Processing method and device for ethercat protocol message, storage medium and program product

Abstract

Embodiments of the present application provide a processing method and device for an EtherCAT protocol message, a storage medium and a program product. The method comprises: receiving an EtherCAT protocol message to be detected; determining an abnormality detection score of the EtherCAT protocol message according to a message detection model, the message detection model being used to detect whether the EtherCAT protocol message is abnormal; when the abnormality detection score is less than or equal to a preset threshold, extracting key data in the EtherCAT protocol message; judging whether an allowed transmission condition of the EtherCAT protocol message is met according to a slave address, a command type and a data field value; and when the allowed transmission condition is not met, blocking transmission of the EtherCAT protocol message. The method can adapt to changing network environments and new attack methods, improve EtherCAT protocol message detection accuracy, and reduce false positive rate and false negative rate of the EtherCAT protocol message.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of message detection, in particular to a processing method and device for EtherCAT protocol messages, a storage medium and a computer program product. BACKGROUND

[0002] EtherCAT (Ethernet for Control Automation Technology) is a high-performance industrial Ethernet protocol that is widely used in various industrial automation systems due to its excellent real-time performance, synchronization and flexibility.

[0003] In the prior art, when detecting industrial internet protocols, it relies on predefined load fingerprint features. However, these features are static and can effectively identify EtherCAT traffic under normal circumstances, but attackers can modify these features to evade detection, for example, by injecting fake data in Ethernet frames or modifying the order of sub-messages. Attackers can interfere with detection mechanisms based on these features. This approach relies heavily on load fingerprint features and is vulnerable to variations and evasion strategies. Moreover, relying solely on fixed load features can lead to false positives and false negatives, for example, some legal but uncommon EtherCAT traffic may be misjudged as abnormal traffic due to not meeting the predefined features.

[0004] Therefore, the detection of EtherCAT protocol messages in the prior art is difficult to adapt to changing network environments and new attack methods, and relying solely on fixed load features can lead to inaccurate detection of EtherCAT protocol messages, increasing the false positive rate and false negative rate of EtherCAT protocol messages. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a processing method, device, storage medium and computer program product for EtherCAT protocol messages to solve the problem of high false positive rate and false negative rate of EtherCAT protocol messages in the prior art.

[0006] To achieve the above-mentioned purpose, the first aspect of the present application provides a processing method for EtherCAT protocol messages, comprising:

[0007] receiving an EtherCAT protocol message to be detected;

[0008] determining an anomaly detection score of the EtherCAT protocol message according to a message detection model, the message detection model being used to detect whether the EtherCAT protocol message is abnormal;

[0009] In a case where the anomaly detection score is less than or equal to a preset threshold, key data in the EtherCAT protocol message is extracted, the key data including a slave address, a command type of a sub-message, and a data field value;

[0010] It is determined whether the EtherCAT protocol message satisfies a transmission permission condition according to the slave address, the command type, and the data field value.

[0011] In a case where the transmission permission condition is not satisfied, transmission of the EtherCAT protocol message is blocked.

[0012] In the embodiments of the present application, in a case where any one of the following conditions is satisfied, it is determined that the transmission permission condition is not satisfied: the slave address is not a preset slave address; the command type is not a preset sub-command type; and the data field value is not a preset data field value.

[0013] In the embodiments of the present application, determining the anomaly detection score of the EtherCAT protocol message according to the message detection model includes: analyzing and extracting key features of the EtherCAT protocol message; performing normalization processing on the key features; and inputting the normalized key features into the message detection model in a preset order to obtain the anomaly detection score of the EtherCAT protocol message.

[0014] In the embodiments of the present application, the processing method further includes: after determining the anomaly detection score of the EtherCAT protocol message, updating the message detection model according to the EtherCAT protocol message and the anomaly detection score of the EtherCAT protocol message.

