Industrial control alarm processing method, device and processing equipment

Abstract

The invention provides an industrial control alarm processing method and device and processing equipment, which are used for configuring an alarm integration mechanism from the overall level aiming at a plurality of industrial control alarm events given by an original industrial control system, so that new data support can be provided for alarm decision response, and the alarm decision response efficiency is improved. The method is suitable for capturing potential safety hazards hidden behind repeatedly occurring low-grade and easily-neglected industrial control alarm events, and good user experience of workers can be taken into account while production safety is guaranteed. The method comprises the following steps: acquiring a plurality of initial industrial control alarm events of a preset industrial control system; analyzing alarm contents of the plurality of initial industrial control alarm events to obtain corresponding analysis results; and on the basis of the analysis result, the plurality of initial industrial control alarm events are integrated to obtain at least one target industrial control alarm event, and one target industrial control alarm event is obtained by integrating at least two initial industrial control alarm events.

Description

Technical Field

[0001] The present application relates to the field of industrial control, and specifically to an industrial control alarm processing method, device and processing equipment. Background Art

[0002] Current industrial control systems (ICS) usually use corresponding alarm mechanisms to timely monitor system anomalies and respond to them to ensure the safety and stability of production.

[0003] Industrial control system alarms may vary depending on the industrial environment and the type of control system, but they usually involve alarm type, alarm level (or priority), alarm trigger conditions, alarm reminders, automated response processing, alarm log analysis, alarm reports, alarm specifications, etc.

[0004] This information can provide the staff with useful information in different aspects and help them better maintain the industrial control system. However, the inventors of the present application have found that, overall, the information involved in the existing industrial control system alarm mechanism is complicated. In actual applications, if a low-level alarm appears repeatedly, there is too much information to be analyzed. Therefore, under the filtering mechanism, it is easy to be filtered out as redundant information, which may result in the omission of some key information in some cases, leaving safety hazards.

[0005] In other words, the existing industrial control system alarm mechanism has the problem of poor alarm effect in some cases, which not only poses a safety hazard but also has the problem of poor user experience. Summary of the invention

[0006] The present application provides an industrial control alarm processing method, apparatus and processing equipment, which are used to configure an alarm integration mechanism for multiple industrial control alarm events given by the original industrial control system from an overall level, so as to provide new data support for alarm decision-making response, and is suitable for capturing the hidden safety hazards behind recurring low-level and other easily overlooked industrial control alarm events, while ensuring production safety while also taking into account the good user experience of the staff.

[0007] In a first aspect, the present application provides an industrial control alarm processing method, the method comprising:

[0008] Acquire multiple initial industrial control alarm events of a preset industrial control system, wherein the initial industrial control alarm event is specifically a corresponding alarm event generated by the preset industrial control system based on the original system function and the abnormal situation of the system detected by monitoring;

[0009] Analyze the alarm contents of multiple initial industrial control alarm events and obtain corresponding analysis results;

[0010] Based on the analysis result, multiple initial industrial control alarm events are integrated to obtain at least one target industrial control alarm event, wherein one target industrial control alarm event is obtained by integrating at least two initial industrial control alarm events.

[0011] In combination with the first aspect of the present application, in a first possible implementation manner of the first aspect of the present application, obtaining multiple initial industrial control alarm events generated by a preset industrial control system includes:

[0012] From the industrial control security log of the industrial control alarm integration service, multiple initial industrial control alarm events generated by the preset industrial control system are extracted according to the selected extraction range, wherein the preset industrial control system is pre-connected to the industrial control alarm integration service, and the preset industrial control system reports the initial industrial control alarm event to the industrial control alarm integration service for the industrial control alarm integration service to record in the industrial control security log, or the industrial control alarm integration service generates multiple industrial control alarm events according to the monitoring data reported by the preset industrial control system and records them in the industrial control security log.

[0013] In combination with the first aspect of the present application, in a second possible implementation manner of the first aspect of the present application, the parsing result is specifically characterized by the field content of different specified fields, and based on the parsing result, multiple initial industrial control alarm events are integrated, including:

[0014] The field contents of different designated fields of multiple initial industrial control alarm events are traversed, and each designated field with the same field content is integrated into a target industrial control alarm event.

