Network threat real-time sensing and collaborative protection method, device and system and electronic medium

Abstract

According to the network threat real-time perception and collaborative protection method, device and system and the electronic medium, the network behavior characteristics are extracted to form the industrial control system behavior model, the network behavior mode of the industrial system during normal operation can be deeply known, and therefore abnormity can be recognized more accurately. In the process of generating the security rules, multi-source information including security policies, alarm logs, network behavior characteristics and the like is integrated, so that the security rules are more suitable for the actual situation of the industrial control network, and the risk of misjudgment is reduced. And in the aspect of describing the security threat portrait, not only can the basic threat information be analyzed, but also the risk level can be dynamically evaluated and the propagation path can be determined, so that a comprehensive and accurate basis is provided for subsequent targeted processing. And the linkage disposal process realizes dynamic adjustment of countermeasures, division of linkage elements and setting of linkage conditions and disposal processes according to threat levels and paths, can quickly isolate network security threat sources and block propagation paths of the network security threat sources through cooperative work of protection, recovery and alarm sub-strategies, and carries out timely emergency recovery on a system influenced by threats, so that the safety of the system is improved. The adverse effect of network threats on the industrial control system is reduced to the maximum extent, and the continuity, stability and safety of industrial production are guaranteed.

Description

Technical Field

[0001] The present application belongs to the field of industrial control network security protection, and specifically relates to a method, device, system and electronic medium for real-time perception and collaborative protection of network threats. Background Art

[0002] With the acceleration of industrialization and informatization, industrial control networks have undergone profound changes, gradually moving from the relatively closed "isolated" state to a new stage of high interconnection. During this transformation process, a large number of industrial control equipment are connected to the network, which has improved the level of intelligence and automation of industrial production, but also exposed them to a complex and changeable network environment, facing many security risks.

[0003] Currently, industrial control network security incidents occur frequently. For example, some key industrial facilities have been attacked by cyber attacks, resulting in serious consequences such as production interruption, equipment damage and even environmental pollution. Existing industrial control network security protection solutions mainly focus on traditional boundary protection technologies such as application firewalls and intrusion detection methods.

[0004] As a commonly used network security device, firewalls mainly filter network traffic based on preset rules. However, their rules are often static and difficult to adapt to the dynamically changing business needs and complex attack patterns in industrial control networks. For example, in the industrial production process, due to process adjustments or equipment upgrades, the pattern of network traffic may change, and the firewall may misjudge legitimate traffic as illegal, or fail to identify new malicious traffic in a timely manner. Although intrusion detection technology can detect some abnormal traffic, it has a high false alarm rate and missed alarm rate. On the one hand, normal operations in industrial control networks may be misjudged as intrusions due to their complexity, resulting in unnecessary alarms and subsequent processing; on the other hand, some cunning attacks may exploit loopholes in industrial protocols to bypass the detection of intrusion detection systems, thereby causing the system to be attacked without being detected.

[0005] In addition, the coupling between traditional information security strategies and the unique business functions of industrial control systems is weak, making it difficult to deeply understand and adapt to the security needs of industrial control processes. They are unable to fully and accurately perceive security data across the "information-function" level, which greatly reduces the accuracy of security risk warnings. For example, when faced with false operation or refusal signals of industrial control systems, it is difficult to accurately determine whether they are caused by network security threats, and when threats occur, they cannot be quickly and effectively linked and handled, making it difficult to minimize the impact of network threats, thereby bringing huge potential losses to industrial production. Summary of the invention

[0006] In view of the above shortcomings and deficiencies of the prior art, the present application provides a method, device, system and electronic medium for real-time perception and collaborative protection of network threats, which can comprehensively and deeply perceive industrial control network security threats, accurately depict the detailed portrait of threat events at the first time of detecting network threats, and determine their risk level and propagation path. Then, the response strategy and measure level can be dynamically adjusted, the linkage elements of industrial control system threat processing can be reasonably planned, the linkage conditions and disposal processes can be set, and finally the network security threat source can be quickly isolated, its propagation path can be blocked, and the affected system can be promptly restored in an emergency, so as to minimize the adverse effects of network threats on industrial control systems and ensure the continuity, stability and security of industrial production.

