Method, system, device and medium for flow anomaly analysis and detection based on industrial control network

Abstract

The application provides a kind of method, system, equipment and medium based on the flow anomaly analysis and detection of industrial control network, the method is through to the process business network flow data of industrial control system is collected and analyzed, data preprocessing, data calculation and analysis, persistent storage etc. Operation, automatically generates network flow behavior baseline model according to process business communication situation, and can utilize flow threshold sensitivity dynamic adjustment mechanism, learn from new flow data and self-optimization, with the passage of time, network flow behavior baseline model will become more intelligent and accurate, can better adapt to the continuous evolution of network threat;Real-time network flow dynamic detection is carried out using network flow behavior baseline model, and the flow anomaly of each device in the network is discovered in time and an alarm is given, which solves the problem that the existing technology does not establish statistical analysis means for specific process business communication link and the threshold setting lacks precision and threshold adjustment is difficult.

Description

Technical Field

[0001] This invention relates to the field of industrial control network security technology, and more specifically, to a method, system, device, and medium for traffic anomaly analysis and detection based on industrial control networks. Background Technology

[0002] The Industrial Internet has injected new vitality into modern industry and improved production efficiency, but it has also brought more security threats. In recent years, numerous industrial control system (ICS) intrusion incidents have occurred both domestically and internationally, seriously affecting industrial production safety and making ICS security issues increasingly prominent. The increasing complexity and scale of industrial control network traffic has brought not only convenience and efficiency but also new challenges and risks, such as the spread of malware and denial-of-service attacks. The importance of anomaly detection in industrial control network traffic is becoming increasingly prominent in the field of cybersecurity, becoming a key link in maintaining network security and stability. Network traffic anomaly analysis and detection aims to identify and analyze abnormal behaviors in the network, which may indicate potential network attacks, security threats, or abnormal system activity. Through effective anomaly analysis and detection methods, these threats can be detected and responded to in a timely manner, reducing potential security risks and losses.

[0003] Traditional methods for analyzing and detecting traffic anomalies in industrial control networks mainly involve simple fixed threshold detection for process traffic, without establishing statistical analysis methods for specific process communication links. When traffic fluctuates, it is difficult to accurately determine the threshold range, and even if the threshold is determined, it is difficult to adjust the threshold when the traffic changes. Summary of the Invention

[0004] This invention aims to provide a method, system, device, and medium for traffic anomaly analysis and detection based on industrial control networks. This method can establish a traffic behavior baseline model for specific process business communication links and industrial protocols based on the address information, protocols, bandwidth, and other factors of the communicating parties in the network traffic. It also enables the automatic construction and updating of the traffic baseline model, solving the problems of existing process business traffic analysis and detection technologies that lack statistical analysis methods for specific process business communication links and suffer from inaccurate threshold settings and difficulties in threshold adjustment. Utilizing the network traffic behavior baseline model to perform anomaly analysis and detection on real-time traffic data can quickly detect traffic anomalies in each device within the industrial network.

[0005] This invention provides a method for traffic anomaly analysis and detection based on industrial control networks, comprising the following steps:

[0006] S100, collects network traffic;

[0007] S200 performs in-depth analysis and session association on the collected network traffic to generate formatted data;

[0008] S300 preprocesses the formatted data generated by parsing, removes duplicate or abnormal data through aggregation, filtering and other means, and generates metadata which is stored in a distributed database as basic data.

[0009] S400, based on the obvious periodicity of process business traffic, automatically establishes a network traffic behavior baseline model for specific process business communication links and industrial protocols according to a preset period, and automatically adjusts it according to real-time traffic, periodically updating and optimizing the network traffic behavior baseline model.

[0010] S500 uses a network traffic behavior baseline model to perform anomaly analysis and detection on real-time traffic data;

[0011] When real-time traffic data violates the network traffic behavior baseline model, the S600 system automatically triggers a response alarm mechanism and generates alarm information.

[0012] Furthermore, in step S200, through deep parsing, traffic containing industrial protocols is filtered out, and session association is performed to extract key network traffic information such as access source IP, destination IP, source MAC, destination MAC, destination port, application protocol, transport protocol, traffic byte count, and session duration, and generate formatted data.

