Processing method and device for EtherCAT protocol message, storage medium and program product

Abstract

The embodiment of the invention provides a processing method and device for an EtherCAT protocol message, a storage medium and a program product. The method comprises the following steps: receiving an EtherCAT protocol message to be detected; determining an anomaly detection score of the EtherCAT protocol message according to a message detection model, wherein the message detection model is used for detecting whether the EtherCAT protocol message is abnormal or not; when the anomaly detection score is smaller than or equal to a preset threshold value, key data in the EtherCAT protocol message is extracted; according to the slave station address, the command type and the data field value, judging whether an allowable transmission condition of the EtherCAT protocol message is met or not; according to the EtherCAT protocol message detection method and the EtherCAT protocol message detection device, transmission of the EtherCAT protocol message is blocked when the transmission permission condition is not met, the EtherCAT protocol message detection method and the EtherCAT protocol message detection device can adapt to continuously changing network environments and new attack means, the EtherCAT protocol message detection accuracy is improved, and the false alarm rate and the missing report rate of the EtherCAT protocol message are reduced.

Description

Technical Field

[0001] The present application relates to the technical field of message detection, and in particular to a method, a processing device, a storage medium and a computer program product for processing EtherCAT protocol messages. Background Art

[0002] EtherCAT (Ethernet for Control Automation Technology), as a high-performance industrial Ethernet protocol, is widely used in various industrial automation systems due to its excellent real-time performance, synchronization and flexibility.

[0003] In the prior art, when detecting industrial Internet protocols, it relies on predefined load fingerprint features. However, these features are static and can effectively identify EtherCAT traffic under normal circumstances. However, attackers will modify these features to evade detection. For example, by injecting forged data into Ethernet frames or modifying the order of sub-messages, attackers can interfere with the detection mechanism based on these features. This method is highly dependent on load fingerprint features and is susceptible to mutation and evasion strategies. Moreover, relying solely on fixed load features may lead to false positives and false negatives. For example, some legitimate but uncommon EtherCAT traffic may be misjudged as abnormal traffic because it does not meet the predefined features.

[0004] Therefore, the detection of EtherCAT protocol messages in the prior art is difficult to adapt to the ever-changing network environment and new attack methods. Simply relying on fixed load characteristics leads to inaccurate detection of EtherCAT protocol messages, which increases the false alarm rate and missed alarm rate of EtherCAT protocol messages. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a method, a processing device, a storage medium and a computer program product for processing EtherCAT protocol messages, so as to solve the problem of high false alarm rate and missed alarm rate of EtherCAT protocol messages in the prior art.

[0006] In order to achieve the above-mentioned object, the first aspect of the present application provides a method for processing EtherCAT protocol messages, comprising:

[0007] Receive the EtherCAT protocol message to be detected;

[0008] Determine an abnormality detection score of the EtherCAT protocol message according to the message detection model, where the message detection model is used to detect whether the EtherCAT protocol message is abnormal;

[0009] When the anomaly detection score is less than or equal to the preset threshold, extract key data in the EtherCAT protocol message, including the slave address, the command type and the data field value of the sub-message;

[0010] Determine whether the transmission conditions of the EtherCAT protocol message are met according to the slave address, command type and data field value;

[0011] If the transmission conditions are not met, the transmission of EtherCAT protocol messages is blocked.

[0012] In an embodiment of the present application, if any one of the following conditions is met, it is determined that the condition for allowing transmission is not met: the slave address is not a preset slave address; the command type is not a preset sub-command type; the data field value is not a preset data field value.

[0013] In an embodiment of the present application, determining an anomaly detection score of an EtherCAT protocol message according to a message detection model includes: parsing and extracting key features of the EtherCAT protocol message; normalizing the key features; and inputting the normalized key features into the message detection model in a preset order to obtain an anomaly detection score of the EtherCAT protocol message.

[0014] In an embodiment of the present application, the processing method further includes: after determining the anomaly detection score of the EtherCAT protocol message, updating the message detection model according to the EtherCAT protocol message and the anomaly detection score of the EtherCAT protocol message.