[0007] To achieve the above objectives, the present application adopts the following technical solution, a method for real-time perception and collaborative protection of network threats, including: S1: Obtain secure network data sources, extract network behavior features, and generate network behavior models; S2: Obtain security policies and alarm log features, analyze the correlation with the network behavior features, generate whitelist rules, and combine the whitelist rules with key security factors of the control system to generate security rules; S3: Analyze network behavior characteristics in real time, combine security rules and multi-source data to determine the legitimacy of network behavior, and profile threat events; S4: Based on the threat event portrait and combined with the industrial control system security strategy, a linkage protection method including a protection strategy, a recovery strategy and an alarm strategy is generated.

[0008] Furthermore, the S1 comprises the steps of: Select data sources that meet network security requirements; Use deep packet inspection technology and deep flow inspection technology to analyze data sources and obtain network behavior feature vectors and feature values; The characteristics of network behavior feature vectors and feature values ​​changing over time are statistically analyzed and collected into a network behavior feature library to form a network behavior model of the industrial control system.

[0009] Furthermore, the S2 comprises the steps of: Obtain security policies and historical alarm logs of industrial control system security products, and use deep learning algorithms to extract feature information from security policies; The extracted feature information is combined with the network behavior features and input into the correlation analysis module to calculate the correlation between the network behavior features and the security policy and alarm logs, and generate the network behavior whitelist rules for each device in the industrial control system; Obtain key security factors of industrial control systems other than device behavior, combine them with whitelist rules, and generate security rules for multi-dimensional information.

[0010] Furthermore, the S3 comprises the steps of: Use deep packet inspection technology and deep flow inspection technology to analyze the behavioral characteristics of real-time industrial control network traffic; Based on the generated security rules and combined with the multi-source data information of the industrial control system, the legality of the network behavior is determined. If it is determined to be illegal, its detailed information is stored in the threat event database; Analyze threat events, obtain basic information about threat events, risk levels of threat events, and propagation paths of threat events, and draw portraits of threat events.

[0011] Furthermore, in S4, the protection strategy includes: Based on the basic information of threat events and the propagation path of threat events, combined with security strategies, collaborative protection areas are divided; Using the active threat avoidance model and based on the adversarial generative network, we learn normal network behavior patterns and potential attack patterns through generative adversarial training to generate a set of methods for the protection system.

[0012] Furthermore, in S4, the recovery strategy includes: Based on real-time incremental data backup and regular full data backup, determine the data backup frequency and backup method according to the importance, change frequency and storage resource conditions of the industrial control system data; By backing up the integrity of the configuration and key data of industrial control system equipment, emergency recovery of industrial control system equipment damaged by threat events can be completed.

[0013] Furthermore, in S4, the alarm strategy includes: Extract log feature information of internal devices at all levels of the industrial control system, combine it with threat event profiling, and evaluate the threat level of threat events to each device; Based on the threat level, corresponding alarm information is pushed to specific devices. The alarm information includes the basic characteristics of the threat event, the impact of the threat event on itself, the generation and execution of protection strategies, whether emergency backup and recovery have been completed, etc.

[0014] The present invention also provides another embodiment, a network threat real-time perception and collaborative protection device, comprising: Network behavior feature extraction module: used to select secure network data, extract network behavior features through deep packet inspection technology and deep flow inspection technology, and generate network behavior models; Security rule generation module: used to obtain security policies and alarm log features, analyze the correlation with the network behavior features, generate whitelist rules, and generate security rules by combining the whitelist rules with key security factors of the control system; Security threat profiling module: Analyze network behavior characteristics in real time, combine security rules and multi-source data to determine the legitimacy of network behavior, and profile threat events; Linkage protection module: Based on the threat event portrait and combined with the industrial control system security strategy, a linkage protection method including protection strategy, recovery strategy and alarm strategy is generated.

[0015] The present application also discloses a network threat real-time perception and collaborative protection system, including: one or more processors; A computer readable storage medium for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the method described in any one of claims 1 to 7.