[0013] Further, in step S400, a network traffic behavior baseline model is established. Specifically, the following steps are taken: First, a traffic baseline sampling period is set. Metadata within this sampling period is extracted from the distributed database. Then, using an aggregation algorithm, the network traffic metadata is aggregated and grouped according to three features: application protocol, source IP address, and destination IP address. Each group is a set of multiple metadata entries, F = {f1, f2, f3, f4, f5, f6, f7, f8, f9, f10, f11, f12, f13, f14, f15, f16, f17, f18, f19, f10 ... 2… f n}, calculate different metadata f within the same group i The average data traffic bytes per second (Xi) is calculated, where Xi = Ki / Ti, Ki represents the data traffic bytes, and Ti represents the session duration of the data. The traffic threshold for each packet is max(X1, X2…Xi), and the detection period for each packet is max(T1, T2…Ti). Each piece of data, after analysis and calculation, is concatenated into a string using fields such as application protocol and source / destination address. This string is then encrypted to generate a unique identifier (ID), and the dataset with this ID is persistently stored in a distributed database. The data structure of the network traffic behavior baseline model includes basic network information (source IP address, destination IP address, source MAC address, destination MAC address, application protocol, transport protocol) and network traffic information (traffic threshold, average data traffic bytes, detection period).

[0014] Further, in step S400, the periodic updating and optimization of the network traffic behavior baseline model is specifically implemented as follows: An empty set M and an average traffic threshold sensitivity X are initialized, with X having a preset value of 10%, depending on traffic changes caused by process and business variations. The network traffic behavior baseline model is used to analyze and detect real-time traffic; if the data stream is abnormal, an alarm is generated. Data streams whose traffic threshold is within the traffic threshold sensitivity X are added to set M. At the beginning of each preset period, the data in set M is added to the network traffic behavior baseline model for recalculation and analysis. If the distributed database already contains this network traffic behavior baseline model, it will be automatically updated based on the unique identifier ID of the data. Step S400 is repeated, and the network traffic behavior baseline model is periodically updated using the traffic threshold sensitivity dynamic adjustment mechanism, thereby achieving continuous dynamic optimization of the network traffic behavior baseline model.

[0015] Furthermore, in step S500, the anomaly analysis and detection of real-time traffic data using the network traffic behavior baseline model includes:

[0016] S510, Abnormal Network Communication Behavior Information Detection: Analyze and detect based on the source and destination IPs, source and destination MACs, application protocols, and corresponding ports in the process business communication links;

[0017] S520, Instantaneous Traffic Detection: By calculating the average number of bytes of traffic in a real-time session and comparing it with a baseline model of network traffic behavior, abnormal behavior such as sudden changes in traffic rate can be detected in industrial control networks.

[0018] S530, Unit Time Traffic Detection: Detects traffic exceeding thresholds and malicious behavior with prolonged periods without packets. If multiple sessions fall within the same detection interval, the sessions are merged. The average number of bytes of traffic is calculated based on the merged session traffic size and session duration. If the average number of bytes exceeds the traffic threshold of the network traffic behavior baseline model, it indicates an abnormal traffic situation. If a real-time session has no traffic for multiple consecutive detection cycles, it indicates malicious behavior with prolonged periods without packets.

[0019] Further, in step S510, the abnormal network communication behavior information detection includes:

[0020] a) Communication requests from unknown IP addresses indicate a risk of abnormal asset access;

[0021] b) When a new IP address is detected as the destination IP, it indicates a risk of unauthorized external asset connections;

[0022] c) By comparing the consistency of IP addresses and MAC addresses, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting.

[0023] d) Inspect the usage of different ports under the same protocol and the use of unauthorized ports to identify potential risks of unauthorized business access.

[0024] This invention also provides a system for traffic anomaly analysis and detection based on industrial control networks, comprising:

[0025] Network traffic acquisition module, used to collect network traffic;

[0026] Network traffic acquisition module, used to collect network traffic;

[0027] The industrial network traffic parsing module is used to perform deep analysis and session association on the collected network traffic and generate formatted data.

[0028] The data preprocessing module is used to preprocess the formatted data generated by parsing, remove duplicate or abnormal data through aggregation and filtering, and generate metadata stored in a distributed database as basic data.