[0015] In the embodiments of the present application, the message detection model is constructed by the following steps: obtaining a plurality of historical EtherCAT protocol messages; analyzing and extracting historical key features of each historical EtherCAT protocol message; performing normalization processing on the historical key features of each historical EtherCAT protocol message; constructing a training set, the training set including the normalized historical key features corresponding to each historical EtherCAT protocol message, the normalized historical key features of each historical EtherCAT protocol message being arranged in a preset order; inputting the training set into a preset convolutional neural network model to make the preset convolutional neural network model output an anomaly detection score of each historical EtherCAT protocol message; and in a case where the convolutional neural network model satisfies a preset training completion condition, determining that the convolutional neural network model is trained and the message detection model is obtained. In the embodiments of the present application, the processing method further includes: in a case where the anomaly detection score is greater than a preset threshold, determining that the EtherCAT protocol message is abnormal and blocking transmission of the EtherCAT protocol message.

[0016] In the embodiment of the present application, the processing method further comprises: in the case that the EtherCAT protocol message is abnormal or does not meet the allowed transmission condition, recording the data field value of the sub-message in the EtherCAT protocol message and the abnormality detection score.

[0017] The second aspect of the present application provides a processing device for an EtherCAT protocol message, comprising:

[0018] a memory configured to store instructions;

[0019] a processor configured to call the instructions from the memory and capable of implementing the above-mentioned processing method for an EtherCAT protocol message when executing the instructions.

[0020] The third aspect of the present application provides a machine-readable storage medium having instructions stored thereon, which, when executed by a processor, cause the processor to be configured to execute the above-mentioned processing method for an EtherCAT protocol message.

[0021] The fourth aspect of the present application provides a computer program product comprising a computer program, which, when executed by a processor, implements the above-mentioned processing method for an EtherCAT protocol message.

[0022] Through the above technical solution, the EtherCAT protocol message to be detected is received; the abnormality detection score of the EtherCAT protocol message is determined according to a message detection model, which is used to detect whether the EtherCAT protocol message is abnormal; in the case that the abnormality detection score is less than or equal to a preset threshold, the key data in the EtherCAT protocol message is extracted, including the slave address, the command type and the data field value of the sub-message; whether the allowed transmission condition of the EtherCAT protocol message is met is judged according to the slave address, the command type and the data field value; in the case that the allowed transmission condition is not met, the transmission of the EtherCAT protocol message is blocked, which can adapt to the constantly changing network environment and new attack means, improve the accuracy of EtherCAT protocol message detection, and reduce the false positive rate and the false negative rate of the EtherCAT protocol message.

[0023] Other features and advantages of the embodiments of the present application will be described in detail in the following specific implementation part. BRIEF DESCRIPTION OF DRAWINGS

[0024] The accompanying drawings are used to provide a further understanding of the embodiments of the present application, and constitute a part of the specification, and are used to explain the embodiments of the present application together with the following specific implementation, but do not constitute a limitation to the embodiments of the present application. In the drawings:

[0025] Figure 1Fig. 1 schematically shows a flowchart of a method for processing an EtherCAT protocol message according to an embodiment of the present application;

[0026] Figure 2 Fig. 2 schematically shows a flowchart of a method for processing an EtherCAT protocol message according to another embodiment of the present application;

[0027] Figure 3 Fig. 3 schematically shows an internal structure diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It should be understood that the specific embodiments described herein are merely used to explain and illustrate the embodiments of the present application, and should not be used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0029] It should be noted that if the present application has a description of "first", "second", etc., the description of "first", "second", etc. is only for the purpose of description, and cannot be understood as indicating or implying the relative importance of the indicated technical features or implicitly indicating the number of the indicated technical features. Therefore, the features limited by "first", "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions of each embodiment can be combined with each other, but it must be based on the fact that a person of ordinary skill in the art can realize it, and when the combination of technical solutions appears to be contradictory or unachievable, it should be considered that the combination of technical solutions does not exist, and is not within the scope of protection claimed by the present application.

[0030] Figure 1 Fig. 1 schematically shows a flowchart of a method for processing an EtherCAT protocol message according to an embodiment of the present application. As shown in Figure 1 In an embodiment of the present application, a method for processing an EtherCAT protocol message is provided, including the following steps:

[0031] Step 101: receiving an EtherCAT protocol message to be detected.

[0032] Step 102: determining an abnormality detection score of the EtherCAT protocol message according to a message detection model, the message detection model being used to detect whether the EtherCAT protocol message is abnormal.