[0016] The present application also discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 7 are implemented.

[0017] The beneficial effects of this application are: 1. Accurate threat perception: Integrate DPI and DFI technologies to deeply analyze traffic, integrate multi-source data, accurately locate threats, analyze multi-dimensional information and dynamically assess risks, reduce misjudgments and missed judgments, and protect industrial production from threat interference.

[0018] 2. Comprehensive threat portrait: Use a variety of detection technologies to analyze traffic characteristics and combine multi-source data to determine threats. Use advanced means to analyze information, assess risks, restore paths, draw accurate threat portraits, and help formulate effective response strategies.

[0019] 3. Efficient collaborative protection processing: Linking protection, recovery, and alarm strategies to achieve multi-level protection, rapid data recovery, and timely and accurate alarm push, improving the overall efficiency of responding to threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The present application is described with the aid of the following drawings: Figure 1 The flowchart of the real-time perception and collaborative protection method of network threats in this application is shown; Figure 2 The flowchart of the method for generating a network behavior model in the present application is shown; Figure 3 The flowchart of the method for generating security rules of the present application is shown; Figure 4 A flow chart of the method for profiling threat events in the present application is shown. DETAILED DESCRIPTION

[0021] In order to better explain the present invention and facilitate understanding, the present invention is described in detail below in conjunction with the accompanying drawings through specific implementation methods. It is understood that the specific embodiments described below are only used to explain the relevant inventions, rather than to limit the invention. It should also be noted that the embodiments and features in the embodiments of this application can be combined with each other in the absence of conflict; for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0022] As can be seen from the background technology, in the field of industrial control, the coupling between traditional information security strategies and the unique business functions of industrial control systems is weak, and it is impossible to fully and accurately perceive security data across the "information-function" level, which greatly reduces the accuracy of security risk warnings. When a threat occurs, it is impossible to deal with it quickly and effectively, and it is difficult to control the impact of network threats to a minimum, which brings huge potential losses to industrial production.

[0023] In response to the above problems, the present application provides a method for real-time perception and collaborative protection of network threats, which can accurately perceive industrial control network security threat events, accurately portray the detailed portrait of the threat event at the first time of detecting the network threat, and determine its risk level and propagation path. Then dynamically adjust the response strategy and measure level, reasonably plan the linkage elements of industrial control system threat processing, quickly isolate the source of network security threats, block its propagation path, and perform timely emergency recovery on the systems affected by the threats, so as to minimize the adverse effects of network threats on industrial control systems and ensure the continuity, stability and security of industrial production. Specific methods include Figure 1 As shown, including: S1: Obtain secure network data sources, extract network behavior features, and generate network behavior models. The industrial control system is a complex integrated system that includes many industrial control devices with different functions. These industrial control devices include multiple modules such as data monitoring, data acquisition, and distributed control. Each functional module will generate unique network behaviors during operation, and these behaviors are accompanied by specific network data features. For example, the specific time period when the behavior occurs, the subject of the behavior (that is, the device or system module that initiates the behavior) and the object (the object on which the behavior acts), the keywords contained in the network traffic corresponding to the behavior, and the specific permutations and combinations of industrial control protocol function codes.

[0024] Because the configuration and operation mode of industrial control systems in actual application scenarios, especially after installation and commissioning are completed and put into formal operation, are basically stable and highly deterministic. Based on this feature, through statistical analysis of a large amount of historical data, relatively stable and accurate behavior models of various types of industrial control equipment can be constructed. In an embodiment of the present invention, by reasonably selecting a data source related to the industrial control system and obtaining data from the selected data source, the network behavior model of the industrial control system is determined based on the obtained data. Based on the determined data model, it is determined whether there is abnormal behavior in the industrial control system network, so that effective monitoring of network threats to the industrial control system can be achieved.

[0025] Among them, the method of generating a network behavior model is as follows: Figure 2 shown.

