Risk detection method and device for industrial control network, medium and electronic equipment

Abstract

The invention provides a risk detection method and device for an industrial control network, a medium and electronic equipment. The method comprises the following steps: acquiring first attribute information of at least one device in an industrial control network, and determining firmware risk information of the device according to the first attribute information; the first attribute information is used for determining each device in the industrial control network; determining traffic risk information in the industrial control network according to the traffic data in the industrial control network; detecting configuration information and a running state of the equipment according to the first attribute information; and determining risk data of the equipment based on the firmware risk information and the traffic risk information of the equipment and the running state and the configuration information of the equipment. By analyzing and detecting the real attributes and the flow data of the devices in the industrial control network, the overall risk of each device in the industrial control network is determined, and the accuracy of detecting the risk information in the industrial control network is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of industrial control technology, and in particular to a risk detection method, device, medium and electronic equipment for an industrial control network. Background Art

[0002] Security is of vital importance in industrial control systems, especially in the fields of modern intelligent manufacturing and automated production. Any security loopholes may lead to production accidents, equipment damage, and even endanger personnel safety. Therefore, risk detection of industrial control networks is crucial.

[0003] In related technologies, risk detection of industrial control networks mainly simulates the existing network environment through simulation or virtual systems, and performs risk assessment related operations in risk assessment scenarios. However, simulation can never completely replicate on-site business and environment, and the simulation environment itself may also have vulnerabilities belonging to the environment itself, which can easily lead to deviations in risk assessment results. Summary of the invention

[0004] In view of this, the present disclosure provides a risk detection method, device, medium and electronic device for an industrial control network, which can improve the accuracy of risk detection in the industrial control network.

[0005] According to a first aspect of an embodiment of the present disclosure, a risk detection method for an industrial control network is provided, the method comprising:

[0006] Acquire first attribute information of at least one device in the industrial control network, and determine firmware risk information of the device based on the first attribute information; the first attribute information is used to determine each device in the industrial control network;

[0007] Determining traffic risk information in the industrial control network based on traffic data in the industrial control network;

[0008] Detecting configuration information and operating status of the device according to the first attribute information;

[0009] Based on the firmware risk information, traffic risk information, and the operating status and configuration information of the device, risk data of the device is determined.

[0010] In one embodiment, obtaining first attribute information of at least one device in the industrial control network includes:

[0011] Sending a detection message to a device in the industrial control network;

[0012] A response message of the device to the detection message is received, and first attribute information of the device carried in the response message is acquired.

[0013] In one embodiment, determining the firmware risk information of the device according to the first attribute information includes:

[0014] Determining a version model of the device according to the first attribute information of the device;

[0015] Based on the version model and a first corresponding relationship, the firmware risk information of the device is determined; the first corresponding relationship is a corresponding relationship between the version model and the firmware risk.

[0016] In one embodiment, determining the traffic risk information in the industrial control network according to the traffic data includes:

[0017] parsing the traffic data;

[0018] If there is target traffic in the traffic data, the traffic risk information in the industrial control network is determined based on the target traffic; the target traffic is traffic including target features, and the target features include at least one of the following: write operation instructions, network attack features, and network virus features.

[0019] In one embodiment, detecting the configuration information and the operating status of the device according to the first attribute information includes:

[0020] Determine the device type and the operating system information of the device according to the first attribute information, and detect the configuration information of the device based on the device type and the operating system information;

[0021] A survival detection mode of the device is determined according to the type of the device, and an operating state of the device is determined based on the survival detection mode.

[0022] In one embodiment, the detecting the configuration information of the device based on the device type and the operating system information includes:

[0023] Determining a configuration standard of the device according to the device type and the operating system of the device;

[0024] Based on the configuration standard, the configuration information of the device is detected.

[0025] In one embodiment, the method further comprises:

[0026] In response to the presence of second attribute information in the traffic data, the firmware risk information of the device corresponding to the second attribute information is determined, wherein the second attribute information is attribute information in the industrial control network except the first attribute information.