[0029] The baseline model building module is used to automatically establish a network traffic behavior baseline model for specific process business communication links and industrial protocols based on the obvious periodicity of process business traffic and according to a preset period; and to automatically adjust and periodically update and optimize the network traffic behavior baseline model according to real-time traffic.

[0030] The real-time traffic access and detection module is used to perform anomaly analysis and detection on real-time traffic data using a network traffic behavior baseline model.

[0031] The abnormal traffic alarm module is used to automatically trigger the response alarm mechanism and generate alarm information when real-time traffic data violates the network traffic behavior baseline model.

[0032] Furthermore, the real-time traffic access and detection module includes:

[0033] The abnormal network communication behavior information detection module is used to analyze and detect the source and destination IPs, source and destination MACs, application protocols and corresponding ports in the process business communication links.

[0034] The instantaneous traffic detection module is used to detect abnormal behavior such as sudden changes in traffic rate in industrial control networks by comparing the average number of bytes of traffic in a real-time session with the network traffic behavior baseline model.

[0035] The unit time traffic detection module is used to detect traffic exceeding the threshold and malicious behavior such as no packets for a long time. If multiple sessions fall within the same detection range, the sessions are merged. The average number of bytes of traffic is calculated based on the traffic size and session duration of the merged sessions. If it exceeds the traffic threshold of the network traffic behavior baseline model, it indicates that there is traffic anomaly. If there is no traffic for several consecutive detection cycles of a real-time session, it indicates that there is malicious behavior such as no packets for a long time.

[0036] Furthermore, in the abnormal network communication behavior information detection module:

[0037] a) Communication requests from unknown IP addresses indicate a risk of abnormal asset access;

[0038] b) When a new IP address is detected as the destination IP, it indicates a risk of unauthorized external asset connections;

[0039] c) By comparing the consistency of IP addresses and MAC addresses, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting.

[0040] d) Inspect the usage of different ports under the same protocol and the use of unauthorized ports to identify potential risks of unauthorized business access.

[0041] The present invention also provides an electronic device, comprising:

[0042] At least one processor; and a memory communicatively connected to said at least one processor;

[0043] The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the instructions stored in the memory to perform the above-described method.

[0044] The present invention also provides a computer-readable storage medium for storing instructions that, when executed, cause the above-described method to be implemented.

[0045] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0046] 1. This invention establishes a network traffic behavior baseline model for specific process business communication links and industrial protocols, which can more effectively identify communication paths and traffic sources, and promptly detect abnormal situations of each device in the industrial control network.

[0047] 2. This invention can automatically establish an industrial network traffic behavior baseline model and automatically realize the continuous iterative update of the network traffic behavior baseline model.

[0048] 3. This invention avoids the problems of inaccurate threshold setting and difficulty in threshold adjustment in traditional industrial flow analysis and detection methods.

[0049] 4. This invention can promptly detect abnormal attack behaviors in industrial traffic and proactively defend against them, thus improving the efficiency and accuracy of abnormal detection of industrial network traffic. Attached Figure Description

[0050] Figure 1 This is a flowchart of a method for traffic anomaly analysis and detection based on an industrial control network in an embodiment of the present invention.

[0051] Figure 2 This is a flowchart of the periodic optimization of the network traffic behavior baseline model in the method for traffic anomaly analysis and detection based on industrial control networks in this embodiment of the invention.

[0052] Figure 3 This is a schematic diagram of a system for traffic anomaly analysis and detection based on an industrial control network, as described in an embodiment of the present invention.

[0053] Figure 4 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0055] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0056] like Figure 1As shown, this embodiment proposes a method for traffic anomaly analysis and detection based on industrial control networks. Through operations such as data collection and parsing, data preprocessing, data calculation and analysis, and persistent storage of process business network traffic data from the industrial control system, a traffic behavior baseline model is automatically generated based on the process business communication situation. This model includes elements such as the IP addresses and MAC addresses of the communicating parties, communication protocols, communication loads, and communication relationships. Furthermore, it can utilize a threshold sensitivity dynamic adjustment mechanism to learn and self-optimize from the continuous influx of new traffic data. Over time, the baseline model becomes more intelligent and accurate, better adapting to the evolving network threats. Based on the established traffic behavior baseline, real-time dynamic network traffic detection is performed to promptly identify traffic anomalies in each device on the network and issue alarms.