[0026] S101: Select a data source that meets network security requirements. The implementation of the present invention is primarily about selecting a suitable data source. These data sources must be able to accurately measure whether the industrial control system meets network security requirements, for example, including the industrial control system's network communication log, device status log, control instruction log, and data transmission log. It is also required to select a data source during the normal operation of the industrial control system that is not subject to network threats as the data source for the network behavior feature analysis of the present invention, so as to build a stable and accurate behavior model.

[0027] S102: Use deep packet inspection (DPI) and deep flow inspection (DFI) technologies to analyze data sources and obtain network behavior feature vectors and feature values. Using DPI and DFI technologies, we can analyze security data sources more deeply and comprehensively, obtain the feature vectors and feature values ​​of each network behavior under the normal operation of the industrial control system, and provide a basis for building a network behavior model.

[0028] S103: Count the characteristics of network behavior feature vectors and feature values ​​changing over time and collect them into a network behavior feature library to form a network behavior model of the industrial control system. Under normal operating conditions, the characteristics of the feature vectors and feature values ​​of each network behavior of the industrial control system changing over time are counted, and all extracted behavior features are integrated into a specially constructed network behavior feature library. Through data processing and model construction of all network behavior features in the feature library, a network behavior model of the industrial control system equipment is finally formed. The network behavior model constructed in this way can more accurately reflect the behavior pattern of the industrial control system equipment under normal operating conditions, thereby laying a solid foundation for the subsequent timely and accurate discovery of abnormal behavior.

[0029] S2: Obtain security policies and alarm log features, analyze the correlation with the network behavior features, generate whitelist rules, and combine the whitelist rules with key security factors of the control system to generate security rules. Figure 3 Shown, incl.

[0030] S201: Obtain the security policies and historical alarm logs of industrial control system security products, and use a deep learning algorithm based on a combination of convolutional neural networks and recurrent neural networks to extract the subject, object, behavior, action, and feature information of the security policy, such as the time when the log occurs, the subject, object, log type, and action of the log. In order to comprehensively evaluate the network security status of the industrial control system, it is necessary to integrate information from many aspects to generate security rules. First, obtain the security policies of various security products such as boundary protection and situational awareness deployed in the industrial control system, as well as rich historical alarm logs. And use appropriate deep learning algorithms to extract security policy and alarm log features, such as a deep learning algorithm based on a combination of convolutional neural networks and recurrent neural networks to extract key features in security policies and alarm logs. These features include the subject, object, behavior, action of the security policy, and the time when the log occurs, the subject, object, log type, and action of the log.

[0031] S202: The extracted feature information is combined with the network behavior features and input into the correlation analysis module to calculate the correlation between the network behavior features and the security policy and alarm log, and generate the network behavior whitelist rules for each device in the industrial control system. The network behavior features extracted in S1 and the feature information extracted from the security policy and alarm log in S201 are input into the correlation analysis module together. Through the correlation calculation model constructed in the correlation analysis module, these multi-source features are deeply processed, and the intrinsic correlation between the network behavior features and the security policy and alarm log is accurately calculated, thereby generating the network behavior whitelist rules for each device in the industrial control system.

[0032] S203: Acquire the key security factors of the industrial control system other than the device behavior, and combine them with the whitelist rules to generate security rules covering multi-dimensional information of the requester and responder of the network behavior, the scope of the allowed operation, the time period when the behavior occurs, the size range of the network traffic of the behavior, and the severity of the violation of the behavior. Among them, the key security factors of the industrial control system other than the device behavior mainly include the bandwidth utilization of the network traffic, the number of abnormal connections, the frequency of network attacks, the compliance of the behavior, etc. By effectively combining the key security factors of the industrial control system other than the device behavior with the whitelist rules, detailed security indicators containing all compliant or illegal behaviors are output, thereby generating security rules. These security indicators include but are not limited to the requester and responder of the network behavior, the scope of the allowed operation of the network behavior, the time period when the behavior occurs, the size range of the network traffic of the behavior, the severity of the violation of the behavior, etc., providing a clear and quantitative basis for subsequent security threat judgment.