[0015] In an embodiment of the present application, a message detection model is constructed by the following steps: obtaining multiple historical EtherCAT protocol messages; parsing and extracting the historical key features of each historical EtherCAT protocol message; normalizing the historical key features of each historical EtherCAT protocol message; constructing a training set, the training set includes the normalized historical key features corresponding to each historical EtherCAT protocol message, and the normalized historical key features of each historical EtherCAT protocol message are arranged in a preset order; the training set is input into a preset convolutional neural network model so that the preset convolutional neural network model outputs the anomaly detection score of each historical EtherCAT protocol message; when the convolutional neural network model meets the preset training completion conditions, it is determined that the convolutional neural network model training is completed to obtain a message detection model. In an embodiment of the present application, the processing method also includes: when the anomaly detection score is greater than a preset threshold, the EtherCAT protocol message is determined to be abnormal, and the transmission of the EtherCAT protocol message is blocked.

[0016] In an embodiment of the present application, the processing method further includes: when the EtherCAT protocol message is abnormal or does not meet the transmission permission conditions, recording the data field value and abnormality detection score of the sub-message in the EtherCAT protocol message.

[0017] A second aspect of the present application provides a device for processing EtherCAT protocol messages, comprising:

[0018] a memory configured to store instructions;

[0019] The processor is configured to call instructions from the memory and implement the above-mentioned processing method for EtherCAT protocol messages when executing the instructions.

[0020] A third aspect of the present application provides a machine-readable storage medium having instructions stored thereon, which, when executed by a processor, configure the processor to execute the above-mentioned method for processing EtherCAT protocol messages.

[0021] A fourth aspect of the present application provides a computer program product, including a computer program, which implements the above-mentioned method for processing EtherCAT protocol messages when executed by a processor.

[0022] Through the above technical scheme, an EtherCAT protocol message to be detected is received; an anomaly detection score of the EtherCAT protocol message is determined according to a message detection model, and the message detection model is used to detect whether the EtherCAT protocol message is abnormal; when the anomaly detection score is less than or equal to a preset threshold, key data in the EtherCAT protocol message is extracted, and the key data includes a slave address, a command type of a sub-message, and a data field value; whether the transmission permission conditions of the EtherCAT protocol message are met according to the slave address, the command type, and the data field value; when the transmission permission conditions are not met, the transmission of the EtherCAT protocol message is blocked, which can adapt to the ever-changing network environment and new attack methods, improve the accuracy of EtherCAT protocol message detection, and reduce the false alarm rate and missed alarm rate of the EtherCAT protocol message.

[0023] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0025] Figure 1A schematic diagram of a process for processing an EtherCAT protocol message according to an embodiment of the present application is shown;

[0026] Figure 2 A schematic diagram of a process for processing EtherCAT protocol messages according to another embodiment of the present application is shown;

[0027] Figure 3 The internal structure diagram of a computer device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0029] It should be noted that if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0030] Figure 1 The flowchart of the method for processing EtherCAT protocol messages according to the embodiment of the present application is schematically shown. Figure 1 As shown, in one embodiment of the present application, a method for processing EtherCAT protocol messages is provided, comprising the following steps:

[0031] Step 101: Receive an EtherCAT protocol message to be detected.

[0032] Step 102: determining an abnormality detection score of the EtherCAT protocol message according to the message detection model, where the message detection model is used to detect whether the EtherCAT protocol message is abnormal.

[0033] The EtherCAT protocol is a high-performance real-time Ethernet communication protocol. In the factory network, each device can continuously send data to the main control system in the form of EtherCAT protocol messages. After receiving the EtherCAT protocol message to be detected, the anomaly detection score of the EtherCAT protocol message can be determined according to the message detection model. Among them, the message detection model is used to detect whether the EtherCAT protocol message is abnormal. The message detection model can be trained based on a convolutional neural network, such as a CNN model.

[0034] In an embodiment of the present application, a message detection model is constructed by the following steps: obtaining multiple historical EtherCAT protocol messages; parsing and extracting historical key features of each historical EtherCAT protocol message; normalizing the historical key features of each historical EtherCAT protocol message; constructing a training set, the training set includes the normalized historical key features corresponding to each historical EtherCAT protocol message, and the normalized historical key features of each historical EtherCAT protocol message are arranged in a preset order; inputting the training set into a preset convolutional neural network model so that the preset convolutional neural network model outputs an anomaly detection score for each historical EtherCAT protocol message; when the convolutional neural network model meets the preset training completion conditions, determining that the convolutional neural network model training is completed, and obtaining a message detection model.