[0033] The EtherCAT protocol is a high-performance real-time Ethernet communication protocol. In the network of a factory, each device can continuously send data to a master system in the form of an EtherCAT protocol message. After receiving an EtherCAT protocol message to be detected, an abnormal detection score of the EtherCAT protocol message can be determined according to a message detection model. The message detection model is used to detect whether the EtherCAT protocol message is abnormal. The message detection model can be trained based on a convolutional neural network, such as a CNN model.

[0034] In the embodiments of the present application, the message detection model is constructed by the following steps: obtaining a plurality of historical EtherCAT protocol messages; parsing and extracting historical key features of each historical EtherCAT protocol message; performing normalization processing on the historical key features of each historical EtherCAT protocol message; constructing a training set, the training set including the normalized historical key features corresponding to each historical EtherCAT protocol message, the normalized historical key features of each historical EtherCAT protocol message being arranged in a predetermined order; inputting the training set into a predetermined convolutional neural network model to make the predetermined convolutional neural network model output an abnormal detection score of each historical EtherCAT protocol message; and determining that the convolutional neural network model is trained when the convolutional neural network model meets a predetermined training completion condition, thereby obtaining the message detection model.

[0035] In constructing the message detection model, a plurality of historical EtherCAT protocol messages can be obtained. The historical EtherCAT protocol messages can include EtherCAT protocol messages obtained before receiving the EtherCAT protocol message to be detected, and legal but uncommon EtherCAT protocol messages received before. The historical key features of each historical EtherCAT protocol message can be parsed and extracted, and the historical key features of each historical EtherCAT protocol message can be normalized.

[0036] After normalizing the historical key features, a message data set can be constructed according to all the historical EtherCAT protocol messages, and the message data set can be divided into a training set, a validation set and a test set according to a predetermined proportion. The predetermined proportion of the training set, the validation set and the test set can be set to 8:1:1 to ensure that the predetermined convolutional neural network has sufficient training data. The validation set and the test set can be used to evaluate the performance of the model.

[0037] The training set includes normalized historical key features corresponding to each historical EtherCAT protocol message. In order to prevent an attacker from modifying the order of the sub-messages, the normalized historical key features of each historical EtherCAT protocol message are arranged in a preset order. The preset order can be set as the order of the message fields in the historical EtherCAT protocol message, such as the header command type, the sub-message command type, the slave address, the data field length, and the data field value.

[0038] After the training set is constructed, the training set can be input into a preset convolutional neural network model, so that the preset convolutional neural network model outputs an anomaly detection score of each historical EtherCAT protocol message. The preset convolutional neural network model is, for example, a CNN model. The preset convolutional neural network model uses a one-dimensional convolution kernel to process the serialized message data, and sets an appropriate stride and padding mode. The activation function of the preset convolutional neural network model can use Sigmoid or ReLU to provide nonlinear modeling capability. The pooling layer of the preset convolutional neural network model can use global pooling to simplify the feature dimension, reduce the parameters, and thus reduce the complexity of the model. The preset convolutional neural network model integrates the features processed by the convolutional layer through a fully connected layer, thereby outputting an anomaly detection score of each historical EtherCAT protocol message.

[0039] When the convolutional neural network model meets a preset training completion condition, it can be determined that the training of the convolutional neural network model is completed, and a message detection model is obtained. The preset training completion condition can include that the number of iterations of the training reaches a preset number, and / or the prediction accuracy reaches a preset accuracy, and / or the prediction error is less than a preset threshold, etc.

[0040] In the embodiments of the present application, determining the anomaly detection score of the EtherCAT protocol message according to the message detection model includes: analyzing and extracting key features of the EtherCAT protocol message; performing normalization processing on the key features; inputting the normalized key features into the message detection model in a preset order to obtain the anomaly detection score of the EtherCAT protocol message.

[0041] The processor can analyze and extract key features of the EtherCAT protocol message. The key features can include the Ethernet frame type, the header command type in the EtherCAT header, the sub-message command type in the sub-message header, the slave address and the data field length, and the data field value of the sub-message, etc. The command type of the sub-message header is determined by decoding the data area of the EtherCAT protocol message and based on a preset offset.