[0033] S3: Real-time analysis of network behavior characteristics, combined with security rules and multi-source data, to determine the legitimacy of network behavior, and to characterize threat events. The specific steps of threat event characterization are as follows: Figure 4 Shown, incl.

[0034] S301: Use deep packet inspection technology and deep flow inspection technology to analyze the behavioral characteristics of real-time industrial control network traffic. In the real-time operation environment of the industrial control network, use deep packet inspection (DPI) technology and deep flow inspection (DFI) technology to deeply analyze the real-time industrial control network traffic and accurately extract the behavioral characteristics contained therein.

[0035] S302: Based on the generated security rules, combined with the multi-source data information of the industrial control system, the legality of the network behavior is determined. If it is determined to be an illegal behavior, its detailed information is stored in the threat event database. The extracted industrial control network behavior characteristics are combined with security rules and multi-source data information such as industrial control system production process parameters, interlocking data, attack feature library, vulnerability library, virus library, etc. to judge the legality of the network behavior, thereby identifying all illegal behaviors, and storing the behavior feature information of illegal behaviors in the threat event database as the main data source for subsequent threat event analysis.

[0036] S303: Analyze the threat event, obtain the basic information of the threat event, the risk level of the threat event and the propagation path of the threat event, and draw a portrait of the threat event. Among them, the threat time portrait includes multiple aspects.

[0037] Basic information of threat events: The threat event portrait records in detail the type of threat (such as network anomalies, illegal behavior, intrusion attacks, etc.), the initiator and responder of the threat event, the scope of the threat event, the time period of occurrence, and other key information. In addition, in order to deeply explore the potential connection between threat events, the pre-set threat event correlation analysis model is used to conduct a comprehensive and integrated analysis of the current threat event and the historical threat events, and calculate the correlation between each threat event on a certain time scale.

[0038] Threat event risk level: Risk level is an important indicator to measure the severity of threat events, and is used to characterize the degree of danger that threat events may cause to industrial control systems. This evaluation standard takes into account multiple factors, such as the prevalence of threat events (i.e., the frequency of occurrence of this type of threat in the industrial network environment), the accuracy of feature rules (this indicator is inversely proportional to the probability of false alarms, that is, the more accurate the feature rules, the lower the probability of false alarms), and the type of threat events. In the actual evaluation process, the basic risk level corresponding to different types of threat events can be set in advance, and then combined with the key features of the threat event (such as the complexity of the attack means, the importance of the attack target, etc.), prevalence, impact range and other factors, a specially designed specific risk level algorithm is used, mainly combined with the threat active avoidance model, and different gradients of threat event risk level thresholds are set for different threat events. The threat feature values ​​calculated in the threat active avoidance model are compared with the corresponding gradient thresholds to generate different risk levels, thereby dynamically evaluating the risk level of the threat event.

[0039] Threat event propagation path: Actively obtain the alarm logs of the industrial control system within a specific time period, and combine the key information such as the threat event initiator and responder analyzed in the threat event analysis system to deeply explore and extract various types of network entities involved in network attack events in each threat event stage. By calculating the target data of these network entities, the correlation of each threat event on the target time scale is calculated. According to the preset network threat event map, the correlation relationship between the various types of node entities in the threat event is established, that is, the correlation relationship between the various industrial control devices involved in the threat event, so as to obtain the network attack path corresponding to the threat event based on the correlation relationship, and then realize the restoration of the threat event propagation path.

[0040] S4: Based on the threat event portrait and combined with the industrial control system security strategy, a linkage protection method including a protection strategy, a recovery strategy and an alarm strategy is generated.

[0041] Based on the comprehensive gaps in the threat event portrait, determine the level changes and propagation paths of threat events, combine with the security strategy of the industrial control system, dynamically adjust the response methods and response measure levels, reasonably divide the collaborative protection areas, set collaborative protection conditions, and issue linkage protection methods including protection strategies, recovery strategies and alarm strategies to relevant subsystems and equipment of key systems.

[0042] The protection strategies include: Based on the basic information of threat events and the propagation path of threat events, combined with security strategies, collaborative protection areas are divided; Using the active threat avoidance model and based on the adversarial generative network, we learn normal network behavior patterns and potential attack patterns through generative adversarial training to generate a set of methods for the protection system.

