow in the real-time session for multiple consecutive detection cycles, it indicates that there is malicious behavior such as long period of no messages.

[0019] Furthermore, in step S510, the abnormal network communication behavior information detection includes:

[0020] a) Communication requests from unknown IP addresses indicate the risk of abnormal asset access;

[0021] b) When the destination IP is detected as a new IP address, it indicates the risk of illegal external connection of assets;

[0022] c) By comparing the consistency of IP address and MAC address, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting;

[0023] d) Check the usage of different ports under the same protocol and the use of illegal ports to identify possible illegal business access risks.

[0024] The present invention also provides a system for analyzing and detecting abnormal flow based on an industrial control network, comprising:

[0025] Network traffic collection module, used to collect network traffic;

[0026] Network traffic collection module, used to collect network traffic;

[0027] Industrial network traffic analysis module, used to perform in-depth analysis and session association of collected network traffic to generate formatted data;

[0028] The data preprocessing module is used to preprocess the formatted data generated by the analysis, remove duplicate or abnormal data through aggregation and filtering, and generate metadata to be stored in the distributed database as basic data;

[0029] The baseline model building module is used to automatically establish a network traffic behavior baseline model for specific process business communication links and industrial protocols according to a preset period based on the obvious periodicity of process business traffic; and automatically adjust according to real-time traffic, and periodically update and optimize the network traffic behavior baseline model;

[0030] Real-time traffic access and detection module, used to analyze and detect anomalies in real-time traffic data using the network traffic behavior baseline model;

[0031] The abnormal traffic alarm module is used to automatically trigger the response alarm mechanism and generate alarm information when the real-time traffic data violates the baseline model of network traffic behavior.

[0032] Furthermore, the real-time traffic access and detection module includes:

[0033] Abnormal network communication behavior information detection module, used to analyze and detect according to the source and destination IP, source and destination MAC, application protocol and corresponding port in the process business communication link;

[0034] The instantaneous time traffic detection module is used to detect abnormal behaviors of sudden changes in traffic rate in industrial control networks by calculating the average traffic bytes of real-time sessions and comparing them with the baseline model of network traffic behavior;

[0035] The unit time traffic detection module is used to detect malicious behaviors such as traffic exceeding the threshold and no messages for a long time. If multiple sessions fall in the same detection interval, the sessions are merged and the average traffic bytes are calculated based on the merged session traffic size and session duration. If it exceeds the traffic threshold of the network traffic behavior baseline model, it indicates that there is traffic anomaly; if the real-time session has no traffic for multiple consecutive detection cycles, it indicates malicious behaviors such as no messages for a long time.

[0036] Furthermore, in the abnormal network communication behavior information detection module:

[0037] a) Communication requests from unknown IP addresses indicate the risk of abnormal asset access;

[0038] b) When the destination IP is detected as a new IP address, it indicates the risk of illegal external connection of assets;

[0039] c) By comparing the consistency of IP address and MAC address, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting;

[0040] d) Check the usage of different ports under the same protocol and the use of illegal ports to identify possible illegal business access risks.

[0041] The present invention also provides an electronic device, comprising:

[0042] at least one processor; and a memory communicatively coupled to the at least one processor;

[0043] The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the above method by executing the instructions stored in the memory.

[0044] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store instructions, and when the instructions are executed, the above method is implemented.

[0045] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0046] 1. The present invention establishes a network traffic behavior baseline model for specific process business communication links and industrial protocols, which can more effectively identify communication paths and traffic sources and promptly discover abnormal conditions of each device in the industrial control network.

[0047] 2. The present invention can automatically establish an industrial network traffic behavior baseline model and automatically realize continuous iterative updating of the network traffic behavior baseline model.

[0048] 3. The present invention avoids the problems of lack of accuracy in threshold setting and difficulty in threshold adjustment in traditional industrial flow analysis detection methods.

[0049] 4. The present invention can timely detect abnormal attack behaviors in industrial traffic and take active defense, thereby improving the efficiency and accuracy of industrial network traffic anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 The present invention is a flowchart of a method for analyzing and detecting traffic anomalies based on an industrial control network in an embodiment of the present invention.

