Information security detection method, device, equipment and storage medium

Abstract

The present application discloses an information security detection method, apparatus, device and storage medium, the method comprising: continuously monitoring network equipment, capturing its network traffic data in real time, or obtaining network traffic data through active interaction. Then, feature extraction is performed on the network traffic data, and the protocol and device type of the network traffic data are identified based on the extracted traffic features; according to the identified protocol and / or device type, the detection script is scheduled and the execution result of the detection script is obtained. The execution results are integrated into the information database, and finally a comprehensive security assessment is performed. The present application dynamically adapts to changes in the OT environment through this method, thereby overcoming the limitations of network security measures based on static rules and policies.

Description

Technical Field

[0001] The present application relates to the technical field of electronic digital data processing, and in particular to information security detection methods, devices, equipment and storage media. Background Art

[0002] With the rapid development of Industry 4.0 and smart manufacturing, cybersecurity issues in industrial control systems (ICS) and operational technology (OT) scenarios have become particularly prominent. Common cybersecurity measures mainly rely on static rules and policies, which are powerless in the face of rapid changes and evolving cyber threats in OT environments. Static defense strategies are difficult to adapt to the dynamic nature of industrial environments, resulting in high security risks for industrial control equipment. For example, industrial control equipment may be running outdated operating systems and software with known security vulnerabilities, and static defense measures cannot be updated in time to respond to new threats. In addition, the boundaries of OT networks are blurred, which limits the effectiveness of boundary-based defense measures. Cyber ​​attackers exploit these weaknesses to launch complex attacks, such as advanced persistent threats (APTs) and zero-day attacks, which can bypass traditional security protection measures. Therefore, existing cybersecurity measures based on static rules and policies have obvious limitations in adapting to the rapid changes in OT environments and the evolving cyber threats. Summary of the invention

[0003] The main purpose of this application is to provide information security detection methods, devices, equipment and storage media, aiming to solve the technical problem that network security measures based on static rules and policies are difficult to adapt to the rapid changes and evolving network threats in the OT environment.

[0004] To achieve the above object, the present application provides an information security detection method, which includes the following steps:

[0005] Capture traffic of network devices to obtain network traffic data;

[0006] Extracting features from the network traffic data, and identifying the protocol and device type of the network traffic data based on the extracted traffic features;

[0007] Scheduling a detection script and obtaining an execution result of the detection script according to the identified protocol and / or device type;

[0008] A safety assessment report is generated according to the execution result.

[0009] In one embodiment, the step of capturing traffic of a network device and obtaining network traffic data includes:

[0010] Collect network traffic data by continuously monitoring network devices.

[0011] In one embodiment, the step of capturing traffic of the network device and obtaining network traffic data further includes:

[0012] Collect network traffic data by actively interacting with network devices.

[0013] In one embodiment, the step of extracting features from the network traffic data and identifying the protocol and device type of the network traffic data based on the extracted traffic features includes:

[0014] Extracting traffic features by parsing the network traffic data, and constructing feature vectors using the traffic features;

[0015] Using the feature vectors to perform pattern matching to identify known protocols and device types;

[0016] Leverage pre-trained models to identify unknown protocols and device types based on feature vectors.

[0017] In one embodiment, the step of using the feature vector to perform pattern matching to identify known protocols and device types includes:

[0018] The feature vectors are matched against a pre-built pattern library, and known protocols and device types are identified based on the matching results.

[0019] In one embodiment, the step of scheduling the detection script and obtaining the execution result of the detection script according to the identified protocol and / or device type includes:

[0020] Using preset rules, preliminary matching of detection scripts is performed based on identified protocols and / or device types;

[0021] Performing model prediction based on historical network traffic data and current network conditions, and adjusting matching results of the detection script based on the prediction results;

[0022] The matched detection scripts are deployed to the network, the detection scripts are executed in parallel, and the execution results of the detection scripts are obtained.

[0023] In one embodiment, the step of using preset rules to perform preliminary matching of detection scripts according to the identified protocols and / or device types includes:

[0024] Select the corresponding detection script from the pre-built detection script library based on the preset rules triggered by the identified protocol and / or device type.