[0015] In combination with the second possible implementation method of the first aspect of the present application, in the third possible implementation method of the first aspect of the present application, different specified fields specifically relate to users, source IP addresses, destination IP addresses, source ports, destination ports, source MAC addresses, destination MAC addresses, log levels, protocols, applications, reasons and behaviors.

[0016] In combination with the third possible implementation method of the first aspect of the present application, in the fourth possible implementation method of the first aspect of the present application, the field content included in the target industrial control alarm event includes not only the integrated field content obtained by integrating the same field content, but also the time period, number of times, alarm level, whether to send an email, and the email address when an email needs to be sent.

[0017] In combination with the third possible implementation manner of the first aspect of the present application, in a fifth possible implementation manner of the first aspect of the present application, the specified field further involves a keyword, and the method further includes:

[0018] If the application and reason fields have the same content, a target industrial control alarm event is integrated for the specified field of the keyword.

[0019] In combination with the third possible implementation of the first aspect of the present application, in a sixth possible implementation of the first aspect of the present application, the designated field further involves whether to save the scene, and the method further includes:

[0020] If a network attack is detected, a target industrial control alarm event is integrated based on whether the specified field on site is saved.

[0021] In a second aspect, the present application provides an industrial control alarm processing device, the device comprising:

[0022] An acquisition unit is used to acquire a plurality of initial industrial control alarm events of a preset industrial control system, wherein the initial industrial control alarm event is specifically a corresponding alarm event generated by the preset industrial control system based on the original system function and the abnormal situation of the system monitored;

[0023] The parsing unit is used to parse the alarm contents of multiple initial industrial control alarm events to obtain corresponding parsing results;

[0024] The integration unit is used to integrate multiple initial industrial control alarm events based on the analysis results to obtain at least one target industrial control alarm event, wherein one target industrial control alarm event is obtained by integrating at least two initial industrial control alarm events.

[0025] In conjunction with the second aspect of the present application, in a first possible implementation manner of the second aspect of the present application, the acquiring unit is specifically configured to:

[0026] From the industrial control security log of the industrial control alarm integration service, multiple initial industrial control alarm events generated by the preset industrial control system are extracted according to the selected extraction range, wherein the preset industrial control system is pre-connected to the industrial control alarm integration service, and the preset industrial control system reports the initial industrial control alarm event to the industrial control alarm integration service for the industrial control alarm integration service to record in the industrial control security log, or the industrial control alarm integration service generates multiple industrial control alarm events according to the monitoring data reported by the preset industrial control system and records them in the industrial control security log.

[0027] In conjunction with the second aspect of the present application, in a second possible implementation manner of the second aspect of the present application, the parsing result is specifically characterized by the field content of different specified fields, and the integration unit is specifically used to:

[0028] The field contents of different designated fields of multiple initial industrial control alarm events are traversed, and each designated field with the same field content is integrated into a target industrial control alarm event.

[0029] In combination with the second possible implementation method of the second aspect of the present application, in the third possible implementation method of the second aspect of the present application, different specified fields specifically relate to users, source IP addresses, destination IP addresses, source ports, destination ports, source MAC addresses, destination MAC addresses, log levels, protocols, applications, reasons and behaviors.

[0030] In combination with the third possible implementation method of the second aspect of the present application, in the fourth possible implementation method of the second aspect of the present application, the field content included in the target industrial control alarm event includes, in addition to the integrated field content obtained by integrating the same field content, the time period, number of times, alarm level, whether it is necessary to send an email, and the email address when it is necessary to send an email.

[0031] In combination with the third possible implementation of the second aspect of the present application, in a fifth possible implementation of the second aspect of the present application, the designated field further involves a keyword, and the integration unit is further used for:

[0032] If the application and reason fields have the same content, a target industrial control alarm event is integrated for the specified field of the keyword.