[0051] Figure 2 The present invention is a flowchart of periodically optimizing a network traffic behavior baseline model in a method for analyzing and detecting traffic anomalies based on an industrial control network in an embodiment of the present invention.

[0052] Figure 3 Schematic diagram of a system for analyzing and detecting traffic anomalies based on an industrial control network in an embodiment of the present invention.

[0053] Figure 4 Schematic diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0055] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] like Figure 1 As shown, this embodiment proposes a method for analyzing and detecting traffic anomalies based on industrial control networks. By collecting and analyzing the process business network traffic data of the industrial control system, preprocessing data, calculating and analyzing data, and persisting storage, a traffic behavior baseline model containing elements such as the IP, MAC, communication protocol, communication load, and communication relationship of both parties of the communication is automatically generated according to the process business communication situation. The model can also use the threshold sensitivity dynamic adjustment mechanism to learn and self-optimize from the continuously influx of new traffic data. As time goes by, the baseline model will become more intelligent and accurate, and can better adapt to the continuous evolution of network threats. According to the established traffic behavior baseline, real-time network traffic dynamic detection is carried out to timely discover the traffic anomalies of each device in the network and issue an alarm.

[0057] The method for analyzing and detecting traffic anomalies based on industrial control networks is specifically implemented as follows:

[0058] S100, network traffic collection: collects network traffic over a period of time through the switch mirror port;

[0059] S200, industrial network traffic analysis: deeply analyze the collected network traffic, filter out the traffic containing industrial protocols, and perform session association to generate formatted data with key information such as access source IP, destination IP, source MAC, destination MAC, destination port, application protocol, transmission protocol, traffic byte count, session duration, etc.

[0060] S300, data preprocessing: preprocess the formatted data generated by the analysis, remove duplicate or abnormal data by aggregation, filtering and other means, and generate metadata to be stored in the distributed database as basic data;

[0061] S400, baseline model construction: Based on the obvious periodicity of process business traffic, a network traffic behavior baseline model for specific process business communication links and industrial protocols is automatically established according to a preset period; and the network traffic behavior baseline model is automatically adjusted according to real-time traffic, and periodically updated and optimized.

[0062] First, a traffic baseline sampling period is set, and metadata within the sampling period is extracted from the distributed database. Using the aggregation algorithm, the network traffic metadata is grouped according to the three features of application protocol, source IP address, and destination IP address. Each group is a set of multiple metadata F = {f 1 , f 2… f n}, calculate different metadata f in the same group i The average traffic bytes per second Xi, Xi = Ki / Ti, Ki represents the traffic bytes of metadata, Ti represents the session duration of metadata, the traffic threshold of each packet = max(X1, X2…Xi), and the detection period of each packet = max(T1, T2…Ti). After analysis and calculation, each piece of data is concatenated with fields such as application protocol, source and destination address, and encrypted to generate a unique identification number ID, and the data set with the ID is persistently stored in a distributed database. The data structure of the network traffic behavior baseline model includes basic network information (source IP, destination IP, source MAC address, destination MAC address, application protocol, transmission protocol) and network traffic information (traffic threshold, average traffic bytes, detection period).

[0063] Then the network traffic behavior baseline model is periodically updated and optimized, such as Figure 2 As shown: initialize an empty set M and an average flow threshold sensitivity X. In this embodiment, the preset value of X is 10%, which depends on the flow changes caused by process business changes. Use the network flow behavior baseline model to analyze and detect real-time flow, and generate an alarm if the data flow is abnormal data. For data flows whose flow thresholds are within the flow threshold sensitivity X, add them to the set M. At the beginning of each preset cycle, the data in the set M is added to the network flow behavior baseline model for recalculation and analysis. If the network flow behavior baseline model already exists in the distributed database, it will be automatically updated based on the unique identification ID of the data. Repeat step S400, and use the flow threshold sensitivity dynamic adjustment mechanism to periodically update the network flow behavior baseline model, so as to achieve continuous dynamic optimization of the network flow behavior baseline model.

[0064] S500, real-time traffic access and detection: uses the network traffic behavior baseline model to perform anomaly analysis and detection on real-time traffic data.

[0065] S510, abnormal network communication behavior information detection: analyze and detect according to the source and destination IP, source and destination MAC, application protocol and corresponding port in the process business communication link.