[0057] The method for analyzing and detecting traffic anomalies based on industrial control networks is implemented as follows:

[0058] S100, Network Traffic Acquisition: Collects network traffic over a period of time through the switch's mirror port;

[0059] S200, Industrial Network Traffic Analysis: Performs in-depth analysis on the collected network traffic, filters out traffic containing industrial protocols, associates sessions, and generates formatted data with key information such as source IP, destination IP, source MAC, destination MAC, destination port, application protocol, transport protocol, number of bytes, and session duration.

[0060] S300, Data Preprocessing: Preprocesses the formatted data generated by parsing, removes duplicate or abnormal data through aggregation, filtering and other means, and generates metadata which is stored in a distributed database as basic data;

[0061] S400, Baseline Model Construction: Based on the obvious periodicity of process business traffic, a network traffic behavior baseline model for specific process business communication links and industrial protocols is automatically established according to a preset period; and the network traffic behavior baseline model is automatically adjusted and periodically updated and optimized according to real-time traffic.

[0062] First, a baseline sampling period for traffic is set. Metadata within this sampling period is extracted from a distributed database. Then, using an aggregation algorithm, the network traffic metadata is grouped according to three characteristics: application protocol, source IP address, and destination IP address. Each group is a set of multiple metadata items F = {f1, f2, f3, f4, f5, f6, f7, f8, f9, f10, f11, f12, f13, f14, f15, f16, f17, f18, f19, f10 ... 2… f n}, calculate different metadata f within the same group iThe average data traffic bytes per second (Xi) is calculated, where Xi = Ki / Ti, Ki represents the data traffic bytes, and Ti represents the session duration of the data. The traffic threshold for each packet is max(X1, X2…Xi), and the detection period for each packet is max(T1, T2…Ti). Each piece of data, after analysis and calculation, is concatenated into a string using fields such as application protocol and source / destination address. This string is then encrypted to generate a unique identifier (ID), and the dataset with this ID is persistently stored in a distributed database. The data structure of the network traffic behavior baseline model includes basic network information (source IP, destination IP, source MAC address, destination MAC address, application protocol, transport protocol) and network traffic information (traffic threshold, average data traffic bytes, detection period).

[0063] Then, the network traffic behavior baseline model is periodically updated and optimized, such as... Figure 2 As shown: Initialize an empty set M and an average traffic threshold sensitivity X. In this embodiment, the preset value of X is 10%, depending on the traffic changes caused by changes in process operations. Analyze and detect real-time traffic using a network traffic behavior baseline model. If the data stream is abnormal, an alarm is generated. For data streams whose traffic threshold is within the traffic threshold sensitivity X, add them to set M. At the beginning of each preset period, add the data in set M to the network traffic behavior baseline model for recalculation and analysis. If the network traffic behavior baseline model already exists in the distributed database, it will be automatically updated based on the unique identifier ID of the data. Repeat step S400, using a dynamic adjustment mechanism for the traffic threshold sensitivity to periodically update the network traffic behavior baseline model, thereby achieving continuous dynamic optimization of the network traffic behavior baseline model.

[0064] S500, Real-time Traffic Access and Detection: Utilizes a network traffic behavior baseline model to perform anomaly analysis and detection on real-time traffic data.

[0065] S510, Abnormal Network Communication Behavior Detection: Analyze and detect based on the source and destination IPs, source and destination MACs, application protocols, and corresponding ports in the process business communication link.

[0066] a) Communication requests from unknown IP addresses indicate a risk of abnormal asset access.

[0067] b) When a new IP address is detected as the destination IP, it indicates a risk of unauthorized external connections to assets.

[0068] c) By comparing the consistency of IP addresses and MAC addresses, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting.

[0069] d) Inspect the usage of different ports under the same protocol and the use of unauthorized ports to identify potential risks of unauthorized business access.

[0070] S520, Instantaneous Traffic Detection: Sudden changes in network traffic rate are a significant indicator of network attacks. By calculating the average number of bytes of traffic in a real-time session and comparing it with a baseline model of network traffic behavior, abnormal behavior such as sudden changes in traffic rate can be detected in industrial control networks.