[0035] When constructing a message detection model, multiple historical EtherCAT protocol messages may be obtained. The historical EtherCAT protocol messages may include EtherCAT protocol messages obtained before receiving the EtherCAT protocol message to be detected, and legal but uncommon EtherCAT protocol messages received previously. The historical key features of each historical EtherCAT protocol message may be parsed and extracted, and the historical key features of each historical EtherCAT protocol message may be normalized.

[0036] After normalizing the historical key features, a message data set can be constructed based on all historical EtherCAT protocol messages, and the message data set can be divided into a training set, a validation set, and a test set according to a preset ratio. The preset ratio of the training set, the validation set, and the test set can be set to 8:1:1 to ensure that the preset convolutional neural network has enough training data. The validation set and the test set can be used to evaluate the performance of the model.

[0037] The training set includes normalized historical key features corresponding to each historical EtherCAT protocol message. In order to prevent attackers from modifying the order of sub-messages, the normalized historical key features of each historical EtherCAT protocol message are arranged in a preset order. The preset order can be set to the order of message fields in the historical EtherCAT protocol message, such as header command type, sub-command type, slave address, data field length, and data field value.

[0038] After constructing the training set, the training set can be input into a preset convolutional neural network model so that the preset convolutional neural network model outputs the anomaly detection score of each historical EtherCAT protocol message. Among them, the preset convolutional neural network is, for example, a CNN model. The preset convolutional neural network uses a one-dimensional convolution kernel to process serialized message data, and sets an appropriate stride and padding method. The activation function of the preset convolutional neural network model can use Sigmoid or ReLU to provide nonlinear modeling capabilities. The pooling layer of the preset convolutional neural network model can use global pooling to simplify feature dimensions and reduce parameters, thereby reducing the complexity of the model. The preset convolutional neural network model integrates the features processed by the convolution layer through a fully connected layer, thereby outputting the anomaly detection score of each historical EtherCAT protocol message.

[0039] When the convolutional neural network model meets the preset training completion conditions, it can be determined that the convolutional neural network model training is completed and a message detection model is obtained. The preset training completion conditions may include that the number of training iterations reaches a preset number, and / or the prediction accuracy reaches a preset accuracy, and / or the prediction error is less than a preset threshold, etc.

[0040] In an embodiment of the present application, determining an anomaly detection score of an EtherCAT protocol message according to a message detection model includes: parsing and extracting key features of the EtherCAT protocol message; normalizing the key features; and inputting the normalized key features into the message detection model in a preset order to obtain an anomaly detection score of the EtherCAT protocol message.

[0041] The processor can parse and extract key features of the EtherCAT protocol message. The key features may include Ethernet frame type, header command type in the EtherCAT header, sub-command type in the sub-message header, slave address and data field length, and data field value of the sub-message. The command type of the sub-message header is determined by decoding the data area of ​​the EtherCAT protocol message and based on a preset offset.

[0042] Specifically, the Ethernet frame header of the EtherCAT protocol message can be parsed and extracted, and the Ethernet frame header of the EtherCAT protocol message includes the source mac address, the destination mac address and the Ethernet frame type. The data area of ​​the EtherCAT protocol message can be parsed and extracted, and the data area includes the EtherCAT header, the sub-message header, the data part of the sub-message and the work counter WKC. The EtherCAT data length, reserved bit and header command type in the EtherCAT header can be extracted, the sub-command type, the slave address and the data field length in the sub-message header can be extracted, and the data field value of the sub-message can be extracted. Among them, if the header type is "1", it means the communication of the slave station.

[0043] The processor can normalize the key features to ensure that the data ranges of different key features are consistent. The processor can input the normalized key features into the message detection model in a preset order to obtain the anomaly detection score of the EtherCAT protocol message. Among them, the preset order can be set according to the actual situation. For example, in order to prevent attackers from modifying the order of sub-messages, the preset order can be set to the order of message fields in the EtherCAT protocol message, such as the header command type, sub-command type, slave address, data field length, and data field value.

[0044] In an embodiment of the present application, the processing method further includes: after determining the anomaly detection score of the EtherCAT protocol message, updating the message detection model according to the EtherCAT protocol message and the anomaly detection score of the EtherCAT protocol message.

[0045] After determining the anomaly detection score of the EtherCAT protocol message, the processor can update the message detection model according to the EtherCAT protocol message and the anomaly detection score of the EtherCAT protocol message. Specifically, the training set of the message detection model can be updated based on the EtherCAT protocol message and the anomaly detection score of the EtherCAT protocol message, so as to update the message detection model with the new training set.