[0025] In addition, to achieve the above-mentioned purpose, the present application also provides an information security detection device, the information security detection device comprising:

[0026] An acquisition module is used to capture traffic of network devices and obtain network traffic data;

[0027] An identification module, used to extract features from the network traffic data, and identify the protocol and device type of the network traffic data based on the extracted traffic features;

[0028] An execution module, used to schedule the detection script and obtain the execution result of the detection script according to the identified protocol and / or device type;

[0029] An evaluation module is used to generate a security evaluation report based on the execution result.

[0030] In addition, to achieve the above-mentioned purpose, the present application also provides a terminal device, which includes a memory, a processor, and an information security detection program stored on the memory and executable on the processor, and the information security detection program, when executed by the processor, implements the steps of the information security detection method described above.

[0031] In addition, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which an information security detection program is stored, and when the information security detection program is executed by a processor, the steps of the information security detection method described above are implemented.

[0032] One or more technical solutions proposed in this application have at least the following technical effects:

[0033] This application first captures the traffic of network devices to obtain network traffic data. Then, the network traffic data is feature extracted to identify the network traffic data protocol and device type. In the pattern matching stage, feature vectors are compared with pre-built pattern libraries to identify known protocols and device types. Finally, the corresponding detection script is scheduled and executed according to the identified protocol and device type. The execution results will be used to generate a security assessment report to provide decision support for network management and security protection.

[0034] In this way, it can dynamically adapt to changes in the OT environment, such as changes in device configurations, the introduction of new network protocols, etc., thereby overcoming the limitations of network security measures based on static rules and policies. This application not only improves recognition efficiency, but also ensures recognition accuracy, allowing security teams to respond to potential security threats more quickly. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a flowchart of the first exemplary embodiment of the information security detection method of the present application;

[0036] Figure 2A system flow chart of the second exemplary embodiment of information security detection of this application;

[0037] Figure 3 This is a schematic diagram of the module structure of the information security detection device according to an embodiment of the present application;

[0038] Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the information security detection method in the embodiment of the present application.

[0039] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0040] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0041] The main technical solution of this application is: continuously monitor network devices, capture their network traffic data in real time, or obtain network traffic data through active interaction. Then, extract features from the network traffic data, identify the protocol and device type of the network traffic data based on the extracted traffic features; schedule the detection script and obtain the execution result of the detection script according to the identified protocol and / or device type. Integrate the execution results into the information database, and finally conduct a comprehensive security assessment.

[0042] This application actually takes into account that existing network security measures are usually based on static rules and policies, which are difficult to adapt to the rapid changes and evolving network threats in the OT environment. These measures often lack flexibility and adaptability, and cannot respond to new security challenges in a timely manner, resulting in industrial control equipment facing higher security risks. In addition, it is also difficult to accurately identify various devices in the network based on static rules and policies, especially when there are a large number of heterogeneous devices. This not only limits the effectiveness of network security measures, but may also lead to false alarms and missed alarms, thereby reducing the overall security protection capabilities. In the face of emerging security threats, the response speed of existing measures is often not fast enough, and updated protection strategies cannot be deployed in a timely manner, thereby increasing the risk of system attacks.

[0043] Based on this, the embodiment of the present application proposes a solution: capture the traffic of network devices to obtain network traffic data; extract features from the network traffic data, and identify the protocol and device type of the network traffic data based on the extracted traffic features; use preset rules to perform preliminary matching of detection scripts according to the identified protocols and / or device types; perform model prediction based on historical network traffic data and current network conditions, and adjust the matching results of the detection scripts based on the prediction results; deploy the matched detection scripts to the network, execute the detection scripts in parallel and obtain the execution results of the detection scripts. Generate a security assessment report based on the execution results. The embodiment of the present application adapts to changes in the OT environment through dynamic feature extraction and model prediction, identifies changes in device configuration and the introduction of new network protocols, improves the accuracy of identification by executing multiple customized detection scripts in parallel, and significantly improves the response speed through real-time traffic capture and feature extraction, as well as dynamic adjustment based on model prediction.

[0044] Specifically, the following are the detailed steps of the first exemplary embodiment of the information security detection method of this application:

[0045] Reference Figure 1 , Figure 1 This is a flowchart of the first exemplary embodiment of the information security detection method of the present application. In this embodiment, the information security detection method includes steps S10 to S40:

[0046] Step S10, capturing traffic of network devices to obtain network traffic data;

[0047] In a feasible implementation, step S10 may include step S11:

[0048] Step S11, collecting network traffic data by continuously monitoring network devices.