[0042] Specifically, the Ethernet frame header of the EtherCAT protocol packet can be parsed and extracted, and the Ethernet frame header of the EtherCAT protocol packet includes a source mac address, a destination mac address, and an Ethernet frame type. The data region of the EtherCAT protocol packet can be parsed and extracted, and the data region includes an EtherCAT header, a sub-packet header, a data part of the sub-packet, and a working counter WKC. The EtherCAT data length, the reserved bit, and the header command type in the EtherCAT header can be extracted, the sub-command type, the slave address, and the data field length in the sub-packet header can be extracted, and the data field value of the sub-packet can be extracted. If the header type is "1", it indicates communication of a slave station.

[0043] The processor can normalize the key features to ensure that the data ranges of different key features are consistent. The processor can input the normalized key features to the packet detection model according to a preset order to obtain an anomaly detection score of the EtherCAT protocol packet. The preset order can be set according to actual conditions, for example, in order to prevent an attacker from modifying the order of the sub-packet, the preset order can be set as the order of the packet fields in the EtherCAT protocol packet, such as the header command type, the sub-command type, the slave address, the data field length, and the data field value.

[0044] In the embodiment of the present application, the processing method further includes: after determining the anomaly detection score of the EtherCAT protocol packet, updating the packet detection model according to the EtherCAT protocol packet and the anomaly detection score of the EtherCAT protocol packet.

[0045] After determining the anomaly detection score of the EtherCAT protocol packet, the processor can update the packet detection model according to the EtherCAT protocol packet and the anomaly detection score of the EtherCAT protocol packet. Specifically, the training set of the packet detection model can be updated based on the EtherCAT protocol packet and the anomaly detection score of the EtherCAT protocol packet, so that the packet detection model is updated with a new training set.

[0046] In one embodiment, the packet detection model can be updated periodically according to the EtherCAT protocol packet and the anomaly detection score of the EtherCAT protocol packet. The period of updating the packet detection model can be customized according to actual conditions.

[0047] The above scheme can periodically retrain the message detection model according to the EtherCAT protocol message and the abnormal detection score of the EtherCAT protocol message after detecting the EtherCAT protocol message, automatically adjust the model parameters and strategy matching rules of the message detection model, adapt to new EtherCAT protocol message modes, circumvent potential security threats, continuously optimize, and improve the accuracy of identifying and filtering abnormal EtherCAT protocol messages.

[0048] Step 103: In the case where the abnormal detection score is less than or equal to the preset threshold, the key data in the EtherCAT protocol message is extracted, and the key data includes the slave address, the command type of the sub-message, and the data field value.

[0049] The processor can compare the size between the abnormal detection score and the preset threshold. The preset threshold can be set according to actual needs. For example, if the detection of the EtherCAT protocol message is relatively strict, the preset threshold can be set to be relatively small, so that the EtherCAT protocol message can also be prevented from attacking the network security when the abnormal detection score is low. If the detection of the EtherCAT protocol message is relatively loose, the preset threshold can be set to be relatively large.

[0050] If the abnormal detection score is less than or equal to the preset threshold, it indicates that the EtherCAT protocol message detection is normal. At this time, the processor can filter the normal EtherCAT protocol message at different granularities to meet the security requirements. Through the inspection of different levels of the protocol, diversified attack methods such as data tampering can be avoided, and different requirements for the importance of data in different devices or application scenarios can also be flexibly adapted. Specifically, the processor can extract the key data in the EtherCAT protocol message. The key data includes the slave address, the command type of the sub-message, and the data field value.

[0051] In the embodiment of the present application, the processing method further includes: in the case where the abnormal detection score is greater than the preset threshold, determining that the EtherCAT protocol message is abnormal, and blocking the transmission of the EtherCAT protocol message.

[0052] If the abnormal detection score is greater than the preset threshold, the processor can determine that the EtherCAT protocol message is abnormal, that is, there may be a network attack, which affects the network security and stability. At this time, the processor can block the transmission of the EtherCAT protocol message to ensure the network security and stability.

[0053] In the embodiment of the present application, the processing method further includes: in the case where the EtherCAT protocol message is abnormal, recording the data field value of the sub-message in the EtherCAT protocol message and the abnormal detection score. In the embodiment of the present application, the processing method further includes: in the case where the EtherCAT protocol message is abnormal, recording the data field value of the sub-message in the EtherCAT protocol message and the abnormal detection score.