[0071] S530, Unit Time Traffic Detection: Detects traffic exceeding thresholds and malicious behavior with prolonged periods without packets. If multiple sessions fall within the same detection interval, the sessions are merged. The average number of bytes of traffic is calculated based on the merged session traffic size and session duration. If the average number of bytes exceeds the traffic threshold of the network traffic behavior baseline model, it indicates an abnormal traffic situation. If a real-time session has no traffic for multiple consecutive detection cycles, it indicates malicious behavior with prolonged periods without packets.

[0072] S600 Abnormal Traffic Alarm: When real-time traffic data violates the network traffic behavior baseline model, the system automatically triggers the response alarm mechanism and generates alarm information.

[0073] Corresponding to the above methods, such as Figure 3 As shown, this embodiment proposes a system for traffic anomaly analysis and detection based on industrial control networks, including:

[0074] The network traffic acquisition module is used to collect network traffic: it collects network traffic over a period of time through the switch's mirror port.

[0075] The industrial network traffic parsing module is used to perform deep analysis on the collected network traffic, filter out traffic containing industrial protocols, associate sessions, and generate formatted data with key information such as source IP, destination IP, source MAC, destination MAC, destination port, industrial control protocol, number of traffic bytes, and session duration.

[0076] The data preprocessing module is used to preprocess the formatted data generated by parsing. It removes duplicate or abnormal data through aggregation and filtering, and generates metadata which is stored in a distributed database as the base data.

[0077] The baseline model building module is used to automatically establish a network traffic behavior baseline model for specific process business communication links and industrial protocols based on the obvious periodicity of process business traffic and according to a preset period; and to automatically adjust and periodically update and optimize the network traffic behavior baseline model according to real-time traffic.

[0078] The real-time traffic access and detection module is used to perform anomaly analysis and detection on real-time traffic data using a network traffic behavior baseline model; specifically, it includes:

[0079] Abnormal network communication behavior detection is used to analyze and detect abnormal network communication behavior based on the source and destination IP addresses, source and destination MAC addresses, application protocols, and corresponding ports in the process business communication links; among which:

[0080] a) Communication requests from unknown IP addresses indicate a risk of abnormal asset access;

[0081] b) When a new IP address is detected as the destination IP, it indicates a risk of unauthorized external asset connections;

[0082] c) By comparing the consistency of IP addresses and MAC addresses, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting.

[0083] d) Inspect the usage of different ports under the same protocol and the use of unauthorized ports to identify potential risks of unauthorized business access.

[0084] The instantaneous traffic detection module is used to detect abnormal behavior such as sudden changes in traffic rate in industrial control networks by comparing the average number of bytes of traffic in a real-time session with the network traffic behavior baseline model.

[0085] The unit-time traffic detection module is used to detect traffic exceeding thresholds and malicious behavior such as prolonged periods without packets. If multiple sessions fall within the same detection interval, the sessions are merged. The average number of bytes of traffic is calculated based on the traffic size and session duration of the merged sessions. If the average number of bytes exceeds the traffic threshold of the network traffic behavior baseline model, it indicates an abnormal traffic situation. If a real-time session has no traffic for several consecutive detection periods, it indicates malicious behavior such as prolonged periods without packets.

[0086] The abnormal traffic alarm module is used to automatically trigger the response alarm mechanism and generate alarm information when real-time traffic data violates the network traffic behavior baseline model.

[0087] The above describes a method and system for traffic anomaly analysis and detection based on an industrial control network, as provided in the embodiments of this application. As one possible product form of the above system, such as... Figure 4 As shown in the embodiments of this application, an electronic device is also provided, including:

[0088] At least one processor; and a communication interface communicatively connected to the at least one processor; the at least one processor causes the electronic device to perform the method steps performed by any device in the above method embodiments via the communication interface by executing instructions stored in the memory.

[0089] Optionally, the memory is located outside the electronic device.

[0090] Optionally, the electronic device includes the memory, which is connected to the at least one processor, and stores instructions executable by the at least one processor. (Appendix) Figure 4 Dashed lines indicate that memory is optional for electronic devices.