[0066] a) Communication requests from unknown IP addresses indicate a risk of abnormal asset access.

[0067] b) When the destination IP is detected as a new IP address, it indicates that there is a risk of illegal external connection of assets.

[0068] c) By comparing the consistency of IP address and MAC address, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting.

[0069] d) Check the usage of different ports under the same protocol and the use of illegal ports to identify possible illegal business access risks.

[0070] S520, instantaneous time traffic detection: Sudden changes in network traffic rate are a significant indicator of network attacks. By calculating the average traffic bytes of real-time sessions and comparing them with the baseline model of network traffic behavior, abnormal behaviors of sudden changes in traffic rate in industrial control networks can be discovered.

[0071] S530, flow detection per unit time: detects malicious behaviors such as flow exceeding the threshold and long period of no messages. If multiple sessions fall in the same detection interval, the sessions are merged and the average flow byte count is calculated based on the merged session flow size and session duration. If the flow threshold of the network flow behavior baseline model is exceeded, it indicates that there is a flow anomaly. If there is no flow in the real-time session for multiple consecutive detection cycles, it indicates that there is malicious behavior such as long period of no messages.

[0072] S600, abnormal traffic alarm: When the real-time traffic data violates the network traffic behavior baseline model, the system automatically triggers the response alarm mechanism and generates alarm information.

[0073] Corresponding to the above method, such as Figure 3 As shown, this embodiment proposes a system for analyzing and detecting traffic anomalies based on an industrial control network, including:

[0074] The network traffic collection module is used to collect network traffic: it collects network traffic over a period of time through the switch mirror port.

[0075] The industrial network traffic analysis module is used to deeply analyze the collected network traffic, filter out the traffic containing industrial protocols, and perform session association to generate formatted data with key information such as access source IP, destination IP, source MAC, destination MAC, destination port, industrial control protocol, traffic byte count, session duration, etc.

[0076] The data preprocessing module is used to preprocess the formatted data generated by the analysis. It removes duplicate or abnormal data through aggregation, filtering, etc., and generates metadata to be stored in the distributed database as basic data;

[0077] The baseline model building module is used to automatically establish a network traffic behavior baseline model for specific process business communication links and industrial protocols according to a preset period based on the obvious periodicity of process business traffic; and automatically adjust according to real-time traffic, and periodically update and optimize the network traffic behavior baseline model;

[0078] The real-time traffic access and detection module is used to analyze and detect anomalies in real-time traffic data using the network traffic behavior baseline model; specifically, it includes:

[0079] Abnormal network communication behavior information detection is used to analyze and detect according to the source and destination IP, source and destination MAC, application protocol and corresponding port in the process business communication link; among which:

[0080] a) Communication requests from unknown IP addresses indicate the risk of abnormal asset access;

[0081] b) When the destination IP is detected as a new IP address, it indicates the risk of illegal external connection of assets;

[0082] c) By comparing the consistency of IP address and MAC address, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting;

[0083] d) Check the usage of different ports under the same protocol and the use of illegal ports to identify possible illegal business access risks.

[0084] The instantaneous time traffic detection module is used to detect abnormal behaviors of sudden changes in traffic rate in industrial control networks by calculating the average traffic bytes of real-time sessions and comparing them with the baseline model of network traffic behavior;

[0085] The unit time traffic detection module is used to detect malicious behaviors such as traffic exceeding the threshold and long periods of no packets. If multiple sessions fall into the same detection interval, the sessions are merged, and the average traffic bytes are calculated based on the merged session traffic size and session duration. If it exceeds the network traffic behavior baseline model traffic threshold, it indicates that there is traffic anomaly; if the real-time session has no traffic for multiple consecutive detection cycles, it indicates that there is malicious behavior such as long periods of no packets.

[0086] The abnormal traffic alarm module is used to automatically trigger the response alarm mechanism and generate alarm information when the real-time traffic data violates the baseline model of network traffic behavior.