[0054] In the case that the EtherCAT protocol message is abnormal, the processor can record the data field value and the abnormality detection score of the sub-message in the EtherCAT protocol message for subsequent analysis.

[0055] Step 104: judging whether the EtherCAT protocol message meets the allowed transmission condition according to the slave address, the command type and the data field value.

[0056] If the abnormality detection score is less than or equal to the preset threshold, the processor can judge whether the EtherCAT protocol message meets the allowed transmission condition according to the slave address, the command type and the data field value. The allowed transmission condition can be constructed according to the preset slave address, the preset sub-command type and the preset data field value.

[0057] In the embodiments of the present application, in the case that any one of the following conditions is met, it is determined that the allowed transmission condition is not met: the slave address is not the preset slave address; the command type is not the preset sub-command type; and the data field value is not the preset data field value.

[0058] The preset slave address, the preset sub-command type and the preset data field value can be set according to requirements. If the slave address of the EtherCAT protocol message is not the preset slave address, it can be determined that the EtherCAT protocol message does not meet the allowed transmission condition of the EtherCAT protocol message. If the command type of the sub-message of the EtherCAT protocol message is not the preset sub-command type, it can be determined that the EtherCAT protocol message does not meet the allowed transmission condition of the EtherCAT protocol message. If the data field value of the sub-message of the EtherCAT protocol message is not the preset data field value, it can be determined that the EtherCAT protocol message does not meet the allowed transmission condition of the EtherCAT protocol message.

[0059] Step 105: blocking the transmission of the EtherCAT protocol message in the case that the allowed transmission condition is not met.

[0060] In the case that it is determined that the EtherCAT protocol message does not meet the allowed transmission condition, the processor can block the transmission of the EtherCAT protocol message to ensure network security and stability.

[0061] In the embodiments of the present application, in the case that the allowed transmission condition is not met, the data field value and the abnormality detection score of the sub-message in the EtherCAT protocol message are recorded.

[0062] In the case that the allowed transmission condition is not met, the processor can record the data field value and the abnormality detection score of the sub-message in the EtherCAT protocol message for subsequent analysis.

[0063] In one embodiment, if the slave address of the EtherCAT protocol message is a preset slave address, the command type of the sub-message of the EtherCAT protocol message is a preset sub-command type, and the data field value of the sub-message of the EtherCAT protocol message is a preset data field value, it can be determined that the EtherCAT protocol message meets the allowed transmission condition.

[0064] In one embodiment, in the case of determining that the EtherCAT protocol message meets the allowed transmission condition, the EtherCAT protocol message can be released, i.e. the EtherCAT protocol message is allowed to be normally transmitted.

[0065] Through the above technical solution, the EtherCAT protocol message to be detected is received; the abnormal detection score of the EtherCAT protocol message is determined according to a message detection model, the message detection model being used to detect whether the EtherCAT protocol message is abnormal; in the case of the abnormal detection score being less than or equal to a preset threshold value, the key data in the EtherCAT protocol message is extracted, the key data including the slave address, the command type of the sub-message and the data field value; it is judged whether the allowed transmission condition of the EtherCAT protocol message is met according to the slave address, the command type and the data field value; in the case of not meeting the allowed transmission condition, the transmission of the EtherCAT protocol message is blocked, which can adapt to the constantly changing network environment and new attack means, improve the accuracy of EtherCAT protocol message detection, and reduce the false positive rate and the false negative rate of the EtherCAT protocol message.

[0066] As shown in FIG. 1, another flowchart of a method for processing an EtherCAT protocol message is provided. As shown in FIG. 2, in one embodiment of the present application, another method for processing an EtherCAT protocol message is provided, which includes the following steps: Figure 2 Figure 2 Message data receiving and parsing: receiving original EtherCAT protocol message data and parsing the original EtherCAT protocol message data into various fields. The steps of parsing are: 1) extracting the Ethernet frame header, which includes the source mac address, the destination mac address, and the Ethernet frame type (such as 0x88A4, indicating EtherCAT protocol); 2) further dividing the EtherCAT header, the sub-message header, the data part and the WKC from the EtherCAT data area; 3) extracting important information such as data length, reserved bit and header type from the EtherCAT header, wherein the header type of “1” indicates the communication of the slave station.

