Method for monitoring control program of at least one functional unit of machine installation, computer program product, computer-readable storage medium and electronic computing device
By developing a method for automated monitoring and processing weak parts of the machine facility control program in an electronic computing device, the cumbersome problems of manually evaluating and handling weak parts in the prior art are solved, and the effect of automated processing and preventing machine shutdown is achieved.
Patent Information
- Application Number
- CN202380062368.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2022-08-30
- Filing Date
- 2023-08-22
- Publication Date
- 2025-04-11
AI Technical Summary
The prior art is difficult to automatically monitor and handle weak parts of control programs in machine facilities, resulting in cumbersome and inefficient manual evaluation and processing.
By developing a control program method in an electronic computing device, weak areas can be detected, weak areas can be classified based on existing analysis, and elimination measures are automatically recommended, including updating the control program to prevent machine downtime.
Automatic monitoring and processing of weak parts of the machine facility control program is realized, reducing the cost of manual operation, improving user-friendliness, and preventing machine downtime through automated measures, reducing the risk of production interruption.
Smart Images
Figure CN119816831A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a method for controlling a program for monitoring at least one functional unit of a machine installation by means of an electronic computing device according to the applicable patent claim 1. Furthermore, the invention relates to a computer-readable storage medium, a computer program product and an electronic computing device. Background Art
[0002] It is well known that, for example, in machine facilities in a production chain, the corresponding software or control programs or also so-called firmware may have weak spots. It is therefore important to be able to update the software or firmware. This involves installing so-called patches or new versions of the software or firmware. The problem currently faced by customers is that they currently have to handle any changes individually. Weak spots can be classified as follows. For example, weak spots can be classified as open weak spots or eliminated weak spots. In addition, it can be determined whether the software or firmware is not affected by the corresponding weak spot. Accordingly, it is currently manually assessed what category the weak spot belongs to and the association is performed accordingly.
[0003] It is also known that information about vulnerabilities is provided in a structured manner so that it can be automatically detected and processed. This is known by the term CVE (Common Vulnerabilities and Exposures). Here, the vulnerabilities are identified by unambiguous identifiers, the hardware or software components involved are described in detail, and the severity is assessed by a CVSS score (Common Vulnerability Scoring System). Information about vulnerabilities is provided via a corresponding CVE database. The data format is defined by the so-called SCAP (Security Content Automation Protocol) to automate security management. Summary of the invention
[0004] The object of the present invention is to provide a method, a computer program product, a computer-readable storage medium and an electronic computing device, by means of which a control program can be monitored in a simplified manner.
[0005] The object is achieved by a method, a computer program product, a computer-readable storage medium and an electronic computing device according to the independent patent claims. Advantageous embodiments are described in the dependent claims.
[0006] One aspect of the invention relates to a method for monitoring a control program of at least one functional unit of a machine installation by means of an electronic computing device. Weak points are detected in the control program. The detected weak points are classified based on weak points that have been analyzed in the past. Based on the classification, measures to eliminate the weak points are suggested.
[0007] The idea of the invention is therefore based in particular on the automatic classification or grouping of reported weaknesses and the measures derived therefrom in the specific context. For this purpose, the weakness reports are analyzed: that is, what actions are derived therefrom in the specific case. For example, within the analysis, the weakness is evaluated: that is, whether the weakness is open, whether it has been eliminated, or whether the control program is not affected by the weakness.
[0008] In a next step, the weak point is then automatically assigned in a program-supported manner to one of the listed or mentioned categories, into which similar weak points have previously been classified, for example.
[0009] In particular, a search function for similar weak points and their handling can therefore also be provided, which has the advantage that it substantially saves manual effort for searching and handling and significantly increases user friendliness. By a search that is as specific as possible, the search options therefor can be reasonably supplemented and all suitable solution options can be displayed to the customer or provider, for example, finding and using the corresponding patch for their weak point.
[0010] It should be noted at this point that the term "patch" should be understood in a broad sense. Therefore, it generally refers to an update of software and / or firmware or a control program. In particular, the patch can be an update for an Industrial Internet of Things (IIoT) device or a control device. The patch can also be an update for a virtual automation function or a virtual control device for an IIoT device.
[0011] In particular, it is proposed according to the invention to prevent a complete update of the machine and thus a machine shutdown by executing corresponding elimination measures which do not cause the machine to shut down. In this case, the machine itself has at least one functional unit, in particular a plurality of functional units. A functional unit can then in turn be associated with a plurality of control programs.