[0027] According to a second aspect of an embodiment of the present disclosure, a risk detection device for an industrial control network is provided, the device comprising:

[0028] An acquisition unit, configured to acquire first attribute information of at least one device in the industrial control network, and determine firmware risk information of the device according to the first attribute information; the first attribute information is used to determine each device in the industrial control network;

[0029] A first determining unit, configured to determine flow risk information in the industrial control network according to flow data in the industrial control network;

[0030] a detection unit, configured to detect configuration information and an operating state of the device according to the first attribute information;

[0031] The second determining unit is used to determine the risk data of the device based on the firmware risk information, traffic risk information of the device, and the operating state and configuration information of the device.

[0032] In one embodiment, the acquisition unit is used to:

[0033] Sending a detection message to a device in the industrial control network;

[0034] A response message of the device to the detection message is received, and first attribute information of the device carried in the response message is acquired.

[0035] In one embodiment, the acquisition unit is used to:

[0036] Determining a version model of the device according to the first attribute information of the device;

[0037] Based on the version model and a first corresponding relationship, the firmware risk information of the device is determined; the first corresponding relationship is a corresponding relationship between the version model and the firmware risk.

[0038] In one embodiment, the first determining unit is configured to:

[0039] parsing the traffic data;

[0040] If there is target traffic in the traffic data, the traffic risk information in the industrial control network is determined based on the target traffic; the target traffic is traffic including target features, and the target features include at least one of the following: write operation instructions, network attack features, and network virus features.

[0041] In one embodiment, the detection unit is used to:

[0042] Determine the device type and the operating system information of the device according to the first attribute information, and detect the configuration information of the device based on the device type and the operating system information;

[0043] A survival detection mode of the device is determined according to the type of the device, and an operating state of the device is determined based on the survival detection mode.

[0044] In one embodiment, the detection unit is used to:

[0045] Determining a configuration standard of the device according to the device type and the operating system of the device;

[0046] Based on the configuration standard, the configuration information of the device is detected.

[0047] In one embodiment, the device further comprises:

[0048] The third determination unit is used to determine the firmware risk information of the device corresponding to the second attribute information in response to the second attribute information existing in the traffic data, wherein the second attribute information is the attribute information in the industrial control network except the first attribute information.

[0049] According to a third aspect of an embodiment of the present disclosure, there is provided a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0050] According to a fourth aspect of an embodiment of the present disclosure, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in the first aspect when executing the program.

[0051] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0052] By analyzing and detecting the real attributes and flow data of devices in the industrial control network, the overall risk of each device in the industrial control network is determined, thereby improving the accuracy of detecting risk information in the industrial control network. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 is a schematic diagram of a risk analysis system shown in an exemplary embodiment of the present disclosure;

[0054] Figure 2 is a flow chart of a risk detection method for an industrial control network shown in an exemplary embodiment of the present disclosure;

[0055] Figure 3is a flowchart of obtaining first attribute information shown in an exemplary embodiment of the present disclosure;

[0056] Figure 4 is a flowchart of detecting firmware risk information shown in an exemplary embodiment of the present disclosure;

[0057] Figure 5 is a flow chart showing a method of determining traffic risk information according to an exemplary embodiment of the present disclosure;

[0058] Figure 6 is a flow chart of detecting configuration information shown in an exemplary embodiment of the present disclosure;

[0059] Figure 7 is a block diagram of a risk detection device for an industrial control network shown in an exemplary embodiment of the present disclosure;

[0060] Figure 8 It is a hardware structure diagram of an electronic device shown in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0061] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0062] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms of "a", "said" and "the" used in this disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0063] It should be understood that although the terms first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0064] Industrial control risks refer to various potential threats and vulnerabilities in industrial control systems that may affect system security, reliability and normal operation. Industrial control systems are widely used in critical infrastructure such as manufacturing, energy, transportation, water treatment, etc., so risk management of industrial control systems is crucial.

[0065] However, since most of the equipment in the industrial control network is industrial equipment, the processing capacity of the industrial equipment itself is relatively weak. If the industrial control network is tested for risks by introducing traffic into the industrial control network, it will cause the industrial control network to carry too much traffic, which may easily cause the industrial control network to be paralyzed. Therefore, in related technologies, simulation or virtual systems are usually used to simulate the existing network environment, and risk assessment related operations are performed in risk assessment scenarios. However, simulation can never completely replicate the on-site business and environment, and the simulated environment itself may also have vulnerabilities that belong to the environment itself, and the risk assessment results are prone to deviations.