[0043] The method for generating a protection system mainly includes the following steps: S401: Data collection: Collect data extensively from various relevant data sources, including but not limited to network equipment log records, system operation status monitoring data, and user behavior records. The collected data should fully reflect the normal state of the network environment and the information under various known intrusion types, providing rich and representative samples for subsequent analysis and model training.

[0044] S402: Data preprocessing; This step is crucial to ensure the quality and availability of data. Among them, feature normalization is a key operation, which mainly uses one-hot encoding technology to convert non-numeric features into numerical features. In a complex network environment, many features exist in non-numeric forms such as text and categories, such as network protocol type, user role, etc. One-hot encoding maps each category into a binary vector by creating virtual variables, so that these features can be effectively processed by subsequent algorithm models.

[0045] S403: Classifier training; The classifier designed by this method is mainly constructed based on the regression model. The data collected under normal state and known intrusion type state are used as the training set. The training set is the basis of model learning, and its quality and representativeness directly affect the performance of the classifier. During the training process, if non-numeric features are encountered, they are also converted into numerical features using unique hot encoding to ensure the consistency and processability of the data.

[0046] Based on the feature values ​​in the training set, regression equations are fitted for each state category. The construction of regression equations aims to capture the intrinsic relationship between features in different states. By learning from a large amount of sample data, the model can understand the characteristic patterns corresponding to normal network behavior and various intrusion behaviors. For example, for normal network behavior states, the regression equation may describe the relationship between network traffic, user access frequency and other features; while for a known intrusion type, the equation reflects the association between specific abnormal traffic patterns, malicious operation features and the intrusion behavior.

[0047] At the same time, the feature values ​​in the training set are used to calculate the threshold corresponding to each state category. The determination of the threshold is a key parameter for the classifier to accurately judge the network state. Through statistical analysis of the training data and model optimization, a reasonable threshold is set for each state category, so that the model can accurately identify the network state based on the comparison between the calculation result and the threshold when making judgments.

[0048] S404: Identify threat feature information. For a specific state to be tested in the test set, substitute its relevant features into the regression equation of each state category for calculation. The model determines whether it meets the preset threshold requirements based on the calculation results of the regression equation. If the calculation result is within the threshold range corresponding to the normal state category, the state is determined to be a normal network behavior state; if the result exceeds the normal range, but meets the threshold condition of a known intrusion type state, the state is identified as the corresponding known intrusion attack; if it neither meets the normal state threshold nor matches the threshold of any known intrusion type, it is determined to be an abnormal network behavior, which may indicate a new potential threat.

[0049] During the entire process of threat event propagation, based on the key information such as the characteristics and propagation path of the threat event, the security strategy of the industrial control system is fully combined, and the security data association analysis model that integrates the unique characteristics of the industrial control system is used to divide the collaborative protection area. In the divided protection area, the threat active avoidance model is used to intelligently generate a set of methods for a multi-level in-depth protection system. The protection system includes multiple layers such as the physical isolation layer, the network access control layer, the application protection layer, and the data encryption layer. It comprehensively isolates the threat propagation source from different levels, resolutely blocks the threat propagation path, and minimizes the adverse effects that may be caused by security incidents.

[0050] Recovery strategies include: Based on real-time incremental data backup and regular full data backup, determine the data backup frequency and backup method according to the importance, change frequency and storage resource conditions of the industrial control system data; By backing up the integrity of the configuration and key data of industrial control system equipment, emergency recovery of industrial control system equipment damaged by threat events can be completed.

[0051] After successfully isolating the threat source and blocking its transmission path, the recovery mechanism is immediately activated. Real-time incremental data backup technology is used in combination with regular full backup to ensure data integrity and recoverability. By backing up the configuration of industrial control system equipment and the integrity of key data, emergency recovery operations for industrial control system equipment damaged by threat events are completed in a timely and effective manner, so that the equipment can quickly return to normal working conditions and ensure the continuity of industrial production.