[0033] In combination with the third possible implementation of the second aspect of the present application, in a sixth possible implementation of the second aspect of the present application, the designated field further relates to whether to save the scene, and the integration unit is also used for:

[0034] If a network attack is detected, a target industrial control alarm event is integrated based on whether the specified field on site is saved.

[0035] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.

[0036] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0037] From the above content, it can be concluded that the present application has the following beneficial effects:

[0038] In the industrial control scenario, in response to the multiple industrial control alarm events given by the original industrial control system, this application configures an alarm integration mechanism from the overall level, which can provide new data support for alarm decision-making responses. It is suitable for capturing the hidden safety hazards behind recurring low-level and other easily overlooked industrial control alarm events, while ensuring production safety while also taking into account the good user experience of the staff. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 A flowchart of the industrial control alarm processing method for this application;

[0041] Figure 2 A structural diagram of the industrial control alarm processing device of this application;

[0042] Figure 3 A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0044] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0045] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0046] Before introducing the industrial control alarm processing method provided by this application, the background content involved in this application is first introduced.

[0047] The industrial control alarm processing method, device and computer-readable storage medium provided in the present application can be applied to processing equipment, and is used to configure an alarm integration mechanism from an overall level for multiple industrial control alarm events given by the original industrial control system, so as to provide new data support for alarm decision-making response, and is suitable for capturing the hidden safety hazards behind recurring low-level and other easily overlooked industrial control alarm events, while ensuring production safety while also taking into account the good user experience of the staff.

[0048] The industrial control alarm processing method mentioned in this application can be executed by an industrial control alarm processing device, or a server, physical host or user equipment (UE) and other different types of processing equipment integrated with the industrial control alarm processing device. Among them, the industrial control alarm processing device can be implemented in hardware or software, and the UE can be a terminal device such as a smart phone, a tablet computer, a laptop computer, a desktop computer or a personal digital assistant (PDA), and the processing device can be set in a device cluster.

[0049] For the processing equipment that executes the industrial control alarm processing method of this application or is equipped with the application service corresponding to the industrial control alarm processing method of this application, in actual applications, it can be on the same device as the preset industrial control system that accesses the industrial control alarm integration service, or it can be on a device other than the device where the preset industrial control system that accesses the industrial control alarm integration service is located. Secondly, considering that this application is data processing based on existing industrial control alarm events, only the required data processing capabilities need to be met to meet the requirements. The specific equipment type and equipment deployment form are relatively flexible and can be flexibly configured according to actual conditions. This application does not make specific limitations. If it also involves corresponding response processing for industrial control alarm events, it is necessary to consider the response link and make further adaptability adjustments.

[0050] Next, the industrial control alarm processing method provided by this application is introduced.

[0051] First, see Figure 1 , Figure 1 A flow chart of the industrial control alarm processing method of the present application is shown. The industrial control alarm processing method provided by the present application may specifically include the following steps S101 to S103:

[0052] Step S101, obtaining a plurality of initial industrial control alarm events of a preset industrial control system, wherein the initial industrial control alarm event is specifically a corresponding alarm event generated by the preset industrial control system based on the original system function and the abnormal situation of the system detected;

[0053] It is understandable that in actual application scenarios, it may involve either one industrial control system or multiple industrial control systems, which are related to the specific application scenarios or production environments. For the industrial control system that is pre-connected to the industrial control alarm integration service of this application (referred to as the preset industrial control system), it has an alarm function itself, so it can generate corresponding industrial control alarm events based on its own monitoring results of system abnormalities (including system failures). Among them, for the sake of convenience, this application records the original industrial control alarm event as the initial industrial control alarm event, and there are subsequent integrated target industrial control alarm events.

[0054] In specific operations, the acquisition and processing of initial industrial control alarm events can be actively extracted from the preset industrial control system, or pushed by the preset industrial control system according to a pre-agreed push plan, which may also involve settings for real-time acquisition, periodic acquisition, or acquisition triggered by trigger conditions.