[0066] Through the analysis and research of industrial control networks, it is determined that the risks currently faced by industrial control networks include the following categories:

[0067] Software and firmware vulnerabilities in the equipment itself. Industrial control equipment and the computers used for control may have software or firmware vulnerabilities. These vulnerabilities may be due to the manufacturer's failure to release patches or updates in a timely manner, or the failure to consider security when designing the device firmware. Attackers can use these vulnerabilities to remotely invade, bypass authentication mechanisms, and access equipment or control systems.

[0068] Network security risks in the transmission process of industrial control networks. Equipment and computers in industrial control systems are usually connected through networks (such as Ethernet, Wi-Fi, serial communication, etc.). Security risks in the data transmission process include man-in-the-middle attacks, data packet interception, unencrypted transmission, etc.

[0069] Risks caused by on-site misoperation: Misoperation by on-site staff may pose a serious threat to the safety of industrial control systems. Misoperation may include incorrect equipment settings, incorrect parameter input, incorrect operation commands, etc. For example, misoperation may cause the safety valve to close, resulting in the equipment being unable to protect properly, and then causing fires, explosions, etc.

[0070] The risk of disconnection caused by equipment anomalies: Equipment in industrial control systems may go offline or fail to work properly due to hardware failure, software crash, network interruption, etc. Such disconnection or anomalies may cause the system to be unable to monitor or control on-site equipment normally, thereby affecting production efficiency or safety.

[0071] Security vulnerability risks introduced due to configuration reasons. Misconfiguration or improper configuration is the root cause of many security vulnerabilities, including the default settings of the device not being modified, too many ports being open, weak passwords being used, improper permissions being set, etc. For example, incorrectly configured permissions may allow ordinary users to obtain excessive permissions and perform malicious operations.

[0072] Therefore, the security of industrial control systems not only depends on the security of the equipment itself, but also needs to consider comprehensive protection from hardware, software to operation and configuration.

[0073] Based on this, the present disclosure provides a risk detection method for an industrial control network. The method can be applied to terminal devices such as computers, and the device data and information in the industrial control network are obtained by the computer to perform risk detection on the industrial control network.

[0074] The method can also be applied to a risk analysis system, which runs in a terminal device such as a computer, obtains device data and information in an industrial control network through the risk analysis system, and analyzes and detects risks in the industrial control network. Figure 1 . Among them, the active detection module 101 is used to detect the first attribute information of the device in the industrial control network, and determine the firmware risk information of each device by version matching based on the first attribute information of the device. The passive detection module 102 is used to obtain the flow data transmitted to the system through the switch, perform risk detection on the flow in the industrial control network, and determine the flow risk information in the industrial control network. The protocol configuration verification module 103 is used to check whether there are risks in the configuration items of the devices in the industrial control network and determine the configuration information of the devices. The status detection module 104 can detect the port of the device through the minimum survival detection method satisfied by the device to determine the operating status of the device. Finally, the detection information of the above four modules will be recorded in the asset risk module 105, and the risk information existing in the industrial control network can be determined through the asset risk module 105.

[0075] The following is an example of an industrial control network risk detection method. Figure 2 As shown in the flow chart, Figure 2 is a flow chart of a risk detection method for an industrial control network shown in an exemplary embodiment of the present disclosure, and the flow chart includes:

[0076] S201, obtaining first attribute information of at least one device in an industrial control network, and determining firmware risk information of the device according to the first attribute information.

[0077] The first attribute information is used to identify each device in the industrial control network. The first attribute information includes at least the IP information, manufacturer information and model of the device. The firmware risk information refers to the firmware vulnerability information carried by the device itself. For example, if a certain model of PLC (Programmable Logic Controller) does not encrypt the firmware, then the attacker can obtain the firmware through physical access to the device or network attack, and then modify its function or destroy the device. Firmware vulnerabilities such as this, which already exist when the device is designed and cannot be improved, are the firmware risk information that needs to be detected in this step.

[0078] When detecting firmware risk information, you can first scan the device through the active detection module in the risk analysis system to obtain identification information such as the device's fingerprint information or IP information, and then determine the first attribute information of the device based on the identification information, and then determine the firmware risk information corresponding to the first attribute information based on the preset vulnerability risk library.