[0091] The processor and the memory can be coupled through an interface circuit or integrated together; no restriction is imposed here.

[0092] This application embodiment does not limit the specific connection medium between the processor, memory, and communication interface described above. This application embodiment... Figure 4 The processor, memory, and communication interface are connected via a bus, and the bus is in... Figure 4 The connections between other components are shown in bold and are for illustrative purposes only, not as limiting information. The bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 4 The text uses only a single thick line to represent a bus, but this does not imply that there is only one bus or one type of bus. It should be understood that the processor mentioned in the embodiments of this application can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor, implemented by reading software code stored in memory.

[0093] For example, the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0094] It should be understood that the memory mentioned in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate Synchronous DRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct RAM (DR RAM).

[0095] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) can be integrated into the processor.

[0096] It should be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

[0097] As another possible product form, this application embodiment also provides a computer-readable storage medium for storing instructions that, when executed, cause a computer to perform the method steps performed by any of the devices in the above method examples.

[0098] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0099] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0100] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0101] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0102] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for traffic anomaly analysis and detection based on industrial control networks, characterized in that, Includes the following steps: S100, collects network traffic; S200 performs in-depth analysis and session association on the collected network traffic to generate formatted data; S300 preprocesses the formatted data generated by parsing, removes duplicate or abnormal data through aggregation and filtering, and generates metadata which is stored in a distributed database as the basic data. S400, based on the obvious periodicity of process business traffic, automatically establishes a baseline model of network traffic behavior for specific process business communication links and industrial protocols according to a preset period. The network traffic behavior baseline model is automatically adjusted and periodically updated and optimized based on real-time traffic. S500 uses a network traffic behavior baseline model to perform anomaly analysis and detection on real-time traffic data; S600: When real-time traffic data violates the network traffic behavior baseline model, the system automatically triggers a response alarm mechanism and generates alarm information. In step S400, a network traffic behavior baseline model is established. Specifically, the following steps are taken: First, a traffic baseline sampling period is set. Metadata within this sampling period is extracted from a distributed database. Then, using an aggregation algorithm, the network traffic metadata is aggregated and grouped according to three features: application protocol, source IP address, and destination IP address. Each group is a set of multiple metadata entries, F = {f1, f2, f3, f4, f5, f6, f7, f8, f9, f10, f11, f12, f13, f14, f15, f16, f17, f18, f19, f10 ... 2… f n }, calculate different metadata f within the same group i The average number of bytes per second traffic Xi, where Xi = Ki / Ti, Ki represents the number of bytes of metadata traffic, and Ti represents the session duration of metadata. The traffic threshold for each group is max(X1,X2…Xi), and the detection period for each group is max(T1,T2…Ti). After analysis and calculation, each piece of data is encrypted using a string concatenated with the application protocol and source and destination addresses to generate a unique identification number ID. The dataset with this ID is then persistently stored in a distributed database. The data structure of the network traffic behavior baseline model includes source IP address, destination IP address, source MAC address, destination MAC address, application protocol, transport protocol, traffic threshold, average traffic bytes, and detection period; In step S400, the periodic updating and optimization of the network traffic behavior baseline model is specifically carried out as follows: an empty set M and an average traffic threshold sensitivity X are initialized; the network traffic behavior baseline model is used to analyze and detect real-time traffic, and an alarm is generated if the data stream is abnormal; for data streams whose traffic threshold is within the traffic threshold sensitivity X, they are added to set M; at the beginning of each preset period, the data in set M is added to the network traffic behavior baseline model for recalculation and analysis. If the network traffic behavior baseline model already exists in the distributed database, it will be automatically updated based on the unique identifier ID of the data. Step S400 is repeated, and the network traffic behavior baseline model is periodically updated using the traffic threshold sensitivity dynamic adjustment mechanism, thereby achieving continuous dynamic optimization of the network traffic behavior baseline model.

2. The method for traffic anomaly analysis and detection based on industrial control networks according to claim 1, characterized in that, In step S200, through deep parsing, traffic containing industrial protocols is filtered out, and session association is performed to extract the access source IP, destination IP, source MAC, destination MAC, destination port, application protocol, transport protocol, traffic byte count, and session duration, generating formatted data.