[0049] In a network environment, in order to achieve comprehensive network traffic monitoring and analysis, network devices can be continuously monitored to collect detailed traffic data.

[0050] Specifically, network probes and sensors are deployed at key locations on the network. These devices use advanced technologies such as port mirroring or optical splitters to replicate network traffic in real time and losslessly, ensuring the integrity and accuracy of the data. For example, a probe is installed on each network link. These probes will continuously capture all data packets passing through the network and decode them into an easy-to-read format for subsequent analysis. At the same time, these probes are connected to the background server and database, and the collected data is transmitted to the server in real time for centralized storage and management.

[0051] In addition, basic information such as the number of input bytes and the number of input non-broadcast packets can be collected from the information management library (MIB) of the network device through the SNMP / RMON protocol. Although this information is basic, it provides necessary background data for traffic analysis. Netflow-based traffic monitoring technology can also be used. This technology can provide traffic information based on five tuples (source IP address, destination IP address, source port number, destination port number, protocol type), which helps to distinguish data flows on different logical channels and greatly improves the efficiency of information collection.

[0052] Step S20, extracting features from the network traffic data, and identifying the protocol and device type of the network traffic data based on the extracted traffic features;

[0053] It should be noted that the network traffic data acquired in step S10 is raw traffic data, and a series of data preprocessing processes are required, specifically, removing duplicate and irrelevant data from the captured raw traffic data, reducing noise, and improving the accuracy of analysis. The data is then converted into a unified format for subsequent processing and analysis.

[0054] In a feasible implementation, step S20 may include steps S21 to S23:

[0055] Step S21, extracting traffic features by parsing the network traffic data, and constructing a feature vector using the traffic features;

[0056] First, the network traffic data after the above preprocessing is parsed to extract basic information such as source IP address, destination IP address, source port number, destination port number, protocol type, etc. This basic information is the basis for constructing feature vectors. Further extract the packet size distribution, packet arrival time interval (IAT), sequence number, window size, etc. These features help to distinguish different protocols and device types, and are crucial for identifying network traffic patterns. Further, the protocol used is identified by checking the header information of the packet. For example, the header structure of TCP and UDP packets is different, and the protocol can be identified by analyzing these headers. In addition, the pattern of a specific protocol can be identified by analyzing the payload of the packet. In addition, the extracted features can be statistically analyzed to calculate statistics such as mean, variance, standard deviation, etc. These statistical features help to identify traffic patterns and anomalies.

[0057] By combining the above features, the "fingerprint" of the device is constructed. The device fingerprint is a set of unique features that can be used to identify and distinguish different devices. Finally, all the extracted features are integrated into a feature vector, which will be used as the input of the model for subsequent protocol and device type classification.

[0058] For example, if the feature extraction results of a piece of network traffic data are as follows: source IP address: 192.168.1.10, destination IP address: 8.8.8.8, source port number: 12345, destination port number: 80, protocol type: TCP, data packet size distribution: mainly concentrated in 500-1000 bytes, data packet arrival time interval (IAT): average value is 0.01 seconds, variance is 0.0001, sequence number: continuously increasing, window size: 2048 bytes, protocol identification: TCP protocol, payload analysis: contains HTTP request header information, statistical characteristics: the average data packet size is 750 bytes, and the standard deviation is 150 bytes.

[0059] Based on the extracted features, a feature vector is constructed for each piece of network traffic data. Each element in the feature vector represents a feature value extracted above. For example, for the above sample data, the feature vector may be as follows:

[0060] [192.168.1.10,8.8.8.8,12345,80,'TCP',[500,1000],0.01,0.0001,continuously increasing,2048,'TCP','HTTP',750,150].

[0061] Step S22, using the feature vector to perform pattern matching to identify known protocols and device types;

[0062] In a feasible implementation, step S22 may include step S221:

[0063] Step S221, matching the feature vector with a pre-built pattern library, and identifying known protocols and device types based on the matching results.

[0064] Specifically, the feature vector is first used to match with a pre-built pattern library. The pattern library contains feature templates of known protocols and device types. Matching is performed by calculating the similarity or distance between each feature vector and each pattern in the pattern library. This process involves selecting appropriate similarity metrics, such as Euclidean distance, cosine similarity, Jaccard similarity coefficient, etc., which can quantify the difference between the feature vector and the pattern. The purpose of calculating similarity or distance is to evaluate the degree of match between the feature vector and the pattern in the pattern library, so as to identify the most likely protocol and device type.