[0046] In one embodiment, the message detection model can be periodically updated according to the EtherCAT protocol message and the abnormal detection score of the EtherCAT protocol message. The period of updating the message detection model can be customized according to actual conditions.

[0047] The above scheme, after detecting the EtherCAT protocol message, regularly retrains the message detection model according to the EtherCAT protocol message and the abnormal detection score of the EtherCAT protocol message, automatically adjusts the model parameters and policy matching rules of the message detection model, can adapt to the new EtherCAT protocol message mode, and avoid its potential security threats, and continuous optimization can also improve the accuracy of identifying and filtering abnormal EtherCAT protocol messages.

[0048] Step 103: When the anomaly detection score is less than or equal to a preset threshold, extract key data in the EtherCAT protocol message, where the key data includes a slave address, a command type of the sub-message, and a data field value.

[0049] The processor can compare the size between the anomaly detection score and the preset threshold. The preset threshold can be set according to actual needs. For example, if the detection of EtherCAT protocol messages is strict, the preset threshold can be set relatively small to prevent EtherCAT protocol messages from attacking network security when the anomaly detection score is low. If the detection of EtherCAT protocol messages is loose, the preset threshold can be set relatively large.

[0050] If the anomaly detection score is less than or equal to the preset threshold, it means that the EtherCAT protocol message detection is normal. At this time, the processor can filter the normal EtherCAT protocol message with different granularity to meet the security requirements. By checking the different levels of the protocol, it can avoid various attack methods such as data tampering, and can also flexibly adapt to the different requirements for data importance in different devices or application scenarios. Specifically, the processor can extract key data from the EtherCAT protocol message. Among them, the key data includes the slave address, the command type of the sub-message, and the data field value.

[0051] In an embodiment of the present application, the processing method further includes: when the anomaly detection score is greater than a preset threshold, determining that the EtherCAT protocol message is abnormal, and blocking the transmission of the EtherCAT protocol message.

[0052] If the anomaly detection score is greater than the preset threshold, the processor can determine that the EtherCAT protocol message is abnormal, which means that there may be a network attack, affecting network security and stability. At this time, the processor can block the transmission of the EtherCAT protocol message to ensure network security and stability.

[0053] In an embodiment of the present application, the processing method further includes: when the EtherCAT protocol message is abnormal, recording the data field value and the abnormality detection score of the sub-message in the EtherCAT protocol message.

[0054] In the case where the EtherCAT protocol message is abnormal, the processor can record the data field value and the abnormality detection score of the sub-message in the EtherCAT protocol message for subsequent analysis.

[0055] Step 104: Determine whether the transmission permission conditions of the EtherCAT protocol message are met according to the slave address, command type and data field value.

[0056] If the anomaly detection score is less than or equal to the preset threshold, the processor can determine whether the transmission condition of the EtherCAT protocol message is met according to the slave address, command type and data field value. The transmission condition can be constructed according to the preset slave address, the preset sub-command type and the preset data field value.

[0057] In an embodiment of the present application, if any one of the following conditions is met, it is determined that the condition for allowing transmission is not met: the slave address is not a preset slave address; the command type is not a preset sub-command type; the data field value is not a preset data field value.

[0058] Among them, the preset slave address, the preset sub-command type and the preset data field value can be set according to the requirements. If the slave address of the EtherCAT protocol message is not the preset slave address, it can be determined that the EtherCAT protocol message does not meet the transmission conditions allowed for the EtherCAT protocol message. If the command type of the sub-message of the EtherCAT protocol message is not the preset sub-command type, it can be determined that the EtherCAT protocol message does not meet the transmission conditions allowed for the EtherCAT protocol message. If the data field value of the sub-message of the EtherCAT protocol message is not the preset data field value, it can be determined that the EtherCAT protocol message does not meet the transmission conditions allowed for the EtherCAT protocol message.

[0059] Step 105: When the transmission permission condition is not met, the transmission of the EtherCAT protocol message is blocked.

[0060] When it is determined that the EtherCAT protocol message does not meet the transmission conditions allowed, the processor can block the transmission of the EtherCAT protocol message to ensure network security and stability.

[0061] In an embodiment of the present application, when the transmission permission condition is not met, the data field value and the anomaly detection score of the sub-message in the EtherCAT protocol message are recorded.