3. The method for traffic anomaly analysis and detection based on industrial control networks according to claim 1, characterized in that, In step S500, the anomaly analysis and detection of real-time traffic data using the network traffic behavior baseline model includes: S510, Abnormal Network Communication Behavior Information Detection: Analyze and detect based on the source and destination IPs, source and destination MACs, application protocols, and corresponding ports in the process business communication links; S520, Instantaneous Traffic Detection: By calculating the average number of bytes of traffic in a real-time session and comparing it with the network traffic behavior baseline model, abnormal behavior such as sudden changes in traffic rate can be detected in industrial control networks. S530, Unit Time Traffic Detection: Detects abnormal behavior such as traffic exceeding the threshold and no packets for a long time. If multiple sessions fall within the same detection range, the sessions are merged. The average number of bytes of traffic is calculated based on the traffic size and session duration of the merged session. If it exceeds the traffic threshold of the network traffic behavior baseline model, it indicates that there is abnormal traffic. If there is no traffic for several consecutive detection cycles of a real-time session, it indicates that there is malicious behavior of no packets for a long time.

4. The method for traffic anomaly analysis and detection based on industrial control networks according to claim 3, characterized in that, In step S510, the abnormal network communication behavior information detection includes: a) Communication requests from unknown IP addresses indicate a risk of abnormal asset access; b) When a new IP address is detected as the destination IP, it indicates a risk of unauthorized external asset connections; c) By comparing the consistency of IP addresses and MAC addresses, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting. d) Check the usage of different ports under the same protocol and the use of illegal ports to identify potential risks of unauthorized business access.

5. A system for traffic anomaly analysis and detection based on an industrial control network, used to perform the method as described in any one of claims 1-4, characterized in that, include: Network traffic acquisition module, used to collect network traffic; The industrial network traffic parsing module is used to perform deep analysis and session association on the collected network traffic and generate formatted data. The data preprocessing module is used to preprocess the formatted data generated by parsing, remove duplicate or abnormal data through aggregation and filtering, and generate metadata stored in a distributed database as basic data. The baseline model building module is used to automatically build a baseline model of network traffic behavior for specific process business communication links and industrial protocols based on the obvious periodicity of process business traffic and according to a preset period. The network traffic behavior baseline model is automatically adjusted and periodically updated and optimized based on real-time traffic. The real-time traffic access and detection module is used to perform anomaly analysis and detection on real-time traffic data using a network traffic behavior baseline model. The abnormal traffic alarm module is used to automatically trigger the response alarm mechanism and generate alarm information when real-time traffic data violates the network traffic behavior baseline model.

6. The system for traffic anomaly analysis and detection based on industrial control networks according to claim 5, characterized in that, The real-time traffic access and detection module includes: The abnormal network communication behavior information detection module is used to analyze and detect the source and destination IPs, source and destination MACs, application protocols and corresponding ports in the process business communication links. The instantaneous traffic detection module is used to detect abnormal behavior such as sudden changes in traffic rate in industrial control networks by comparing the average number of bytes of traffic in a real-time session with the network traffic behavior baseline model. The unit time traffic detection module is used to detect traffic exceeding the threshold and malicious behavior such as no packets for a long time. If multiple sessions fall within the same detection range, the sessions are merged. The average number of bytes of traffic is calculated based on the traffic size and session duration of the merged sessions. If it exceeds the traffic threshold of the network traffic behavior baseline model, it indicates that there is traffic anomaly. If there is no traffic for several consecutive detection cycles of a real-time session, it indicates that there is malicious behavior such as no packets for a long time.

7. The system for traffic anomaly analysis and detection based on industrial control networks according to claim 6, characterized in that, In the abnormal network communication behavior information detection module: a) Communication requests from unknown IP addresses indicate a risk of abnormal asset access; b) When a new IP address is detected as the destination IP, it indicates a risk of unauthorized external asset connections; c) By comparing the consistency of IP addresses and MAC addresses, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting. d) Check the usage of different ports under the same protocol and the use of illegal ports to identify potential risks of unauthorized business access.

8. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method as described in any one of claims 1-4.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed, implement the method as described in any one of claims 1-4.

Images