[0065] In the pattern matching process, a threshold is pre-set to determine the matching degree between the feature vector and the pattern in the pattern library. If the similarity exceeds this threshold, the match is considered successful and the corresponding protocol and device type are identified.

[0066] If the similarity between multiple patterns and the feature vector exceeds the threshold, the matching results are sorted according to the similarity, and the pattern with the highest similarity is selected as the recognition result.

[0067] Exemplarily, a piece of network traffic data is captured, and the following feature vector is extracted: [source IP address: 192.168.1.10, destination IP address: 8.8.8.8, source port number: 12345, destination port number: 80, protocol type: TCP, packet size distribution: [500, 1000], packet arrival time interval (IAT): 0.01 seconds, sequence number: continuously increasing, window size: 2048 bytes, payload: contains HTTP request header information].

[0068] Match this feature vector with the feature template in the pattern library. Specifically, traverse all feature templates in the pattern library and calculate the similarity between the feature vector and each feature template. Assume that there is a feature template in the pattern library that is very similar to the characteristics of the HTTP protocol and a certain web server device. Select cosine similarity as the measurement method. Cosine similarity is an indicator that measures the consistency of the directions of two vectors, and its value is between -1 and 1. When the directions of the two vectors are exactly the same, the cosine similarity is 1; when the directions of the two vectors are completely opposite, the cosine similarity is -1; when the two vectors are orthogonal, the cosine similarity is 0.

[0069] For feature vectors and feature templates, they can be regarded as two points or two vectors in a high-dimensional space. To calculate the cosine similarity between them is to calculate the cosine value of the angle between the two vectors. The specific calculation process is as follows: express the feature vector and feature template in mathematical vector form, that is, a set of a series of numerical values; calculate the dot product of the two vectors (that is, the corresponding elements are multiplied and summed); calculate the modulus of the two vectors (that is, the length of the vector, which can be obtained by summing the square of each element in the vector and then taking the square root); divide the dot product by the product of the moduli of the two vectors to obtain the cosine similarity. In this case, the cosine similarity between the feature vector and a feature template in the pattern library is calculated to be 0.95. In this case, the similarity score between the feature vector and a feature template is 0.95, which exceeds the threshold of 0.8, so the match is successful.

[0070] If the similarity between multiple feature templates and feature vectors exceeds the threshold, the matching results need to be sorted according to the similarity score. The specific steps are as follows: Sort all successfully matched feature templates from high to low according to the similarity score; select the feature template with the highest similarity score as the final recognition result. In this case, only one feature template has a similarity score that exceeds the threshold, so there is no need to sort.

[0071] Therefore, the feature vector is successfully matched, and it is identified that the network traffic data belongs to the HTTP protocol and is likely generated by a Web server device.

[0072] Step S23, using the pre-trained model, identifying unknown protocols and device types according to the feature vectors.

[0073] It should be noted that a pre-trained model is used to identify unknown protocols and device types in network traffic. The above model is a machine learning model that does not rely on preset rules and can learn and identify complex patterns from large amounts of data, discover hidden correlations and abnormal behaviors, making it particularly suitable for identifying new or unknown protocols and devices.

[0074] During the implementation, the captured network traffic data is first converted into feature vectors and then input into a pre-trained machine learning model. The model classifies the feature vectors based on the learned patterns and identifies unknown protocols and device types.

[0075] For example, a support vector machine (SVM) algorithm can be used to perform a preliminary classification of devices. SVM is a powerful classifier that can find the optimal decision boundary in a high-dimensional space to distinguish between different categories. During the model training process, SVM can learn complex patterns of traffic, such as packet size, arrival time interval, protocol header information, etc., and associate these patterns with known protocols and device types. Through continuous iteration and optimization, the SVM model can gradually improve the accuracy of classification.

[0076] When new network traffic data is captured and converted into feature vectors, these feature vectors are fed into the pre-trained SVM model. The SVM model classifies the feature vectors based on the learned patterns and preliminarily identifies possible protocols and device types.

[0077] It should be noted that due to the complexity and diversity of network traffic, the preliminary classification results may have certain errors. In particular, for those devices with overlapping classifications, that is, their feature vectors are near the decision boundary of SVM, the preliminary classification results may not be accurate enough.