[0062] When the transmission permission conditions are not met, the processor can record the data field value and anomaly detection score of the sub-message in the EtherCAT protocol message for subsequent analysis.

[0063] In one embodiment, if the slave address of the EtherCAT protocol message is a preset slave address, the command type of the sub-message of the EtherCAT protocol message is a preset sub-command type, and the data field value of the sub-message of the EtherCAT protocol message is a preset data field value, it can be determined that the EtherCAT protocol message meets the conditions for allowing transmission.

[0064] In one embodiment, when it is determined that the EtherCAT protocol message meets the transmission permission condition, the EtherCAT protocol message may be released, that is, the EtherCAT protocol message is allowed to be transmitted normally.

[0065] Through the above technical scheme, an EtherCAT protocol message to be detected is received; an anomaly detection score of the EtherCAT protocol message is determined according to a message detection model, and the message detection model is used to detect whether the EtherCAT protocol message is abnormal; when the anomaly detection score is less than or equal to a preset threshold, key data in the EtherCAT protocol message is extracted, and the key data includes a slave address, a command type of a sub-message, and a data field value; whether the transmission permission conditions of the EtherCAT protocol message are met is determined according to the slave address, the command type, and the data field value; when the transmission permission conditions are not met, the transmission of the EtherCAT protocol message is blocked, which can adapt to the ever-changing network environment and new attack methods, improve the accuracy of EtherCAT protocol message detection, and reduce the false alarm rate and missed alarm rate of the EtherCAT protocol message.

[0066] like Figure 2 As shown in FIG. 1 , another flowchart of a method for processing EtherCAT protocol messages is provided. Figure 2 As shown, in one embodiment of the present application, another method for processing EtherCAT protocol messages is provided, comprising the following steps:

[0067] Message data reception and parsing: Receive the original EtherCAT protocol message data and parse the original EtherCAT protocol message data into various fields. The parsing steps are: 1) Extract the Ethernet frame header, including the source mac address, destination mac address, and Ethernet frame type (for example, 0x88A4, which identifies the EtherCAT protocol); 2) Further separate the EtherCAT header, sub-message header, data part, and WKC from the EtherCAT data area; 3) Extract important information in the EtherCAT header, such as data length, reserved bits, and header type, where "1" in the header type indicates slave communication.

[0068] Feature extraction and data processing: The parsed message fields (such as Ethernet frame type, header command type, subcommand type, slave address, data field length, and data field value) are extracted as key features. The extracted features are directly used as raw values ​​and normalized to ensure that the data range of different features is consistent and suitable for deep learning models. The processed data is combined into vectors or arrays to ensure that the order of each message feature meets the expectations of the model. Multiple message data sets form a (N, D) matrix. N is the number of samples and D is the number of features.

[0069] Training and testing of deep learning models: The entire message data set can be divided into training set, validation set and test set in a ratio of 8:1:1 to ensure that the model has sufficient training data, and the performance of the model can be tested through the validation set and test set. Among them, the convolution layer of the model can use a one-dimensional convolution kernel to process serialized message data, and can set an appropriate stride and padding method. The activation function of the model can use Sigmoid or ReLU to provide nonlinear modeling capabilities. The pooling layer of the model can use global pooling to simplify feature dimensions and reduce parameters, thereby reducing the complexity of the model. The model can integrate the features processed by the convolution layer through the fully connected layer and output anomaly detection results or specific anomaly scores.

[0070] Model reasoning and message anomaly detection: After model training is completed, the trained model can be saved as a file for subsequent real-time reasoning. During the operation of the trained model, for each received EtherCAT protocol message, the anomaly detection score of each received EtherCAT protocol message can be output. If the anomaly detection score exceeds the set threshold, the EtherCAT protocol message is judged to be abnormal. At this time, detailed logs can be recorded, which may include the specific field values ​​and anomaly detection scores of the abnormal message for subsequent analysis by the administrator. Using the trained model to parse the EtherCAT protocol message can detect complex anomalies more accurately than the load-based rule matching method. By extracting multiple key fields such as Ethernet frame type, subcommand type, and slave address, CNN deep feature extraction makes anomaly detection more accurate. At the same time, the global pooling layer retains important features and reduces model complexity, improving detection efficiency.