[0067] Message data receiving and parsing: receiving original EtherCAT protocol message data and parsing the original EtherCAT protocol message data into various fields. The steps of parsing are: 1) extracting the Ethernet frame header, which includes the source mac address, the destination mac address, and the Ethernet frame type (such as 0x88A4, indicating EtherCAT protocol); 2) further dividing the EtherCAT header, the sub-message header, the data part and the WKC from the EtherCAT data area; 3) extracting important information such as data length, reserved bit and header type from the EtherCAT header, wherein the header type of “1” indicates the communication of the slave station.

[0068] ​Feature extraction and data processing: The parsed message fields (such as Ethernet frame type, header command type, sub-command type, slave address, data field length, and data field value) are extracted as key features. The extracted features are directly used as raw numerical values and are normalized to ensure consistent data ranges for different features, suitable for deep learning models. The processed data is combined into vectors or arrays to ensure that the order of each message feature meets the expectations of the model, and multiple message data sets form an (N, D) matrix. Where N is the number of samples and D is the number of features.

[0069] Training and testing of deep learning model: The entire message data set can be divided into training set, validation set and test set according to the ratio of 8:1:1 to ensure that the model has enough training data and can test the performance of the model through the validation set and test set. The convolutional layer of the model can use one-dimensional convolution kernel to process the serialized message data, and appropriate stride and padding methods can be set. The activation function of the model can use Sigmoid or ReLU to provide nonlinear modeling capability. The pooling layer of the model can use global pooling to simplify the feature dimension, reduce the parameters, and thus reduce the complexity of the model. The model can integrate the features processed by the convolutional layer through the fully connected layer to output the abnormal detection result or specific abnormal score.

[0070] Model inference and message anomaly detection: After the model is trained, the trained model can be saved as a file for subsequent real-time inference. During the running of the trained model, for each received EtherCAT protocol message, the abnormal detection score of each received EtherCAT protocol message can be output. If the abnormal detection score exceeds the set threshold, the EtherCAT protocol message is determined to be abnormal. At this time, detailed logs can be recorded, which can include specific field values and abnormal detection scores of abnormal messages for subsequent analysis by administrators. Using the trained model to analyze EtherCAT protocol messages can more accurately detect complex anomalies than the rule matching method based on load. By extracting multiple key fields such as Ethernet frame type, sub-command type, and slave address, CNN deep feature extraction makes anomaly detection more accurate. At the same time, the global pooling layer retains important features and reduces the complexity of the model, improving the detection efficiency.

[0071] Policy matching and packet filtering: for the EtherCAT protocol packets determined to be normal, policy matching can be performed. Specifically, according to the pre-set policy, it can be checked whether the key fields (such as slave address and data field value, etc.) in the EtherCAT protocol packet meet the set policy conditions. If all the key fields meet the set policy conditions, the EtherCAT protocol packet passes and is allowed to be normally transmitted. If any one of the key fields does not meet the set policy conditions, the transmission of the EtherCAT protocol packet is blocked, and a log is recorded for review.

[0072] System adaptation and optimization: periodically retrain the deep learning model, automatically adjust the model parameters and policy matching rules, ensure that the model can adapt to new packet patterns, and avoid potential attack threats, continuously optimize and improve the accuracy of the model in identifying and filtering abnormal packets, reduce manual intervention, continuously improve the identification accuracy, and ensure that the packet processing is flexible and efficient.

[0073] Through the above technical solutions, the EtherCAT protocol packet to be detected is received; the abnormal detection score of the EtherCAT protocol packet is determined according to a packet detection model, and the packet detection model is used to detect whether the EtherCAT protocol packet is abnormal; in the case that the abnormal detection score is less than or equal to a preset threshold, key data in the EtherCAT protocol packet is extracted, the key data including a slave address, a command type of a sub-packet, and a data field value; it is judged whether the EtherCAT protocol packet meets an allowed transmission condition according to the slave address, the command type, and the data field value; in the case that the allowed transmission condition is not met, the transmission of the EtherCAT protocol packet is blocked, which can adapt to the changing network environment and new attack means, improve the accuracy of EtherCAT protocol packet detection, and reduce the false positive rate and the false negative rate of the EtherCAT protocol packet.