[0078] In order to further improve the accuracy of recognition, a cosine similarity calculation module can be used for secondary classification. Cosine similarity is a method to measure the similarity between two vectors, which evaluates their similarity by calculating the angle between the vectors.

[0079] For devices with overlapping classifications in the preliminary classification results, their feature vectors are calculated for cosine similarity with known feature templates in the pattern library, and a threshold is set to determine the degree of match. If the similarity score between a feature vector and a feature template exceeds the threshold, the match is considered successful, and the corresponding protocol and device type are identified.

[0080] Finally, the results of the preliminary classification and the secondary classification are combined to make a final judgment on the unknown protocol and device type. If the results of the preliminary classification and the secondary classification are consistent, the result is output as the final recognition result. If the two are inconsistent, it may be necessary to further analyze the feature vector and the feature template in the pattern library to find a more accurate matching result.

[0081] In summary, feature extraction provides basic data, pattern matching processes known protocols, and machine learning classification processes unknown or newly emerging protocols. The three complement each other and jointly improve the accuracy and efficiency of recognition.

[0082] Step S30, scheduling the detection script and obtaining the execution result of the detection script according to the identified protocol and / or device type;

[0083] In a feasible implementation, step S30 may include steps S31 to S33:

[0084] Step S31, using preset rules, performing preliminary matching of detection scripts according to the identified protocols and / or device types;

[0085] In a feasible implementation, step S31 may include step S311:

[0086] Step S311 : selecting a corresponding detection script from a pre-built detection script library according to preset rules triggered by the identified protocol and / or device type.

[0087] Specifically, the rule engine is activated. The core function of the rule engine is based on a series of predefined rules that cover various device types and protocol characteristics and specify corresponding detection scripts.

[0088] Once the protocol and device type of the network traffic are identified, the rule engine begins the matching process, comparing the characteristics of the network traffic with the conditions in the rules one by one in a preset order or priority.

[0089] During the matching process, if there are multiple rules applicable to the same network traffic, the rule engine will sort the rules according to their priorities and select the rule with the highest priority. At the same time, the rule engine also needs to handle possible rule conflicts to ensure that the wrong detection script is not selected due to inconsistencies between rules.

[0090] When a matching rule is found, the rule engine retrieves the corresponding script from the pre-built detection script library based on the detection script information specified in the rule. These scripts are usually written in a specific programming language (such as Python, Bash, etc.) and contain analysis logic and detection actions for specific threats or protocols.

[0091] For example, if a rule is defined in the rule engine, when traffic is detected to be coming from a smart home device and the device is communicating using a specific IoT protocol (such as MQTT), a specific detection script should be selected to deeply analyze its communication behavior. When network traffic is identified as a specific protocol or device type, the rule engine starts the matching process. Check the preset rules one by one to find entries that match the network traffic characteristics. This process is automated and can match a large number of rules in a very short time. When a matching rule is found, the corresponding script is retrieved from the pre-built detection script library based on the detection script information specified in the rule. These scripts are specially designed to respond to specific threats or analyze specific protocols and devices, and can perform more in-depth and accurate network detection.

[0092] For example, if the rule engine determines that the network traffic comes from a web server using the HTTP protocol and that the server has recently suffered multiple DDoS attacks, it may select a detection script specifically designed to detect signs of DDoS attacks in HTTP traffic. This script will deeply analyze the characteristics of HTTP requests and look for possible attack patterns, such as abnormal request rates, request header information, etc.

[0093] Step S32, performing model prediction according to historical network traffic data and current network conditions, and adjusting the matching result of the detection script based on the prediction result;

[0094] First, collect historical data for model training and learn the mapping relationship from features to protocols and device types. Specifically, collect historical network traffic data, which includes but is not limited to traffic features, protocol types, device types, and any known security events. Then preprocess the collected data, including cleaning data, processing missing values, and converting data into a format suitable for model input. During the preprocessing process, extract features from the raw data that help the model identify protocols and device types, such as packet size, transmission time, port number, and specific protocol header information. Use the preprocessed data to train the model, and evaluate the performance of the model through cross-validation, accuracy, recall, and other indicators.

[0095] Furthermore, the model with the best performance is selected for actual detection script scheduling, and the selection of the detection script is dynamically adjusted according to the prediction results of the model and the current network conditions.