[0071] Policy matching and message filtering: For EtherCAT protocol messages that are determined to be normal, policy matching can be performed. Specifically, according to the pre-set policy, the key fields in the EtherCAT protocol message (such as slave address and data field value, etc.) can be checked to see if they meet the policy conditions to be set. If all the key fields meet the set policy conditions, the EtherCAT protocol message passes and is allowed to be transmitted normally. If any key field does not meet the set policy conditions, the EtherCAT protocol message transmission is blocked and a log is recorded for review.

[0072] System adaptation and optimization: Regularly retrain deep learning models, automatically adjust model parameters and policy matching rules, ensure that the model can adapt to new message patterns and avoid potential attack threats, continuously optimize and improve the accuracy of model recognition and filtering of abnormal messages, reduce manual intervention, continuously improve recognition accuracy, and ensure flexible and efficient message processing.

[0073] Through the above technical scheme, an EtherCAT protocol message to be detected is received; an anomaly detection score of the EtherCAT protocol message is determined according to a message detection model, and the message detection model is used to detect whether the EtherCAT protocol message is abnormal; when the anomaly detection score is less than or equal to a preset threshold, key data in the EtherCAT protocol message is extracted, and the key data includes a slave address, a command type of a sub-message, and a data field value; whether the transmission permission conditions of the EtherCAT protocol message are met according to the slave address, the command type, and the data field value; when the transmission permission conditions are not met, the transmission of the EtherCAT protocol message is blocked, which can adapt to the ever-changing network environment and new attack methods, improve the accuracy of EtherCAT protocol message detection, and reduce the false alarm rate and missed alarm rate of the EtherCAT protocol message.

[0074] Figure 1 and 2 FIG. 1 is a flow chart of a method for processing EtherCAT protocol messages in one embodiment. It should be understood that although Figure 1 and 2 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1 and 2At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0075] In one embodiment, a device for processing EtherCAT protocol messages is provided, comprising:

[0076] a memory configured to store instructions;

[0077] The processor is configured to call instructions from the memory and implement the above-mentioned processing method for EtherCAT protocol messages when executing the instructions.

[0078] In one embodiment, a machine-readable storage medium is provided, on which instructions are stored, and the instructions are used to enable a machine to execute the above-mentioned method for processing EtherCAT protocol messages.

[0079] In one embodiment, a processor is provided, and the processor is used to run a program, wherein the program executes the above-mentioned processing method for EtherCAT protocol messages when it is run.

[0080] In one embodiment, an industrial control firewall is provided, comprising the above-mentioned processor.

[0081] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 3 As shown. The computer device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected through a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The database of the computer device is used to store data such as abnormality detection results of EtherCAT protocol messages. The network interface A02 of the computer device is used to communicate with an external terminal through a network connection. When the computer program B02 is executed by the processor A01, a processing method for EtherCAT protocol messages is implemented.

[0082] Those skilled in the art will understand that Figure 3The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0083] The embodiment of the present application provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented:

[0084] Receive the EtherCAT protocol message to be detected;

[0085] Determine an abnormality detection score of the EtherCAT protocol message according to the message detection model, where the message detection model is used to detect whether the EtherCAT protocol message is abnormal;

[0086] When the anomaly detection score is less than or equal to the preset threshold, extract key data in the EtherCAT protocol message, including the slave address, the command type and the data field value of the sub-message;

[0087] Determine whether the transmission conditions of the EtherCAT protocol message are met according to the slave address, command type and data field value;

[0088] If the transmission conditions are not met, the transmission of EtherCAT protocol messages is blocked.

[0089] In one embodiment, when any one of the following conditions is met, it is determined that the transmission permission condition is not met: the slave address is not a preset slave address; the command type is not a preset sub-command type; the data field value is not a preset data field value.

[0090] In one embodiment, determining an anomaly detection score of an EtherCAT protocol message according to a message detection model includes: parsing and extracting key features of the EtherCAT protocol message; normalizing the key features; and inputting the normalized key features into the message detection model in a preset order to obtain an anomaly detection score of the EtherCAT protocol message.

[0091] In one embodiment, the processing method further includes: after determining the anomaly detection score of the EtherCAT protocol message, updating the message detection model according to the EtherCAT protocol message and the anomaly detection score of the EtherCAT protocol message.