[0012] The object of the invention is therefore to prevent machine downtimes based on simple checks of control programs and corresponding operating recommendations or corrective measures, thereby making it possible to prevent particularly long failures, for example in series process plants, thereby saving considerable effort and money.
[0013] According to an advantageous embodiment, the weak points are classified into at least two categories, in particular at least three categories. In this case, in particular, a first category refers to open weak points, a second category refers to closed weak points, and a third category refers to weak points that are not associated with a functional unit. Thus, a classification can be performed in a simple manner, which classifies the weak points accordingly and proposes corresponding elimination measures, for example in the case of only open weak points.
[0014] Furthermore, it can be provided that a classification is carried out based on the weakness characteristics of the weak points. Thus, in particular, similarities of weak points are defined so that a specific "strategy" is determined for the weakness characteristics. In this context, it can be provided, for example, that the type and / or manufacturer of the functional unit in question and / or the location of the functional unit in question are described with the aid of the weakness characteristics. For example, for this purpose, the type and manufacturer of the component or functional unit in question, the location of the functional unit in question, in particular the physical and / or topological location, the type of weakness, for example remote code execution, buffer overflow, denial of service, availability of updates or workarounds can be defined, whereby a corresponding search task can be started, which reviews and compares the previous weakness assessments with predefined parameters and outputs grouping suggestions or classifications based on suitable criteria.
[0015] Furthermore, it can be proposed that the control program be updated as a remediation measure. In particular, the classification or grouping is the basis for further actions, such as defining and implementing suitable remediation options for the weak points by means of corresponding patches. It can also happen that the weak points have been eliminated or are assessed as non-critical or unaffected. Further countermeasures can also be taken, such as disconnecting a subnet, blocking ports via a firewall, stopping a machine, shutting down an automation system, etc.
[0016] Furthermore, it can be proposed that within the classification, the weak point is compared with other weak points and, if the weak point is similar to at least one other closed weak point, elimination measures for other closed weak points are proposed for the weak point. In other words, the systematic nature of a specific strategy can also be supplemented by a comparison of the aforementioned operating measures, which are meant to be used again in similar situations or weak points. For example, an electronic computing device is provided as a machine learning algorithm for this purpose and teaches which actions are to be performed by the security administrator when a specific weak point is reported. The actions are detected as suggestions or examples. Thus, in the case of similar weak point reports, one or more suggestions can be automatically proposed. The operational recommendations can indicate what needs to be done and, moreover, under what boundary conditions of the engineering system or automation component the measures are to be implemented.
[0017] Another advantageous embodiment provides that the detection of weak points and / or the classification of weak points and / or the proposal of elimination measures are performed by means of a machine learning algorithm of the electronic computing device. For example, the machine learning algorithm can be provided as an artificial intelligence, for example in the form of a neural network. In particular, the detection, classification and / or the proposal of elimination measures can thus be simplified and performed quickly in the future. Furthermore, it can also be provided that the elimination itself is performed automatically by means of a neural network, for example.
[0018] Furthermore, it has proven to be advantageous to analyze the classified weak points and to take them into account for the detection and / or classification and / or elimination of future weak points. The electronic computing device can thus learn and correspondingly use the unclassified weak points in the future in order to use them for future weak points. This is thus a learning system that can be checked in a simplified manner.
[0019] Furthermore, it has proven to be advantageous to check the effects of the elimination of a weak point on other detected weak points. For example, it can be proposed that multiple functional units are affected by a weak point. For example, the weak point can be closed again because the firewall settings are not adapted or the firewall settings are changed by blocking ports. Due to the measures described, the corresponding strategy, in particular the superior program, can again show that this type of change is also suitable for other weak points or yet another weak point and can therefore be implemented there in the same way. Thus, multiple weak points can be eliminated simultaneously by port or configuration changes. In addition, a so-called patch can also eliminate multiple weak points and can be used for multiple components.
[0020] Furthermore, it has proven to be advantageous to provide the electronic computing device as a central electronic computing device outside the machine. For example, the electronic computing device can then be connected to a network in order to be able to provide the corresponding patch. Furthermore, the electronic computing device can be coupled to a plurality of machines so that the corresponding countermeasures on one machine can also be relevant for other machines. Thus, a closed system can be created in which the inspection of weak points can again be advantageously carried out based on the electronic computing device.
[0021] According to another advantageous embodiment, the execution of the elimination measure is automatically carried out by means of an electronic computing device. In particular, it can be provided that a suggestion of elimination measures is provided to the electronic computing device, wherein the electronic computing device in turn automatically executes the elimination measure based on the suggestion. Alternatively, it can be provided that, for example, a suggestion is provided to a user of the electronic computing device, and the user can manually execute the corresponding elimination measure.