[0055] As an exemplary embodiment here, obtaining multiple initial industrial control alarm events generated by a preset industrial control system may specifically include:

[0056] From the industrial control security log of the industrial control alarm integration service, multiple initial industrial control alarm events generated by the preset industrial control system are extracted according to the selected extraction range, wherein the preset industrial control system is pre-connected to the industrial control alarm integration service, and the preset industrial control system reports the initial industrial control alarm event to the industrial control alarm integration service for the industrial control alarm integration service to record in the industrial control security log, or the industrial control alarm integration service generates multiple industrial control alarm events according to the monitoring data reported by the preset industrial control system and records them in the industrial control security log.

[0057] It can be seen from the embodiments here that the initial industrial control alarm event involved in the present application can specifically be a log record content in the industrial control security log, and the log record content can be processed by the industrial control alarm integration service of the present application, or it is itself processed and reported by the preset industrial control system connected to the industrial control alarm integration service. This provides a more flexible processing method for how the present application obtains the initial industrial control alarm event, compared to the original conventional way of obtaining the event directly provided by the preset industrial control system, and also makes a certain degree of expansion, that is, the initial industrial control alarm event may also be obtained by the industrial control alarm integration service in some cases through secondary processing based on the relevant monitoring data reported by the preset industrial control system.

[0058] In addition, for the initial industrial control alarm events, the acquisition process may also involve constraints on the extraction scope or conditions to obtain specific industrial control alarm events with scopes / conditions such as specific time periods, specific data sources or specific circumstances, thereby playing a role in accurately extracting data.

[0059] Step S102, analyzing the alarm contents of multiple initial industrial control alarm events to obtain corresponding analysis results;

[0060] It is understandable that the alarm content of the initial industrial control alarm event may come from different data sources. Therefore, corresponding data preprocessing operations can be implemented through corresponding analysis processing to obtain analysis results that are convenient for subsequent integration processing, thereby providing stable quality data input for subsequent integration processing.

[0061] Alternatively, directly for the subsequent integration processing, it may also involve extracting more concise data from the alarm content of the industrial control alarm event, so as to carry out the subsequent integration processing more conveniently.

[0062] Of course, in some cases, the subsequent integration processing can also be pre-adapted to the alarm content of the previous initial industrial control alarm event. At this time, it may involve relatively simple data verification, such as removing abnormal data, so as to provide stable quality data input for subsequent integration processing. Among them, the data verification processing itself can also be included in the previous two analysis processing methods.

[0063] Step S103, based on the analysis result, multiple initial industrial control alarm events are integrated to obtain at least one target industrial control alarm event, wherein one target industrial control alarm event is obtained by integrating at least two initial industrial control alarm events.

[0064] It can be understood that the integration processing introduced in the present application specifically refers to integrating different initial industrial control alarm events with common characteristics into a new industrial control alarm event, namely, a target industrial control alarm event.

[0065] In the process of this integration and processing, the common determination strategies / rules pre-constructed in this application may be involved, so that the abnormal situations whose event generation mechanisms of the original initial industrial control alarm events are difficult to reflect from a single event can be discovered.

[0066] From this, it can be seen that the present application starts from the overall level involving multiple initial industrial control alarm events, in order to try to capture the corresponding abnormal problems that may be ignored or not paid attention to by a single initial industrial control alarm event at the overall level. The severity of these abnormal problems that were originally difficult to detect is not fixed, but they are obviously accompanied by a corresponding degree of safety hazards. Therefore, the present application provides more detailed data support for system safety response by capturing these hidden and difficult to detect safety hazards.

[0067] More specifically, in the original industrial control alarm mechanism, if a low-level alarm appears repeatedly, there is too much information to analyze and it is easy to be filtered out as redundant information. In some cases, this will result in missing some key information, leaving safety risks.

[0068] It is worth adding that the number of at least one target industrial control alarm event obtained through integration may not necessarily be smaller than the number of the original multiple initial industrial control alarm events. In actual situations, this will change accordingly with the commonalities of the events mined.

[0069] Furthermore, the integration processing designed by the present application can be specifically carried out for the designated fields involved in the industrial control alarm events. That is to say, the present application characterizes the industrial control alarm events through the field content of the designated fields, and performs efficient comparison of the event commonalities between the industrial control alarm events, and thereby develops the generation of new industrial control alarm events, i.e., the target industrial control alarm events, to achieve the integration goal of the target industrial control alarm events.