[0092] In one embodiment, the message detection model is constructed by the following steps: obtaining multiple historical EtherCAT protocol messages; parsing and extracting the historical key features of each historical EtherCAT protocol message; normalizing the historical key features of each historical EtherCAT protocol message; constructing a training set, the training set includes the normalized historical key features corresponding to each historical EtherCAT protocol message, and the normalized historical key features of each historical EtherCAT protocol message are arranged in a preset order; inputting the training set into a preset convolutional neural network model so that the preset convolutional neural network model outputs the abnormal detection score of each historical EtherCAT protocol message; when the convolutional neural network model meets the preset training completion condition, determining that the convolutional neural network model training is completed, and obtaining the message detection model. In one embodiment, the processing method also includes: when the abnormal detection score is greater than a preset threshold, determining that the EtherCAT protocol message is abnormal, and blocking the transmission of the EtherCAT protocol message.

[0093] In one embodiment, the processing method further includes: when the EtherCAT protocol message is abnormal or does not meet the transmission permission condition, recording the data field value and the abnormality detection score of the sub-message in the EtherCAT protocol message.

[0094] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program for initializing the steps of a processing method for EtherCAT protocol messages.

[0095] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0096] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0097] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0098] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0099] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0100] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0101] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0102] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0103] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for processing EtherCAT protocol messages, characterized in that: The processing method comprises: Receive the EtherCAT protocol message to be detected; Determining an abnormality detection score of the EtherCAT protocol message according to a message detection model, wherein the message detection model is used to detect whether the EtherCAT protocol message is abnormal; When the anomaly detection score is less than or equal to a preset threshold, extracting key data in the EtherCAT protocol message, the key data including a slave station address, a command type of a sub-message, and a data field value; Determining whether the transmission permission condition of the EtherCAT protocol message is met according to the slave station address, the command type and the data field value; If the transmission permission condition is not met, the transmission of the EtherCAT protocol message is blocked.

2. The method for processing EtherCAT protocol messages according to claim 1, characterized in that: When any of the following conditions is met, it is determined that the transmission permission condition is not met: The slave station address is not a preset slave station address; The command type is not a preset sub-command type; The data field value is not a preset data field value.

3. The method for processing EtherCAT protocol messages according to claim 1, characterized in that: Determining the abnormality detection score of the EtherCAT protocol message according to the message detection model includes: Parsing and extracting key features of the EtherCAT protocol message; Normalizing the key features; The normalized key features are input into the message detection model in a preset order to obtain an anomaly detection score for the EtherCAT protocol message.

4. The method for processing EtherCAT protocol messages according to claim 3, characterized in that: The processing method also includes: After determining the anomaly detection score of the EtherCAT protocol message, the message detection model is updated according to the EtherCAT protocol message and the anomaly detection score of the EtherCAT protocol message.

5. The method for processing EtherCAT protocol messages according to claim 3, characterized in that: The message detection model is constructed by the following steps: Get multiple historical EtherCAT protocol messages; Parse and extract historical key features of each historical EtherCAT protocol message; Normalize the historical key features of each historical EtherCAT protocol message; Constructing a training set, wherein the training set includes normalized historical key features corresponding to each historical EtherCAT protocol message, and the normalized historical key features of each historical EtherCAT protocol message are arranged in a preset order; Inputting the training set into a preset convolutional neural network model so that the preset convolutional neural network model outputs an anomaly detection score for each historical EtherCAT protocol message; When the convolutional neural network model meets the preset training completion conditions, it is determined that the training of the convolutional neural network model is completed, and the message detection model is obtained.

6. The method for processing EtherCAT protocol messages according to claim 1, characterized in that: The processing method also includes: When the abnormality detection score is greater than the preset threshold, the EtherCAT protocol message is determined to be abnormal, and the transmission of the EtherCAT protocol message is blocked.

7. The method for processing EtherCAT protocol messages according to claim 6, characterized in that: The processing method also includes: When the EtherCAT protocol message is abnormal or does not meet the transmission permission condition, the data field value of the sub-message in the EtherCAT protocol message and the abnormality detection score are recorded.

8. A device for processing EtherCAT protocol messages, characterized in that: The device comprises: a memory configured to store instructions; A processor is configured to call the instruction from the memory and implement the method for processing EtherCAT protocol messages according to any one of claims 1 to 7 when executing the instruction.

9. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores instructions, which are used to enable a machine to execute the method for processing EtherCAT protocol messages according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the method for processing EtherCAT protocol messages according to any one of claims 1 to 7.

Images