[0022] In particular, the proposed method is a computer-implemented method. Therefore, another aspect of the invention relates to a computer program product having a program code medium, which, when processed by an electronic computing device, causes the electronic computing device to perform the method according to the aforementioned aspect. The computer program product can also be referred to as a computer program.
[0023] Furthermore, the present invention also relates to a computer-readable storage medium having the computer program product.
[0024] Another aspect of the invention relates to an electronic computing device for monitoring a control program of at least one functional unit of a machine installation, wherein the electronic computing device is configured to execute the method according to the above-mentioned aspect. In particular, the method is executed by means of the electronic computing device.
[0025] The electronic computing device has, for example, electronic components, such as a processor, circuits, in particular integrated circuits, and further electronic components in order to be able to carry out the corresponding method steps.
[0026] Advantageous embodiments of the method can be viewed as advantageous embodiments of a computer program product, a computer-readable storage medium and an electronic computing device. The electronic computing device has in particular physical features to be able to carry out the corresponding method steps.
[0027] For use cases or applications that may arise in the method and are not explicitly described here, it may be provided that according to the method an error message and / or a request for inputting user feedback and / or standard settings and / or a predefined initial state are output. BRIEF DESCRIPTION OF THE DRAWINGS
[0028] Now, the present invention will be explained in more detail based on the embodiments shown in the accompanying drawings. To this end:
[0029] Figure 1 shows a schematic flow chart according to one embodiment of the method; and
[0030] Figure 2 A schematic block diagram according to one embodiment of an electronic computing device is shown.
[0031] In the figures, identical or functionally identical elements are provided with the same reference symbols. DETAILED DESCRIPTION
[0032] Figure 1 A schematic flow chart according to one embodiment of the method is shown. In particular, Figure 1 A method for using an electronic computing device 10 ( Figure 2 ) Monitoring equipment and facilities 16( Figure 2 ) of at least one functional unit 14 ( Figure 2 ) control program 12( Figure 2 ) method.
[0033] In a first step S1, a weak point 18 in the control program 12 is detected ( Figure 2 ). In the second steps S2.1, S2.2, S2.3, the detected weak points 18 are classified based on the weak points that have been analyzed in the past. In the third step S3, elimination measures for the weak points 18 are then proposed based on the classification.
[0034] In particular, Figure 1 It is shown that the weak points 18 are divided into at least two categories, in particular at least three categories. In particular, the first category can refer to the weak points 18 as open, which is represented in the present case by step S2.1. In addition, the second category can refer to the weak points 18 as closed, which is represented in the present case by a second step S2.2. In addition, the weak points 18 can be referred to as not being relevant to the functional unit 14, which is represented in the present case by a second step S2.3.
[0035] The classification can be carried out in particular based on the weak point properties of the weak point 18. In particular, the type and / or manufacturer of the functional unit 14 in question and / or the location of the functional unit 14 in question can be described with the aid of the weak point properties. For example, an update of the control program 12 can be recommended as a corrective measure.
[0036] Furthermore, it may be provided that within the classification weak point 18 is compared with other weak points and, if weak point 18 is similar to at least one other closed weak point, measures to eliminate other closed weak points are suggested for weak point 18 .
[0037] Furthermore, it can be provided that the classified weak points 18 are analyzed and taken into account for the detection and / or classification and / or elimination of future weak points. Furthermore, the influence of the elimination of weak points 18 on other detected weak points can also be checked.
[0038] Figure 2 A schematic block diagram according to one embodiment of an electronic computing device 10 is shown. Figure 2 In particular, it is shown that in block 20, a new weak point (e.g., weak point 18) is associated with a functional unit 14. In block 22, the state or category of the weak point 18 is evaluated by a machine learning algorithm, in particular an artificial intelligence, for example as a neural network. Then it is evaluated whether the weak point 18 is open. If this is the case, the closure of the weak point 18 is performed by the user in block 24. In block 26, the machine learning algorithm is then suggested again: to associate this with similar components, in particular based on so-called tags. In block 28, it is determined from block 22 or block 24 that the weak point 18 is closed. Then, in block 30, corresponding tags can be added based on the same changes. In block 32, the components or functional units 14 can be supplemented with tags based on the machine learning algorithm. For example, if a new component or functional unit 14 should be added, this is currently performed in block 34. Then, the corresponding tags can be added to the new functional unit 14 in block 36.