[0070] In this regard, as an exemplary embodiment, the analysis result obtained by the previous analysis can be specifically represented by the field content of different specified fields, and here, based on the analysis result, multiple initial industrial control alarm events are integrated, which can include:

[0071] The field contents of different designated fields of multiple initial industrial control alarm events are traversed, and each designated field with the same field content is integrated into a target industrial control alarm event.

[0072] Next, this application starts from a more specific practical application and provides a set of practical supporting solutions.

[0073] In this regard, as an exemplary embodiment, as shown in Table 1 below, the different specified fields mentioned above may specifically involve users, source IP addresses, destination IP addresses, source ports, destination ports, source MAC addresses, destination MAC addresses, log levels, protocols, applications, reasons, and behaviors.

[0074] Table 1 - Field examples of industrial control alarm events

[0075] Field Number Field Name meaning 1 user User who generated the alarm 2 Source IP address Source IP address of the alarm 3 Destination IP address Destination IP address that generates the alarm 4 Source Port Source port of the alarm 5 Destination Port Destination port that generates the alarm 6 Source MAC address Source MAC address of the alarm 7 Destination MAC address Destination MAC address that generates the alarm 8 Log Level Log level for generating warnings 9 protocol Protocol that generates the alarm 10 application Industrial control protocol that generates alarms 11 reason Cause of the alarm 12 Behavior Behavior that generates an alert

[0076] It is not difficult to see that there is a high probability that the alarms with the above fields are exactly the same. This application can select to configure the alarms with the specified field numbers 1-12 to be exactly the same, and generate a high-level alarm with the content X. The alarm will prompt that B alarms with the content X were generated within the configured specified time A, so that the staff / related system services can obtain this integrated information.

[0077] To facilitate understanding of the integrated field content, as a simple example (actual applications may involve more complex, customized specified fields), you can also refer to the following Table 2 to help understand.

[0078] Table 2 - Integration Field Example 1

[0079] Field Number Field Name Configuration value 1 user "Some user" 2 Source IP address "Some source IP address" 3 Destination IP address "IP address of a destination" 4 Source Port "Some source port" 5 Destination Port "Some destination port" 6 Source MAC "Some source MAC address" 7 Destination MAC "A destination MAC address" 8 Log Level "A certain log level" 9 protocol "A certain agreement" 10 application "Some application" 11 reason "Some reason" 12 Behavior "certain behavior"

[0080] Furthermore, corresponding to the related application services that can be conveniently deployed based on the target industrial control alarm events, the present application can also configure additional integration fields for the integrated target industrial control alarm events to provide a brief overview and response plan to enhance its application value and practicality.

[0081] Correspondingly, as an exemplary embodiment, the field content included in the target industrial control alarm event of the present application may include not only the integrated field content obtained by integrating the same field content, but also the time period, number of times, alarm level, whether it is necessary to send an email, and the email address when an email needs to be sent.

[0082] For example, within time period A, B alarm contents that need to be converted are generated (as shown in Table 2 above). At this time, the alarm level is reset to C. If an email needs to be sent, it is sent to mailbox E. If not, it is displayed as an alarm log in the system.

[0083] The integrated field content involved in the embodiment here can also be more vividly understood in conjunction with the following Table 3.

[0084] Table 3 - Integration Field Example 2

[0085] serial number Configuration Content Configuration Values 1 Time period A 2 frequency B 3 Alarm level C 4 Do you need to send an email? D 5 Mail E

[0086] At the same time, the present application can further introduce a processing mechanism for association analysis.

[0087] It is understandable that in complex and changeable actual application scenarios, there are many types of industrial control applications. In this regard, in many applications, this application can also support keyword analysis related content in terms of details.

[0088] Correspondingly, as an exemplary embodiment, referring to Table 4 below, the aforementioned designated field may also involve a new item, namely, a keyword. In this case, the method of the present application may further include:

[0089] If the application (item 9) and reason (item 11) fields have the same field contents, a target industrial control alarm event is integrated for the specified field of the keyword (item 13).