[0096] For example, assuming that a network traffic data packet is identified as conforming to the characteristics of the HTTP protocol, and the source device type is determined to be a smartphone, a detection script specifically for the HTTP protocol and smartphone device type is selected from a pre-built detection script library according to preset rules. These scripts may contain logic for detailed inspection of HTTP request headers, response content, and network behavior patterns unique to smartphones, in order to more accurately detect potential anomalies or security threats. Similarly, if the likelihood of a particular type of network attack (such as a DDoS attack) is predicted to increase, then even if the protocol and device type do not directly point to this attack, the preset rules may also include detection script selection logic based on attack pattern recognition, thereby giving priority to scheduling detection scripts for DDoS attacks, and achieving dynamic and accurate network security monitoring and response.

[0097] Step S33, deploying the matched detection script to the network, executing the detection script in parallel and obtaining the execution result of the detection script.

[0098] Based on the preset rules triggered by the rule engine and the dynamic adjustment of the detection script after model prediction, the best execution script is obtained, and the detection script that matches the identified protocol and / or device type is automatically selected from the pre-built detection script library and deployed to the network environment. The deployment process is automated without manual intervention, which significantly improves the efficiency and response speed of operations. Once the detection scripts are successfully deployed, they are immediately executed in parallel.

[0099] For example, if it is identified that a certain network traffic meets the characteristics of the HTTP protocol, and the source device is determined to be a smart router, a detection script specifically for the HTTP protocol and smart router device type is selected for deployment and execution. These scripts will deeply analyze the header fields of the HTTP request, the response content, and the network behavior patterns unique to the smart router, so as to accurately discover potential security threats or abnormal behaviors. By executing multiple detection scripts in parallel, the network can be deeply detected from different angles at the same time, which not only improves the comprehensiveness of the detection, but also significantly enhances the system's adaptability to complex network environments and the accuracy of security assessments.

[0100] Step S40: Generate a security assessment report based on the execution result.

[0101] Specifically, the execution results obtained by the parallel execution of the detection scripts are summarized and integrated. These execution results contain in-depth detection information for different protocols and device types in the network, reflecting the current operation status of the network and potential security risks. Subsequently, according to the preset security assessment standards and logic, these execution results are comprehensively analyzed to identify existing security vulnerabilities, abnormal behaviors or potential threats.

[0102] Specifically, comprehensive analysis may include: checking whether the scan results contain indications of known vulnerabilities, such as specific port openings, service version information, etc.; evaluating whether the configuration of network equipment and systems meets security baseline standards, such as firewall rules and password policies; identifying abnormal behaviors that do not match normal behavior patterns by monitoring and analyzing network traffic, logs and other data, such as unauthorized access attempts and data leaks; matching traffic, logs and other data in the network with threat intelligence to check whether there are known malicious behaviors or attack patterns.

[0103] On this basis, security vulnerabilities, abnormal behaviors or potential threats in the network can be identified, and a detailed security assessment report can be generated based on the identified security issues. The report not only lists all detected assets and their security status, but also provides a detailed description of the identified security issues, possible impact analysis, and recommended repair measures.

[0104] For example, if a smart home device is detected to have unauthorized access risk when communicating using the MQTT protocol, the security assessment report will clearly indicate the device's IP address, MAC address, department, and other detailed information, and provide a specific description of the risk, possible consequences, and recommended repair steps, such as upgrading device firmware, changing default passwords, or configuring access control lists. In addition, the system will instantly update asset information in the database to ensure that all device information is up-to-date and accurate, providing a solid foundation for subsequent asset management and security monitoring.

[0105] Further, based on Figure 1 In the second exemplary embodiment of the present application, step S10: capturing traffic of the network device, and the step of obtaining network traffic data further includes step S12:

[0106] Step S12, collecting network traffic data by actively interacting with network devices.

[0107] Please refer to Figure 2 , Figure 2 This is a system flow chart involved in the second exemplary embodiment of information security detection of this application.

[0108] It should be noted that active interaction is necessary when the system needs to obtain more detailed or in-depth information. For example, some devices may hide specific services or ports that may not be easily discovered in ordinary continuous monitoring. Through active detection, the system can send specific requests or data packets to trigger a response from the target device, thereby revealing hidden information. In addition, when a security incident occurs, such as detecting suspicious network activity or abnormal system behavior, the system may need to actively interact with the target device to collect more information or perform specific response actions. This helps to quickly locate the problem, assess the scope of impact, and take appropriate measures to mitigate or eliminate the threat.