[0074] Figure 1 and 2 is a flowchart of a method for processing an EtherCAT protocol packet in an embodiment. It should be understood that, although Figure 1 and 2 the steps in the flowchart are displayed in sequence according to the arrows, these steps are not necessarily executed in sequence according to the arrows. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, Figure 1 and 2At least one of the steps in the above method can comprise a plurality of sub-steps or a plurality of stages, which are not necessarily performed at the same time, but can be performed at different times, and the order of the sub-steps or stages is not necessarily sequential, but can be performed alternately or in rotation with at least one of the other steps or sub-steps or stages of the other steps.

[0075] In one embodiment, a processing apparatus for EtherCAT protocol packets is provided, comprising:

[0076] a memory configured to store instructions;

[0077] a processor configured to invoke the instructions from the memory and implement the above-mentioned processing method for EtherCAT protocol packets when the instructions are executed.

[0078] In one embodiment, a machine-readable storage medium having stored thereon instructions for causing a machine to perform the above-mentioned processing method for EtherCAT protocol packets is provided.

[0079] In one embodiment, a processor for running a program is provided, wherein the program, when running, performs the above-mentioned processing method for EtherCAT protocol packets.

[0080] In one embodiment, an industrial control firewall is provided, comprising the above-mentioned processor.

[0081] In one embodiment, a computer device is provided, which can be a server, and the internal structure diagram thereof can be as shown in Figure 3 The computer device comprises a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected through a system bus. The processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device comprises an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the running of the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The database of the computer device is used to store data such as the abnormality detection result of the EtherCAT protocol packet. The network interface A02 of the computer device is used to communicate with the external terminal through the network connection. The computer program B02 is executed by the processor A01 to implement a processing method for EtherCAT protocol packets.

[0082] Those skilled in the art can understand that, Figure 3The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0083] The embodiment of the present application provides a device, which comprises a processor, a memory and a program stored on the memory and executable on the processor, and the processor implements the following steps when executing the program:

[0084] receiving an EtherCAT protocol packet to be detected;

[0085] determining an abnormality detection score of the EtherCAT protocol packet according to a packet detection model, the packet detection model being used to detect whether the EtherCAT protocol packet is abnormal;

[0086] extracting key data in the EtherCAT protocol packet in a case where the abnormality detection score is less than or equal to a preset threshold, the key data comprising a slave address, a command type of a sub-packet and a data field value;

[0087] judging whether an allowed transmission condition of the EtherCAT protocol packet is met according to the slave address, the command type and the data field value;

[0088] blocking transmission of the EtherCAT protocol packet in a case where the allowed transmission condition is not met.

[0089] In one embodiment, the allowed transmission condition is determined not to be met in a case where any one of the following conditions is met: the slave address is not a preset slave address; the command type is not a preset sub-command type; and the data field value is not a preset data field value.

[0090] In one embodiment, determining the abnormality detection score of the EtherCAT protocol packet according to the packet detection model comprises: analyzing and extracting key features of the EtherCAT protocol packet; performing normalization processing on the key features; and inputting the normalized key features into the packet detection model in a preset order to obtain the abnormality detection score of the EtherCAT protocol packet.

[0091] In one embodiment, the processing method further comprises: updating the packet detection model according to the EtherCAT protocol packet and the abnormality detection score of the EtherCAT protocol packet after the abnormality detection score of the EtherCAT protocol packet is determined.

[0092] In one embodiment, the packet detection model is constructed by the following steps: obtaining a plurality of historical EtherCAT protocol packets; parsing and extracting historical key features of each historical EtherCAT protocol packet; performing normalization processing on the historical key features of each historical EtherCAT protocol packet; constructing a training set, the training set including the normalized historical key features corresponding to each historical EtherCAT protocol packet, and the normalized historical key features of each historical EtherCAT protocol packet being arranged in a preset order; inputting the training set into a preset convolutional neural network model, so that the preset convolutional neural network model outputs an anomaly detection score of each historical EtherCAT protocol packet; and in a case where the convolutional neural network model meets a preset training completion condition, determining that the convolutional neural network model is trained and completed, and obtaining the packet detection model. In one embodiment, the processing method further includes: in a case where the anomaly detection score is greater than a preset threshold, determining that the EtherCAT protocol packet is abnormal, and blocking transmission of the EtherCAT protocol packet.