[0079] In one embodiment, the Figure 3 As shown in the flowchart, obtaining the first attribute information, the specific steps include:

[0080] S301: Send a detection message to a device in the industrial control network.

[0081] S302: Receive a response message from the device to the detection message, and obtain first attribute information of the device carried in the response message.

[0082] When obtaining the first attribute information, the port of the device in the industrial control system is first detected through the risk analysis system, and then the fingerprint information of the device is obtained according to the port, and finally the first attribute information of the device is determined according to the fingerprint information.

[0083] Specifically, a detection message can be sent to the port of the device in the industrial control network through the active detection module in the risk analysis system. According to the response of the device port, determine whether the device port is in a survival state. If the device port does not return a response message to the detection message, it means that the status of the device is not alive, and the status of the device is recorded in the ledger of the asset risk module. If the risk analysis system receives a response message returned by the device port, it means that the device is in a survival state. Then parse the response message, and according to the message parsing result, determine the fingerprint information of the device in the preset fingerprint information library, and finally query the manufacturer and model information corresponding to the fingerprint information in the preset information library according to the fingerprint information.

[0084] At this point, the first attribute information such as IP, manufacturer and model of each device in the industrial control network can be determined. In order to facilitate the subsequent risk detection steps, the first attribute information can be recorded in the ledger of the asset risk module. The firmware risk of the device will be detected based on the first attribute information. Because the device being detected is in the industrial control network, based on the relatively weak processing power of the devices in the industrial control network, the firmware risk information of the device will be detected by version matching to avoid the problem of introducing irrelevant traffic into the industrial control network and causing the industrial control network to crash. For the process of detecting firmware risk information, please refer to Figure 4 The flowchart shown includes at least the following steps:

[0085] S401: Determine a version model of the device according to first attribute information of the device.

[0086] S402: Determine firmware risk information of the device based on the version model and the first corresponding relationship.

[0087] The first corresponding relationship is the corresponding relationship between the version model and the firmware risk. As can be seen from the foregoing content, the first attribute information includes information such as device IP, manufacturer and model, so the version model of the device can be determined based on the first attribute information. After determining the version model of the device, the active detection module can further determine whether the current device is an industrial control device. This is because there are many types of devices in the industrial control network, such as industrial control equipment, terminals, security equipment or host computers. The firmware vulnerabilities of industrial control equipment will directly affect the working safety of the industrial control network. Therefore, the first corresponding relationship can be queried according to the version model of the device to determine the firmware risk information of the device. It should be noted that for the first corresponding relationship, the first corresponding relationship can be constructed by detecting and querying the application information of each device in the industrial control network, or the first corresponding relationship can be constructed based on relevant publicly released information.

[0088] By obtaining the first attribute information of the devices in the industrial control network and determining the firmware risk information of each industrial control device according to the version matching method, the firmware risk in the industrial control network is determined in a fine-grained manner. In addition, the first attribute information can be obtained by simply probing the port of the device, which reduces the traffic introduced into the industrial control network as much as possible and ensures the stability of the industrial control network.

[0089] After determining the firmware risk of the device, the traffic risk in the industrial control network can be further determined at the traffic level through a passive detection module for detection, as specifically shown in S202.

[0090] S202: Determine traffic risk information in the industrial control network based on traffic data in the industrial control network.

[0091] In some embodiments, the flow data in the industrial control network can be mirrored to a risk analysis system or an electronic device that applies a risk detection method for an industrial control network through a switch, and then the flow data in the industrial control network can be analyzed through the risk analysis system or the electronic device to detect the flow risk information therein. The flow risk information includes at least one of the following: operational risks caused by write operation instructions, network attack risks caused by network attack traffic, and network security risks caused by network virus traffic. Therefore, when determining the flow risk information, the characteristics of the risk traffic can be analyzed through a passive detection module. In one embodiment, the method for determining flow risk information is as follows: Figure 5 as shown, including at least:

[0092] S501, parsing the traffic data.

[0093] S502: If there is target traffic in the traffic data, determine traffic risk information in the industrial control network according to the target traffic.