[0090] Table 4 - Integration Field Example 3

[0091] Field Number Field Name Configuration value 1 user "Some user" 2 Source IP address "Some source IP address" 3 Destination IP address "IP address of a destination" 4 Source Port "Some source port" 5 Destination Port "Some destination port" 6 Source MAC address "Some source MAC address" 7 Destination MAC address "A destination MAC address" 8 Log Level "A certain log level" 9 protocol "A certain agreement" 10 application "Multiple Applications" 11 reason "Some reason" 12 Behavior "certain behavior" 13 Keywords "Keyword"

[0092] In layman's terms, if a "certain keyword" is generated in the "certain reason" triggered by the "multiple applications" of the alarm, and it is generated B times within time period A, a new alarm content will be generated as ["certain keyword" is generated in "multiple applications" for "certain reason"]. At this time, the alarm level is reset to C. If an email needs to be sent, it will be sent to mailbox E. If not, it will be displayed in the system as an alarm log.

[0093] It can be understood that under the setting of this embodiment, the keyword analysis association setting supplemented in detail by the present application can be reflected through the newly added keyword designated field and its corresponding new target industrial control alarm event, and this setting can obviously continue to provide new data support for alarm decision response, so as to further enhance the mining effect of the present application on the abnormal situation of the original initial industrial control alarm event from a deeper level, and realize more powerful data-assisted support.

[0094] In addition, the present application can further consider the possibility of supplementing the on-site backtracking solution to better carry out security work in the corresponding industrial control scenarios. Once an attack is encountered, it can support packet capture of traffic messages (data packets) with corresponding characteristics, so as to promote the prevention of subsequent corresponding attacks based on the on-site message analysis characteristics.

[0095] In this regard, as an exemplary embodiment, as shown in Table 5 below, the aforementioned designated field may also relate to whether to save the scene. In this case, the method of the present application may also include:

[0096] If a network attack is detected, a target industrial control alarm event is integrated based on whether the specified field on site is saved.

[0097] Table 5 - Integration Field Example 4

[0098] Field Number Field Name Configuration value 1 user "Some user" 2 Source IP address "Some source IP address" 3 Destination IP address "IP address of a destination" 4 Source Port "Some source port" 5 Destination Port "Some destination port" 6 Source MAC address "Some source MAC address" 7 Destination MAC address "A destination MAC address" 8 Log Level "A certain log level" 9 protocol "A certain agreement" 10 application "Multiple Applications" 11 reason "Some reason" 12 Behavior "certain behavior" 13 Keywords "Keyword" 14 Save the scene yes

[0099] As an example, an operation in which "a certain behavior" is "a certain keyword" is found in "multiple applications" with a destination port of "a certain destination port". If the scene needs to be saved, a new alarm content is generated as [an operation in which "a certain behavior" is "a certain keyword" is found in "multiple applications" with a destination port of "a certain destination port"]. At this time, the alarm level is reset to C. If an email needs to be sent, it is sent to mailbox E. If not, it is displayed in the system as an alarm log, and the scene message can be downloaded from the system.

[0100] After completing the integration process and obtaining the target industrial control alarm event, corresponding to its role as a data support, the present application scheme may also involve corresponding data application links.

[0101] Specifically, in the data application link, local storage, off-site storage, result display, output of prompts for completed integration processing, forwarding, further data analysis, and further automatic response can be performed. Obviously, these can all be adaptively configured according to actual needs, and the specific data application strategies / rules followed can be pre-configured and / or configured in real time. In this way, the discovered safety hazards can be further processed through relevant data application processing, and the relevant production work can be promoted stably, efficiently, and accurately in the industrial control scenario.

[0102] Finally, for the above solution content, in general, in the industrial control scenario, for the multiple industrial control alarm events given by the original industrial control system, this application configures an alarm integration mechanism from the overall level, so as to provide new data support for alarm decision-making response, which is suitable for capturing the hidden safety hazards behind recurring low-level and other easily overlooked industrial control alarm events, while ensuring production safety while also taking into account the good user experience of the staff.