[0093] In one embodiment, the processing method further includes: in a case where the EtherCAT protocol packet is abnormal or the transmission permission condition is not met, recording a data field value and the anomaly detection score of a sub-packet in the EtherCAT protocol packet.

[0094] The application also provides a computer program product adapted to execute the steps of the processing method for the EtherCAT protocol packet when executed on a data processing device.

[0095] Those skilled in the art will understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0096] The present application is described with reference to the flowcharts and / or block diagrams according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one flow or multiple flows and / or blocksFigure 1 A device that provides the functions specified in one or more boxes.

[0097] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0098] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0099] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0100] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0101] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0102] It should also be noted that the terms "comprising", "comprises" or other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0103] The above embodiments are only used to illustrate the present application, but not to limit it. Instead of the above, various modifications and changes can be made to the application by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall fall into the scope of the claims of the application.

Claims

1. A method for processing EtherCAT protocol messages, characterized in that, The processing method includes: Receive the EtherCAT protocol message to be detected; The anomaly detection score of the EtherCAT protocol message is determined based on the message detection model, which is used to detect whether the EtherCAT protocol message is abnormal. If the anomaly detection score is less than or equal to a preset threshold, key data is extracted from the EtherCAT protocol message. The key data includes the slave address, the command type of the sub-message, and the data field values. If the anomaly detection score is greater than the preset threshold, the EtherCAT protocol message is determined to be abnormal, and the transmission of the EtherCAT protocol message is blocked. Determine whether the allowed transmission conditions of the EtherCAT protocol message are met based on the slave address, the command type, and the data field value. If the permitted transmission conditions are not met, the transmission of the EtherCAT protocol message is blocked.

2. The method for processing EtherCAT protocol messages according to claim 1, characterized in that, The allowed transmission condition is determined not to be met if any of the following conditions are met: The slave address is not a preset slave address; The command type is not a preset subcommand type; The data field value is not a preset data field value.

3. The method for processing EtherCAT protocol messages according to claim 1, characterized in that, The anomaly detection score of the EtherCAT protocol message determined according to the message detection model includes: Parse and extract the key features of the EtherCAT protocol message; The key features are normalized. The normalized key features are input into the message detection model in a preset order to obtain the anomaly detection score of the EtherCAT protocol message.

4. The method for processing EtherCAT protocol messages according to claim 3, characterized in that, The processing method further includes: After determining the anomaly detection score of the EtherCAT protocol message, the message detection model is updated based on the EtherCAT protocol message and the anomaly detection score of the EtherCAT protocol message.

5. The method for processing EtherCAT protocol messages according to claim 3, characterized in that, The message detection model is constructed through the following steps: Retrieve multiple historical EtherCAT protocol messages; Parse and extract the key historical features of each historical EtherCAT protocol message; The key historical features of each historical EtherCAT protocol message are normalized. A training set is constructed, which includes normalized historical key features corresponding to each historical EtherCAT protocol message. The normalized historical key features of each historical EtherCAT protocol message are arranged in a preset order. The training set is input into a preset convolutional neural network model so that the preset convolutional neural network model outputs an anomaly detection score for each historical EtherCAT protocol message. If the convolutional neural network model meets the preset training completion conditions, the training of the convolutional neural network model is determined to be complete, and the message detection model is obtained.

6. The method for processing EtherCAT protocol messages according to claim 1, characterized in that, The processing method further includes: If the EtherCAT protocol message is abnormal or does not meet the allowed transmission conditions, record the data field values ​​of the sub-messages in the EtherCAT protocol message and the abnormality detection score.

7. A processing apparatus for EtherCAT protocol messages, characterized in that, The device includes: The memory is configured to store instructions; A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the processing method for EtherCAT protocol messages according to any one of claims 1 to 6.

8. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to perform a processing method for EtherCAT protocol messages according to any one of claims 1 to 6.

9. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the processing method for EtherCAT protocol messages according to any one of claims 1 to 6.

Images