[0094] The target flow is a flow including target features, and the target features include at least one of the following: write operation instructions, network attack features, and network virus features. The write operation instructions are key instructions in the industrial control network, and the write instructions directly modify the logic and control behavior inside the device by changing the configuration, parameters or status of the device. In other words, the write instructions directly determine the production actions in the industrial control network. If there is a problem with the write operation instructions, it will directly affect the security of the industrial control network, so it is necessary to pay attention to the write operation instructions. The write operation instructions may include PLC start and stop instructions, remote control instructions of the IEC104 communication protocol, write instructions of the Modbus communication protocol, Ethernet / IP protocol reset PLC and other instructions.

[0095] Network attack characteristics refer to the corresponding characteristics that appear in messages related to device vulnerabilities. If network attack characteristics exist in the target traffic, it means that there are related vulnerability exploitation behaviors in the industrial control network. The vulnerability refers to a vulnerability that affects the security of the industrial control network, for example, the HMI (Human Machine Interface) string stack overflow vulnerability of the PLC's WinCC (Windows Control Center).

[0096] Network virus characteristics are traffic characteristics that appear when some viruses spread. If the target traffic contains network virus characteristics, it means that there is a risk of virus attack in the current industrial control network. The above network viruses can be network viruses such as ransomware and Trojan virus.

[0097] By determining the traffic risk information in the industrial control network, we can accurately understand the network security risks existing in the industrial control network and improve the accuracy of the industrial control network.

[0098] In addition, after parsing the traffic data, the passive detection module may find information such as the device IP that the active detection module has not been able to obtain before in the traffic data. The passive detection module may send the new attribute information (i.e., the second attribute information) found in the traffic data to the active detection module. The active detection module re-detects the firmware risk of the new device based on the new attribute information to determine the firmware risk information of the new device.

[0099] In order to detect the security vulnerability risks introduced by the industrial control network due to configuration reasons and the offline risks caused by equipment abnormalities, it is also necessary to detect the configuration information and operating status of the equipment. The detection process is explained below.

[0100] S203: Detect configuration information and operating status of the device according to the first attribute information.

[0101] According to the first attribute information of the device, the device IP, version model, manufacturer and other information can be determined. Based on the first attribute information, the protocol configuration verification module can determine the type of device, for example, the type includes terminal, network, security device or industrial control host computer and other types. Based on the first attribute information, the operating system information of the device can be further determined according to the correspondence between the preset attribute information and the operating system. For example, the operating system of the device may be Windows, Linux, Unix and other systems. After determining the type and operating system information of the device, the configuration information of the device can be checked. It should be noted that when checking the configuration information, it is mainly aimed at devices other than industrial control devices in the industrial control network. This is because the industrial control equipment executes instructions, and the possibility of its own configuration causing security risks to the industrial control network is relatively small.

[0102] The process of configuring the device can be found in Figure 6 The flowchart shown includes:

[0103] S601: Determine a configuration standard of the device according to the device type and the operating system of the device.

[0104] S602: Detect configuration information of the device based on the configuration standard.

[0105] First, according to the device type and the device's operating system, the device's configuration standard can be determined. The configuration standard is determined according to relevant laws and regulations, industry standards or user-defined rules. For example, the configuration standard can be determined based on the requirement of the "Cybersecurity Law" that the device must have a specific security configuration. Configuration standards can also be determined based on international or industry security standards such as ISO 27001 and NIST SP800-53. And define your own security configuration strategy based on actual business needs, such as shutting down specific services, forcing password complexity and other rules to determine configuration standards.

[0106] After determining the configuration standard, the user name and password information of the device to be inspected is logged in the risk detection system or electronic device, the configuration information of the device to be inspected is obtained, and the configuration information of the device to be inspected is batch checked based on the configuration standard.

[0107] It should be noted that after the configuration information is detected, the method further includes: if the configuration information of the device does not meet the configuration standard, the configuration information of the device is modified according to the configuration standard. In this way, the configuration of the device can be tightened in a targeted manner, so that the device configuration in the industrial control network meets the corresponding configuration standard, and the risks caused and introduced by the configuration are minimized, thereby improving the security of the industrial control network.