[0052] Alert strategies include: Extract log feature information of internal devices at all levels of the industrial control system, combine it with threat event profiling, and evaluate the threat level of threat events to each device; Based on the threat level, corresponding alarm information is pushed to specific devices. The alarm information includes the basic characteristics of the threat event, the impact of the threat event on itself, the generation and execution of protection strategies, whether emergency backup and recovery have been completed, etc.

[0053] By extracting the log feature information of internal devices at all levels of the industrial control system, combined with the threat characteristics, risk level, and impact range of the threat event, the impact of the threat event on the subsystems and specific devices of the subsystem within the industrial control system is comprehensively evaluated. According to the different degrees of impact, the corresponding alarm information is pushed to the specific subsystem or device. Among them, the alarm information includes the basic characteristics of the threat event, the impact of the threat event on itself, the generation and execution of the protection strategy, whether the emergency backup has been restored, etc., and the alarm information can be sent through multiple channels, including but not limited to emails, text messages, system pop-ups and sound alarms, and different alarm channels can be selected according to the priorities and preferences set by the user to ensure that relevant personnel can obtain the alarm information in a timely and accurate manner and take corresponding countermeasures.

[0054] In summary, the beneficial effects of the method of the present invention are: 1. Accurate threat perception: Integrate DPI and DFI technologies to deeply analyze traffic, integrate multi-source data, accurately locate threats, analyze multi-dimensional information and dynamically assess risks, reduce misjudgments and missed judgments, and protect industrial production from threat interference.

[0055] 2. Comprehensive threat portrait: Use a variety of detection technologies to analyze traffic characteristics and combine multi-source data to determine threats. Use advanced means to analyze information, assess risks, restore paths, draw accurate threat portraits, and help formulate effective response strategies.

[0056] 3. Efficient collaborative protection processing: Linking protection, recovery, and alarm strategies to achieve multi-level protection, rapid data recovery, and timely and accurate alarm push, improving the overall efficiency of responding to threats.

[0057] Another embodiment of the present invention is a network threat real-time perception and collaborative protection device, characterized by comprising: Network behavior feature extraction module: used to select secure network data, extract network behavior features through deep packet inspection technology and deep flow inspection technology, and generate network behavior models; Security rule generation module: used to obtain security policies and alarm log features, and generate whitelist rules through the built-in correlation analysis module with the network behavior features, and generate security rules by combining the whitelist rules with the key security factors of the control system; Security threat profiling module: Analyze network behavior characteristics in real time, combine security rules and multi-source data to determine the legitimacy of network behavior, and profile threat events; Linkage protection module: Based on the threat event portrait and combined with the industrial control system security strategy, a linkage protection method including protection strategy, recovery strategy and alarm strategy is generated.

[0058] The present invention can accurately extract network behavior characteristics and generate security rules, deeply analyze traffic, and comprehensively identify threats from multiple sources, effectively reducing the risk of misjudgment or missed judgment, and achieving accurate threat perception. It builds a multi-level in-depth protection system that can intelligently back up and restore data and issue timely and accurate alarms. The collaboration of multiple strategies can significantly improve the efficiency of responding to threats and ensure production continuity. It uses advanced technology to draw a comprehensive threat portrait, and with the help of a variety of intelligent algorithms and dynamic mechanisms, it can flexibly adapt to network changes and new threats, building a solid line of defense for industrial control network security.

[0059] A third embodiment of the present invention is a suspicious signal processing system, comprising: one or more processors; A computer readable storage medium for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the method described in any one of claims 1 to 7.

[0060] A fourth embodiment of the present invention is a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the device address allocation method described in any one of claims 1 to 7 are implemented.

[0061] It should be noted that in the claims, any reference signs placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several distinct components and by means of a suitably programmed computer. The use of the words first, second, third, etc., is for convenience of expression only and does not imply any order. These words may be understood as part of the component name.

[0062] In addition, it should be noted that, in the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0063] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments after knowing the basic creative concept. Therefore, the claims should be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present invention.

[0064] Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention should also include these modifications and variations.