[0103] The above is an introduction to the industrial control alarm processing method provided by this application. In order to facilitate better implementation of the industrial control alarm processing method provided by this application, this application also provides an industrial control alarm processing device from the perspective of functional modules.

[0104] See also Figure 2 , Figure 2 This is a structural diagram of the industrial control alarm processing device of this application. In this application, the industrial control alarm processing device 200 may specifically include the following structure:

[0105] The acquisition unit 201 is used to acquire multiple initial industrial control alarm events of a preset industrial control system, wherein the initial industrial control alarm event is specifically a corresponding alarm event generated by the preset industrial control system based on the original system function and the system abnormality detected by monitoring;

[0106] The parsing unit 202 is used to parse the alarm contents of multiple initial industrial control alarm events to obtain corresponding parsing results;

[0107] The integration unit 203 is used to integrate multiple initial industrial control alarm events based on the analysis result to obtain at least one target industrial control alarm event, wherein one target industrial control alarm event is obtained by integrating at least two initial industrial control alarm events.

[0108] In an exemplary embodiment, the acquisition unit 201 is specifically configured to:

[0109] From the industrial control security log of the industrial control alarm integration service, multiple initial industrial control alarm events generated by the preset industrial control system are extracted according to the selected extraction range, wherein the preset industrial control system is pre-connected to the industrial control alarm integration service, and the preset industrial control system reports the initial industrial control alarm event to the industrial control alarm integration service for the industrial control alarm integration service to record in the industrial control security log, or the industrial control alarm integration service generates multiple industrial control alarm events according to the monitoring data reported by the preset industrial control system and records them in the industrial control security log.

[0110] In another exemplary embodiment, the parsing result is specifically represented by the field contents of different specified fields, and the integration unit 203 is specifically used to:

[0111] The field contents of different designated fields of multiple initial industrial control alarm events are traversed, and each designated field with the same field content is integrated into a target industrial control alarm event.

[0112] In yet another exemplary embodiment, the different designated fields specifically relate to user, source IP address, destination IP address, source port, destination port, source MAC address, destination MAC address, log level, protocol, application, reason, and behavior.

[0113] In another exemplary embodiment, the field content included in the target industrial control alarm event includes not only the integrated field content obtained by integrating the same field content, but also the time period, number of times, alarm level, whether to send an email and the email address when sending an email.

[0114] In another exemplary embodiment, the designated field further involves a keyword, and the integration unit 203 is further configured to:

[0115] If the application and reason fields have the same content, a target industrial control alarm event is integrated for the specified field of the keyword.

[0116] In another exemplary embodiment, the designated field further relates to whether to save the scene, and the integration unit 203 is further used to:

[0117] If a network attack is detected, a target industrial control alarm event is integrated based on whether the specified field on site is saved.

[0118] This application also provides a processing device from the perspective of hardware structure, see Figure 3 , Figure 3 301, a memory 302, and an input / output device 303. The processor 301 is used to execute the computer program stored in the memory 302 to implement the following Figure 1The steps of the industrial control alarm processing method in the corresponding embodiment; or, the processor 301 is used to execute the computer program stored in the memory 302 to implement the following Figure 2 Corresponding to the functions of each unit in the embodiment, the memory 302 is used to store the processor 301 executing the above Figure 1 The computer program required by the industrial control alarm processing method in the corresponding embodiment.

[0119] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 302, and executed by the processor 301 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0120] The processing device may include, but is not limited to, a processor 301, a memory 302, and an input / output device 303. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 301, the memory 302, the input / output device 303, etc. are connected via a bus.

[0121] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0122] The memory 302 can be used to store computer programs and / or modules. The processor 301 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 302 and calling the data stored in the memory 302. The memory 302 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0123] When the processor 301 is used to execute the computer program stored in the memory 302, the following functions can be implemented:

[0124] Acquire multiple initial industrial control alarm events of a preset industrial control system, wherein the initial industrial control alarm event is specifically a corresponding alarm event generated by the preset industrial control system based on the original system function and the abnormal situation of the system detected by monitoring;

[0125] Analyze the alarm contents of multiple initial industrial control alarm events and obtain corresponding analysis results;

[0126] Based on the analysis result, multiple initial industrial control alarm events are integrated to obtain at least one target industrial control alarm event, wherein one target industrial control alarm event is obtained by integrating at least two initial industrial control alarm events.