[0108] For the detection of the operating status of the device, the status detection module can determine the minimum survival detection method corresponding to the device based on the type of device. The minimum survival detection method is the simplest and most effective detection method formulated according to the function of the device and the demand for detection, which can ensure whether the device is in a normal state or needs further inspection. To determine the minimum survival detection method, it is necessary to determine the function and requirements of the device according to the type of device. Then further determine the detection method that meets the device requirements, and the detection method includes at least one of the following: heartbeat detection, simple request response (Ping), resource monitoring, etc.

[0109] For example, if a device can be detected through PING, this detection method is used for the device. If the device prohibits PING, the device uses its own open service port for detection, ensuring minimal interference to the existing network equipment and improving the overall operation stability. The detection frequency can be adjusted according to actual needs.

[0110] After determining the configuration information and operating status of the device, the configuration information and operating status may be recorded in the asset risk module so that the asset risk module can summarize the risk information of each dimension of the device and determine the risk data of the device.

[0111] S204: Determine risk data of the device based on the firmware risk information, traffic risk information, and the operating status and configuration information of the device.

[0112] In some embodiments, the firmware risk information and traffic risk information of the device can be divided into medium, high and low levels. For example, network viruses can be divided into low, medium and high risk levels according to their propagation capabilities. And the configuration risk level of the device can also be determined for the number of ports in the configuration information. Therefore, the level and configuration risk level of the firmware risk information, traffic risk information, and operating status information can be weighted to determine the risk data of the device. This allows staff to intuitively understand the risk situation in the industrial control network. Risk warnings are issued for medium and high-risk assets to remind relevant on-site administrators to deal with asset risks in a timely manner. In addition, a corresponding solution library can be preset according to different risk information. After determining the risk situation of the device, corresponding solutions can be provided to the staff in combination with the solution library.

[0113] In some embodiments, the asset risk module records risk detection information and attribute information of all devices in the industrial control network. Based on the risk detection information and attribute information, the operating status of each device in the industrial control network can be determined.

[0114] Corresponding to the above-mentioned embodiment of the risk detection method for industrial control network, the present disclosure also provides an embodiment of the risk detection device for industrial control network. Figure 7 , Figure 7 Schematically shows a block diagram of a risk detection device for an industrial control network according to an embodiment of the present disclosure, wherein the device comprises:

[0115] The acquisition unit 701 is used to acquire first attribute information of at least one device in the industrial control network, and determine the firmware risk information of the device according to the first attribute information; the first attribute information is used to determine each device in the industrial control network;

[0116] A first determining unit 702, configured to determine flow risk information in the industrial control network according to flow data in the industrial control network;

[0117] A detection unit 703, configured to detect configuration information and operating status of the device according to the first attribute information;

[0118] The second determining unit 704 is configured to determine the risk data of the device based on the firmware risk information, the traffic risk information, and the operating state and configuration information of the device.

[0119] In one embodiment, the acquisition unit 701 is used to:

[0120] Sending a detection message to a device in the industrial control network;

[0121] A response message of the device to the detection message is received, and first attribute information of the device carried in the response message is acquired.

[0122] In one embodiment, the acquisition unit 701 is used to:

[0123] Determining a version model of the device according to the first attribute information of the device;

[0124] Based on the version model and a first corresponding relationship, the firmware risk information of the device is determined; the first corresponding relationship is a corresponding relationship between the version model and the firmware risk.

[0125] In one embodiment, the first determining unit 702 is configured to:

[0126] parsing the traffic data;

[0127] If there is target traffic in the traffic data, the traffic risk information in the industrial control network is determined based on the target traffic; the target traffic is traffic including target features, and the target features include at least one of the following: write operation instructions, network attack features, and network virus features.

[0128] In one embodiment, the detection unit 703 is used to:

[0129] Determine the device type and the operating system information of the device according to the first attribute information, and detect the configuration information of the device based on the device type and the operating system information;

[0130] A survival detection mode of the device is determined according to the type of the device, and an operating state of the device is determined based on the survival detection mode.

[0131] In one embodiment, the detection unit 703 is used to:

[0132] Determining a configuration standard of the device according to the device type and the operating system of the device;

[0133] Based on the configuration standard, the configuration information of the device is detected.

[0134] In one embodiment, the device further comprises:

[0135] The third determination unit is used to determine the firmware risk information of the device corresponding to the second attribute information in response to the second attribute information existing in the traffic data, wherein the second attribute information is the attribute information in the industrial control network except the first attribute information.