Claims

1. A method for real-time perception and collaborative protection of network threats, characterized in that: include: S1: Obtain secure network data sources, extract network behavior features, and generate network behavior models; S2: Obtain security policies and alarm log features, analyze the correlation with the network behavior features, generate whitelist rules, and combine the whitelist rules with key security factors of the control system to generate security rules; S3: Analyze network behavior characteristics in real time, combine security rules and multi-source data to determine the legitimacy of network behavior, and characterize threat events; S4: Based on the threat event portrait and combined with the industrial control system security strategy, a linkage protection method including a protection strategy, a recovery strategy and an alarm strategy is generated.

2. The collaborative protection method according to claim 1, characterized in that: The S1 comprises the steps of: Select data sources that meet network security requirements; Use deep packet inspection technology and deep flow inspection technology to analyze data sources and obtain network behavior feature vectors and feature values; The characteristics of network behavior feature vectors and feature values ​​changing over time are statistically analyzed and collected into a network behavior feature library to form a network behavior model of the industrial control system.

3. The collaborative protection method according to claim 1, characterized in that: The S2 comprises the steps of: Obtain security policies and historical alarm logs of industrial control system security products, and use deep learning algorithms to extract feature information from security policies; The extracted feature information is combined with the network behavior features and input into the correlation analysis module to calculate the correlation between the network behavior features and the security policy and alarm logs, and generate the network behavior whitelist rules for each device in the industrial control system; Obtain key security factors of industrial control systems other than device behavior, combine them with whitelist rules, and generate security rules for multi-dimensional information.

4. The collaborative protection method according to claim 1, characterized in that: The S3 comprises the steps of: Use deep packet inspection technology and deep flow inspection technology to analyze the behavioral characteristics of real-time industrial control network traffic; Based on the generated security rules and combined with the multi-source data information of the industrial control system, the legality of the network behavior is determined. If it is determined to be illegal, its detailed information is stored in the threat event database; Analyze threat events, obtain basic information about threat events, risk levels of threat events, and propagation paths of threat events, and draw portraits of threat events.

5. The collaborative protection method according to claim 1, characterized in that: In S4, the protection strategy includes: Based on the basic information of threat events and the propagation path of threat events, combined with security strategies, collaborative protection areas are divided; Using the active threat avoidance model and based on the adversarial generative network, we learn normal network behavior patterns and potential attack patterns through generative adversarial training to generate a set of methods for the protection system.

6. The collaborative protection method according to claim 1, characterized in that: In S4, the recovery strategy includes: Based on real-time incremental data backup and regular full data backup, determine the data backup frequency and backup method according to the importance, change frequency and storage resource conditions of the industrial control system data; By backing up the integrity of the configuration and key data of industrial control system equipment, emergency recovery of industrial control system equipment damaged by threat events can be completed.

7. The collaborative protection method according to claim 1, characterized in that: In S4, the alarm strategy includes: Extract log feature information of internal devices at all levels of the industrial control system, combine it with threat event profiling, and evaluate the threat level of threat events to each device; Based on the threat level, corresponding alarm information is pushed to specific devices. The alarm information includes the basic characteristics of the threat event, the impact of the threat event on itself, the generation and execution of protection strategies, whether emergency backup and recovery have been completed, etc.

8. A network threat real-time perception and collaborative protection device, characterized in that: include: Network behavior feature extraction module: used to select secure network data, extract network behavior features through deep packet inspection technology and deep flow inspection technology, and generate network behavior models; Security rule generation module: used to obtain security policies and alarm log features, and generate whitelist rules through the built-in correlation analysis module with the network behavior features, and generate security rules by combining the whitelist rules with the key security factors of the control system; Security threat profiling module: Analyze network behavior characteristics in real time, combine security rules and multi-source data to determine the legitimacy of network behavior, and profile threat events; Linkage protection module: Based on the threat event portrait and combined with the industrial control system security strategy, a linkage protection method including protection strategy, recovery strategy and alarm strategy is generated.

9. A network threat real-time perception and collaborative protection system, characterized in that: include: one or more processors; A computer readable storage medium for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images