[0109] Specifically, when the system detects suspicious network activities, abnormal system behaviors, or in order to obtain more detailed and in-depth network traffic information, it will trigger the need for active interaction. The detection server triggers the response of the target device by sending specific requests or data packets to the target device. These requests or data packets may be detections of specific services or ports that may be hidden by the target device to reveal hidden information. After receiving the request, the target device will return the corresponding response data, including network traffic data.

[0110] Furthermore, the collected network traffic data is preprocessed to remove duplicate and irrelevant data, reduce noise, and convert the data into a unified format. Feature extraction is performed on the preprocessed network traffic data to extract basic information such as source IP address, destination IP address, source port number, destination port number, protocol type, etc., and a feature vector is constructed. The feature vector is used for pattern matching and compared with a pre-built pattern library to identify known protocols and device types. For unknown protocols and device types, a pre-trained machine learning model is used for identification. According to the identified protocol and / or device type, the preset rules are triggered and the corresponding detection script is selected from the pre-built detection script library.

[0111] Based on predefined rules, the network traffic characteristics are matched with the conditions in the rules according to the priority and order, and the most appropriate detection script is selected. Furthermore, historical network traffic data and current network conditions are collected to perform model prediction. Based on the prediction results, the matching results of the detection script are dynamically adjusted to ensure that the selected detection script is more accurate and effective.

[0112] Deploy the matched detection scripts to the network and execute them in parallel. The detection scripts deeply analyze the network behavior patterns of the target devices to find potential security threats or abnormal behaviors. Based on the execution results of the detection scripts, update the device information, protocol type, security status, etc. in the asset information library. Ensure the accuracy and completeness of asset information, and provide a solid foundation for subsequent security monitoring and management.

[0113] Summarize and integrate the execution results obtained by the parallel execution of the detection scripts. These execution results contain in-depth detection information for different protocols and device types in the network, reflecting the current operation status of the network and potential security risks. According to the preset security assessment standards and logic, the execution results are comprehensively analyzed. Identify existing security vulnerabilities, abnormal behaviors or potential threats, and generate a detailed security assessment report. The report includes the detected assets and their security status, a detailed description of the security issues, possible impact analysis, and recommended remediation measures.

[0114] In summary, the embodiment of the present application realizes intelligent security detection and assessment of target devices through multiple steps such as actively and interactively collecting network traffic data, deeply analyzing data, scheduling and executing detection scripts, updating asset information, and conducting comprehensive security assessment. This method improves the accuracy and efficiency of network security monitoring and provides strong support for network security protection.

[0115] In addition, the present application also proposes an information security detection device, which includes:

[0116] The acquisition module 10 is used to capture the traffic of the network device and obtain the network traffic data;

[0117] An identification module 20, configured to extract features from the network traffic data and identify the protocol and device type of the network traffic data based on the extracted traffic features;

[0118] An execution module 30, configured to schedule a detection script and obtain an execution result of the detection script according to the identified protocol and / or device type;

[0119] The evaluation module 40 is used to generate a security evaluation report according to the execution result.

[0120] The information security detection device provided by the present application adopts the information security detection method in the above-mentioned embodiment, aiming to solve the technical problem that network security measures based on static rules and policies are difficult to adapt to the rapidly changing and evolving network threats in the OT environment. Compared with the prior art, the beneficial effects of the information security detection device provided by the present application are the same as the beneficial effects of the information security detection method provided by the above-mentioned embodiment, and the other technical features in the information security detection device are the same as the features disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0121] The present application provides an information security detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the information security detection method in the above-mentioned embodiment one.

[0122] The information security detection equipment in the embodiments of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., as well as fixed terminals such as digital TVs, desktop computers, etc. Figure 4 The information security detection device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0123] like Figure 4 As shown, the information security detection device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the information security detection device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the information security detection device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an information security detection device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0124] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0125] The information security detection device provided by the present application adopts the information security detection method in the above embodiment, aiming to solve the technical problem that network security measures based on static rules and policies are difficult to adapt to the rapidly changing and evolving network threats in the OT environment. Compared with the prior art, the beneficial effects of the information security detection device provided by the present application are the same as the beneficial effects of the information security detection method provided by the above embodiment, and the other technical features in the information security detection device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0126] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0127] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0128] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, wherein the computer-readable program instructions are used to execute the information security detection method in the above-mentioned embodiment.