[0039] In particular, therefore, Figure 2 Shows the flow of the so-called security / weak point use case, where Figure 2The process is suggested in the tool-based method. The corresponding functional unit 14 is imported, for example, into the Industrial Vulnerability Manager (IVM), which is provided for monitoring and updating of safety significance in particular in the tool for software identification and is currently represented by the electronic computing device 10. The prerequisite for this is that the corresponding tags are supplemented; in this case, information is automatically provided to increase user friendliness. The tags are statically associated, for example, according to the functional unit, according to the facility component, according to the IP network or according to the configuration. All known information is used. The user can additionally add his own tags or attributes. For example, the tags or attributes can be derived from the planning of the automation system, for example, by indicating the automation component, such as a machine or machine type, an automation cell, an automation area, a production line, a station or associating with it. It is also possible to take into account the current operating data, such as the current operating mode of the machine or the status data of the physical engineering system. In addition, other tags can be associated. For this purpose, machine learning algorithms (especially algorithms based on artificial intelligence) can also be used as program support as an additional aid to increase the scope of association. In this case, in addition to the criteria to be checked, the machine learning algorithm also checks: how to act in similar situations in the past, or how to act here to reduce consumption. The labels or attributes can be evaluated to cluster and make recommendations representing improvements. The prerequisite is that all weak points 18 of this type can be found and changed by the electronic computing device 10. Based on the changes, the machine learning algorithm learns again and makes recommendations for further changes.
[0040] In this case, a label represents a property of a component or weak point 18, which label can be assigned manually or automatically and is machine-readable. The label can thus be further processed and compared by programs or machine learning algorithms, such as artificial intelligence. Examples are hardware / firmware / software versions, IP addresses, network ranges, open ports, physical locations, properties for specific plant components / production lines, groups that have handled weak points in the same way in the past, etc. A component or functional unit 14 can have any number of labels.
Claims
1. A method for monitoring a control program (12) of at least one functional unit (14) of a machine installation (16) by means of an electronic computing device (10), comprising the following steps: - (S1) detecting weak points (18) in the control program (12); - (S2.1, S2.2, S2.3) classifying the detected weak points (18) based on weak points that have been analyzed in the past; and -(S3) Proposing elimination measures for the weak points (18) according to the classification.
2. The method according to claim 1, It is characterized in that The weak points (18) are classified into at least two categories, in particular at least three categories.
3. The method according to claim 2, It is characterized in that The first category refers to the weak point (18) as open (S2.1), the second category refers to the weak point (18) as closed (S2.2), and the third category refers to the weak point (18) as not relevant to the functional unit (14) (S2.3).
4. The method according to any one of the preceding claims, It is characterized in that The classification is performed based on the weak point characteristics of the weak point (18).
5. The method according to claim 4, characterized in that The type and / or manufacturer of the functional unit (14) in question and / or the location of the functional unit (14) in question are described using the weak point properties.
6. The method according to any one of the preceding claims, It is characterized in that It is suggested to update the control program (12) as a remedial measure.
7. The method according to any one of the preceding claims, It is characterized in that The weak point (18) is compared with other weak points within the classification and, if the weak point (18) is similar to at least one other closed weak point, measures to eliminate other closed weak points are suggested for the weak point (18).
8. The method according to any one of the preceding claims, It is characterized in that The detection of the weak point (18) and / or the classification of the weak point (18) and / or the suggestion of the elimination measures are carried out with the aid of a machine learning algorithm of the electronic computing device (10).
9. The method according to any one of the preceding claims, It is characterized in that The classified weak points (18) are analyzed and taken into account for future detection and / or classification and / or elimination of weak points.
10. The method according to any one of the preceding claims, It is characterized in that The effect of eliminating the weak point (18) on other detected weak points is examined.
11. The method according to any one of the preceding claims, It is characterized in that The electronic computing device (10) is provided as a central electronic computing device (10) outside the machine.
12. The method according to any one of the preceding claims, It is characterized in that The execution of the elimination measures is automatically carried out by means of the electronic computing device (10).
13. A computer program product having a program code medium which, when processed by an electronic computing device (10), causes the electronic computing device (10) to execute the method according to any one of claims 1 to 12.
14. A computer-readable storage medium having at least one computer program product according to claim 13.
15. An electronic computer (10) for monitoring a control program (12) of at least one functional unit (14) of a machine installation (16), wherein the electronic computer (10) is designed to execute the method according to any one of claims 1 to 12.