[0087] The above describes a method and system for analyzing and detecting abnormal traffic based on an industrial control network provided by an embodiment of the present application. As a possible product form of the above system, Figure 4 As shown, an embodiment of the present application further provides an electronic device, including:

[0088] At least one processor; and a communication interface that is communicatively connected to the at least one processor; the at least one processor executes instructions stored in the memory, so that the electronic device executes the method steps executed by any device in the above method embodiments through the communication interface.

[0089] Optionally, the memory is located outside the electronic device.

[0090] Optionally, the electronic device includes the memory, the memory is connected to the at least one processor, and the memory stores instructions that can be executed by the at least one processor. Figure 4 The dashed lines indicate that the memory is optional for the electronic device.

[0091] The processor and the memory may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0092] The specific connection medium between the processor, memory and communication interface is not limited in the embodiments of the present application. Figure 4 The processor, memory and communication interface are connected by a bus. Figure 4 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 In the example, only one thick line is used to represent the bus, but it does not mean that there is only one bus or one type of bus. It should be understood that the processor mentioned in the embodiment of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory.

[0093] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0094] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DirectRambus RAM, DR RAM).

[0095] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0096] It should be noted that the memory described herein is intended to include, without being limited to, these and any other suitable types of memory.

[0097] As another possible product form, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps performed by any device in the above method example.

[0098] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0099] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0100] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0101] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0102] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for analyzing and detecting traffic anomalies based on an industrial control network, characterized in that: The steps include: S100, collects network traffic; S200, performing in-depth analysis and session association on the collected network traffic to generate formatted data; S300, preprocessing the formatted data generated by the analysis, removing duplicate or abnormal data through aggregation and filtering, and generating metadata to be stored in a distributed database as basic data; S400, based on the obvious periodicity of process business traffic, automatically establishes a network traffic behavior baseline model for specific process business communication links and industrial protocols according to a preset period; And automatically adjust according to real-time traffic, and periodically update and optimize the network traffic behavior baseline model; S500, uses a baseline model of network traffic behavior to perform anomaly analysis and detection on real-time traffic data; S600, when the real-time traffic data violates the network traffic behavior baseline model, the system automatically triggers a response alarm mechanism and generates an alarm message.

2. The method for analyzing and detecting traffic anomalies based on an industrial control network according to claim 1 is characterized in that: In step S200, through deep analysis, the traffic containing industrial protocols is screened out, and session association is performed to extract the access source IP, destination IP, source MAC, destination MAC, destination port, application protocol, transmission protocol, traffic byte count and session duration to generate formatted data.

3. The method for analyzing and detecting traffic anomalies based on an industrial control network according to claim 1 is characterized in that: In step S400, a network traffic behavior baseline model is established. Specifically, the traffic baseline sampling period is first set, and metadata within the sampling period is extracted from the distributed database. The network traffic metadata is aggregated and grouped according to the three features of application protocol, source IP address and destination IP address using an aggregation algorithm. Each group is a set of multiple metadata F = {f1, f 2… f n }, calculate different metadata f in the same group i The average traffic bytes per second Xi, Xi = Ki / Ti, Ki represents the traffic bytes of metadata, Ti represents the session duration of metadata, the traffic threshold of each group = max(X1, X2…Xi), and the detection period of each group = max(T1, T2…Ti); each piece of data after analysis and calculation is encrypted through the string concatenated by the application protocol and the source and destination addresses to generate a unique identification number ID, and the data set with the ID is persistently stored in the distributed database; The data structure of the network traffic behavior baseline model includes source IP address, destination IP address, source MAC address, destination MAC address, application protocol, transmission protocol, traffic threshold, average traffic byte count and detection period.

4. The method for analyzing and detecting traffic anomalies based on an industrial control network according to claim 1, characterized in that: In step S400, the network traffic behavior baseline model is periodically updated and optimized, specifically in the following manner: initialize an empty set M and an average traffic threshold sensitivity X; use the network traffic behavior baseline model to analyze and detect real-time traffic, and generate an alarm if the data flow is abnormal data; for data flows whose traffic thresholds are within the traffic threshold sensitivity X, add them to the set M; at the beginning of each preset cycle, add the data in the set M to the network traffic behavior baseline model for recalculation and analysis, and if the network traffic behavior baseline model already exists in the distributed database, it will be automatically updated based on the unique identification ID of the data, repeat step S400, and use the traffic threshold sensitivity dynamic adjustment mechanism to periodically update the network traffic behavior baseline model, thereby achieving continuous dynamic optimization of the network traffic behavior baseline model.