[0127] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the industrial control alarm processing device, processing equipment and its corresponding units described above can refer to the following Figure 1 The description of the industrial control alarm processing method in the corresponding embodiment will not be repeated here.

[0128] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0129] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 For the steps of the industrial control alarm processing method in the corresponding embodiment, the specific operations can be referred to as follows Figure 1 The description of the industrial control alarm processing method in the corresponding embodiment will not be repeated here.

[0130] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0131] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1 The steps of the industrial control alarm processing method in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the industrial control alarm processing method in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0132] The industrial control alarm processing method, device, processing equipment and computer-readable storage medium provided by the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the core idea of ​​the present application; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for processing industrial control alarms, characterized in that: The method comprises: Acquire multiple initial industrial control alarm events of a preset industrial control system, wherein the initial industrial control alarm event is specifically a corresponding alarm event generated by the preset industrial control system based on the original system function and the abnormal situation of the system detected; Analyze the alarm contents of the multiple initial industrial control alarm events to obtain corresponding analysis results; Based on the analysis result, the multiple initial industrial control alarm events are integrated to obtain at least one target industrial control alarm event, wherein one target industrial control alarm event is obtained by integrating at least two initial industrial control alarm events.

2. The method according to claim 1, characterized in that The obtaining of multiple initial industrial control alarm events generated by a preset industrial control system includes: From the industrial control security log of the industrial control alarm integration service, extract the multiple initial industrial control alarm events generated by the preset industrial control system according to the selected extraction range, wherein the preset industrial control system is pre-connected to the industrial control alarm integration service, and the preset industrial control system reports the initial industrial control alarm event to the industrial control alarm integration service for the industrial control alarm integration service to record it in the industrial control security log, or the industrial control alarm integration service generates the multiple industrial control alarm events according to the monitoring data reported by the preset industrial control system and records them in the industrial control security log.

3. The method according to claim 1, characterized in that The analysis result is specifically characterized by the field content of different designated fields. Based on the analysis result, the multiple initial industrial control alarm events are integrated, including: The field contents of the different designated fields of the multiple initial industrial control alarm events are traversed, and each designated field with the same field content is integrated into one target industrial control alarm event.

4. The method according to claim 3, characterized in that The different designated fields specifically relate to user, source IP address, destination IP address, source port, destination port, source MAC address, destination MAC address, log level, protocol, application, reason and behavior.

5. The method according to claim 4, characterized in that The field content included in the target industrial control alarm event includes not only the integrated field content obtained by integrating the same field content, but also the time period, number of times, alarm level, whether to send an email and the email address when sending an email.

6. The method according to claim 4, characterized in that The specified field also involves a keyword, and the method further includes: If the application and the reason fields have the same field contents, then one target industrial control alarm event is integrated with respect to the designated field of the keyword.

7. The method according to claim 4, characterized in that The specified field also relates to whether to save the scene, and the method further includes: If a network attack is detected, a target industrial control alarm event is integrated according to the designated field of whether to save the scene.

8. An industrial control alarm processing device, characterized in that: The device comprises: An acquisition unit, used for acquiring a plurality of initial industrial control alarm events of a preset industrial control system, wherein the initial industrial control alarm event is specifically a corresponding alarm event generated by the preset industrial control system based on the original system function and the abnormal situation of the system detected; An analysis unit, used for analyzing the alarm contents of the plurality of initial industrial control alarm events to obtain corresponding analysis results; The integration unit is used to integrate the multiple initial industrial control alarm events based on the analysis result to obtain at least one target industrial control alarm event, wherein one target industrial control alarm event is obtained by integrating at least two initial industrial control alarm events.

9. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 7 when calling the computer program in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images