[0136] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0137] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0138] The embodiments of the risk detection device for industrial control networks disclosed in the present invention can be applied to electronic devices. The device embodiments can be implemented by software, or by hardware, or by a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, the processor of the electronic device in which it is located reads the corresponding computer program instructions in the non-volatile memory into the memory and runs them. From the hardware level, if Figure 8 As shown, it is a hardware structure diagram of the electronic device where the risk detection device of the industrial control network disclosed in the present invention is located. Figure 8 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in which the device in the embodiment is located may also include other hardware according to its actual functions, which will not be described in detail.

[0139] The embodiments of the subject matter and functional operations described in this specification may be implemented in the following: digital electronic circuits, tangibly embodied computer software or firmware, computer hardware including the structures disclosed in this specification and their structural equivalents, or a combination of one or more of them. The embodiments of the subject matter described in this specification may be implemented as one or more computer programs, i.e., one or more modules in computer program instructions encoded on a tangible non-temporary program carrier to be executed by a data processing device or to control the operation of the data processing device. Alternatively or additionally, the program instructions may be encoded on an artificially generated propagation signal, such as a machine-generated electrical, optical or electromagnetic signal, which is generated to encode information and transmit it to a suitable receiver device for execution by a data processing device. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them.

[0140] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the particular order or sequential order shown to achieve the desired results. In some implementations, multitasking and parallel processing may be advantageous.

[0141] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure shall be included in the scope of protection of the present disclosure.

Claims

1. A risk detection method for an industrial control network, characterized in that: The method comprises: Acquire first attribute information of at least one device in the industrial control network, and determine firmware risk information of the device based on the first attribute information; the first attribute information is used to determine each device in the industrial control network; Determining traffic risk information in the industrial control network based on traffic data in the industrial control network; Detecting configuration information and operating status of the device according to the first attribute information; Based on the firmware risk information, traffic risk information, and the operating status and configuration information of the device, risk data of the device is determined.

2. The method according to claim 1, characterized in that The obtaining of first attribute information of at least one device in the industrial control network includes: Sending a detection message to a device in the industrial control network; A response message of the device to the detection message is received, and first attribute information of the device is determined according to the response message.

3. The method according to claim 1, characterized in that: The determining, according to the first attribute information, the firmware risk information of the device includes: Determining a version model of the device according to the first attribute information of the device; Based on the version model and a first corresponding relationship, the firmware risk information of the device is determined; the first corresponding relationship is a corresponding relationship between the version model and the firmware risk.

4. The method according to claim 1, characterized in that Determining the traffic risk information in the industrial control network according to the traffic data includes: parsing the traffic data; If there is target traffic in the traffic data, the traffic risk information in the industrial control network is determined based on the target traffic; the target traffic is traffic including target features, and the target features include at least one of the following: write operation instructions, network attack features, and network virus features.

5. The method according to claim 1, characterized in that The detecting, according to the first attribute information, the configuration information and the operating status of the device includes: Determine the device type and the operating system information of the device according to the first attribute information, and detect the configuration information of the device based on the device type and the operating system information; A survival detection mode of the device is determined according to the type of the device, and an operating state of the device is determined based on the survival detection mode.

6. The method according to claim 5, characterized in that The detecting the configuration information of the device based on the device type and the operating system information includes: Determining a configuration standard of the device according to the device type and the operating system of the device; Based on the configuration standard, the configuration information of the device is detected.

7. The method according to claim 1, characterized in that The method further comprises: In response to the presence of second attribute information in the traffic data, the firmware risk information of the device corresponding to the second attribute information is determined, wherein the second attribute information is attribute information in the industrial control network except the first attribute information.

8. A risk detection device for an industrial control network, characterized in that: The device comprises: An acquisition unit, configured to acquire first attribute information of at least one device in the industrial control network, and determine firmware risk information of the device according to the first attribute information; the first attribute information is used to determine each device in the industrial control network; A first determining unit, configured to determine flow risk information in the industrial control network according to flow data in the industrial control network; a detection unit, configured to detect configuration information and an operating state of the device according to the first attribute information; The second determining unit is used to determine the risk data of the device based on the firmware risk information, traffic risk information of the device, and the operating state and configuration information of the device.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images