5. The method for analyzing and detecting traffic anomalies based on an industrial control network according to claim 1, characterized in that: In step S500, the use of the network traffic behavior baseline model to perform abnormal analysis and detection on real-time traffic data includes: S510, abnormal network communication behavior information detection: analyze and detect according to the source and destination IP, source and destination MAC, application protocol and corresponding port in the process business communication link; S520, instantaneous time traffic detection: by calculating the average traffic bytes of real-time sessions and comparing them with the network traffic behavior baseline model, abnormal behaviors of sudden changes in traffic rates in industrial control networks can be discovered; S530, flow detection per unit time: detect abnormal behavior of flow exceeding the threshold and long-term absence of messages. If multiple sessions fall in the same detection interval, the sessions are merged and the average flow byte count is calculated based on the merged session flow size and session duration. If it exceeds the flow threshold of the network flow behavior baseline model, it indicates that there is a flow anomaly. If there is no flow in the real-time session for multiple consecutive detection cycles, it indicates that there is malicious behavior of long-term absence of messages.

6. The method for analyzing and detecting abnormal flow based on industrial control network according to claim 5 is characterized in that: In step S510, the abnormal network communication behavior information detection includes: a) Communication requests from unknown IP addresses indicate the risk of abnormal asset access; b) When the destination IP is detected as a new IP address, it indicates the risk of illegal external connection of assets; c) By comparing the consistency of IP address and MAC address, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting; d) Check the usage of different ports under the same protocol and the use of illegal ports to identify possible illegal business access risks.

7. A system for analyzing and detecting traffic anomalies based on industrial control networks, characterized in that: include: Network traffic collection module, used to collect network traffic; Industrial network traffic analysis module, used to perform in-depth analysis and session association of collected network traffic to generate formatted data; The data preprocessing module is used to preprocess the formatted data generated by the analysis, remove duplicate or abnormal data through aggregation and filtering, and generate metadata to be stored in the distributed database as basic data; The baseline model building module is used to automatically establish a network traffic behavior baseline model for specific process business communication links and industrial protocols according to a preset period based on the obvious periodicity of process business traffic; And automatically adjust according to real-time traffic, and periodically update and optimize the network traffic behavior baseline model; Real-time traffic access and detection module, used to analyze and detect anomalies in real-time traffic data using the network traffic behavior baseline model; The abnormal traffic alarm module is used to automatically trigger the response alarm mechanism and generate alarm information when the real-time traffic data violates the baseline model of network traffic behavior.

8. The system for analyzing and detecting abnormal flow based on industrial control network according to claim 7, characterized in that: The real-time traffic access and detection module includes: Abnormal network communication behavior information detection module, used to analyze and detect according to the source and destination IP, source and destination MAC, application protocol and corresponding port in the process business communication link; The instantaneous time traffic detection module is used to detect abnormal behaviors of sudden changes in traffic rate in industrial control networks by calculating the average traffic bytes of real-time sessions and comparing them with the baseline model of network traffic behavior; The unit time traffic detection module is used to detect malicious behaviors such as traffic exceeding the threshold and no messages for a long time. If multiple sessions fall in the same detection interval, the sessions are merged and the average traffic bytes are calculated based on the merged session traffic size and session duration. If it exceeds the traffic threshold of the network traffic behavior baseline model, it indicates that there is traffic anomaly; if the real-time session has no traffic for multiple consecutive detection cycles, it indicates malicious behaviors such as no messages for a long time.

9. The system for analyzing and detecting abnormal flow based on industrial control network according to claim 8, characterized in that: In the abnormal network communication behavior information detection module: a) Communication requests from unknown IP addresses indicate the risk of abnormal asset access; b) When the destination IP is detected as a new IP address, it indicates the risk of illegal external connection of assets; c) By comparing the consistency of IP address and MAC address, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting; d) Check the usage of different ports under the same protocol and the use of illegal ports to identify possible illegal business access risks.

10. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method as described in any one of claims 1 to 6 by executing the instructions stored in the memory.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 6 is implemented.

Images