[0129] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0130] The computer-readable storage medium may be included in the information security detection device; or may exist independently without being assembled into the information security detection device.

[0131] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0132] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0133] The modules involved in the embodiments described in the present application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0134] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned information security detection method, and is intended to solve the technical problem that network security measures based on static rules and policies are difficult to adapt to the rapidly changing and evolving network threats in the OT environment. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the information security detection method provided in the above-mentioned embodiment, and will not be repeated here.

[0135] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned information security detection method when executed by a processor.

[0136] The computer program product provided by this application is intended to solve the technical problem that network security measures based on static rules and policies are difficult to adapt to the rapidly changing and evolving network threats in the OT environment. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the information security detection method provided by the above embodiment, which will not be repeated here.

[0137] Compared with the prior art, the information security detection method, device, equipment, medium and computer product proposed in the embodiment of the present application extracts the business feature information of the target business, performs data standardization processing on the business feature information, obtains standard feature data, performs hash processing on the standard feature data, obtains unique feature data, performs numerical processing and splicing processing on the unique feature data, obtains the first business feature value, accumulates the first business feature value of the target business, obtains the target business feature value, and finally compares the target business feature value with the feature value set to obtain the information security detection result. Compared with the traditional method of identifying duplicate businesses by generating a unique key value or a continuous serial number for each business, it is more efficient, flexible and reliable. Based on the solution of the present application, by subjecting the business of complex scenarios to a series of simple transformations and finally converting it into a comparison of two numbers, the comparison process is very intuitive and efficient. The system only needs to simply compare whether the two values ​​are equal to quickly determine whether the two businesses are exactly the same.

[0138] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0139] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0140] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, a controlled terminal, or a network device, etc.) to execute the method of each embodiment of the present application.

[0141] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. An information security detection method, characterized in that: The information security detection method comprises: Capture traffic of network devices to obtain network traffic data; Extracting features from the network traffic data, and identifying the protocol and device type of the network traffic data based on the extracted traffic features; Scheduling a detection script and obtaining an execution result of the detection script according to the identified protocol and / or device type; A safety assessment report is generated according to the execution result.

2. The information security detection method according to claim 1, characterized in that: The step of capturing the traffic of the network device and obtaining the network traffic data comprises: Collect network traffic data by continuously monitoring network devices.

3. The information security detection method according to claim 1, characterized in that: The step of capturing the traffic of the network device and obtaining the network traffic data also includes: Collect network traffic data by actively interacting with network devices.

4. The information security detection method according to claim 1, characterized in that: The step of extracting features from the network traffic data and identifying the protocol and device type of the network traffic data based on the extracted traffic features includes: Extracting traffic features by parsing the network traffic data, and constructing feature vectors using the traffic features; Using the feature vectors to perform pattern matching to identify known protocols and device types; Leverage pre-trained models to identify unknown protocols and device types based on feature vectors.

5. The information security detection method according to claim 4, characterized in that: The step of using the feature vector to perform pattern matching and identify known protocols and device types includes: The feature vectors are matched against a pre-built pattern library, and known protocols and device types are identified based on the matching results.

6. The information security detection method according to claim 1, characterized in that: The step of scheduling the detection script and obtaining the execution result of the detection script according to the identified protocol and / or device type includes: Using preset rules, preliminary matching of detection scripts is performed based on identified protocols and / or device types; Performing model prediction based on historical network traffic data and current network conditions, and adjusting matching results of the detection script based on the prediction results; The matched detection scripts are deployed to the network, the detection scripts are executed in parallel, and the execution results of the detection scripts are obtained.

7. The information security detection method according to claim 6, characterized in that: The step of using preset rules to perform preliminary matching of detection scripts according to the identified protocols and / or device types includes: Select the corresponding detection script from the pre-built detection script library based on the preset rules triggered by the identified protocol and / or device type.

8. An information security detection device, characterized in that: The device comprises: An acquisition module is used to capture traffic of network devices and obtain network traffic data; An identification module, used to extract features from the network traffic data, and identify the protocol and device type of the network traffic data based on the extracted traffic features; An execution module, used to schedule the detection script and obtain the execution result of the detection script according to the identified protocol and / or device type; An evaluation module is used to generate a security evaluation report based on the execution result.

9. An information security detection device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the information security detection method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the information security detection method according to any one of claims 1 to 7 are implemented.

Images