Industrial network topology construction method and system based on active and passive linkage

Abstract

The invention provides an industrial network topology construction method and system based on active and passive linkage, and the method comprises the following steps: S1, extracting equipment interface information and a neighbor link relation through an SNMP protocol, and screening stable and credible links in combination with multi-point routing link detection and time sequence analysis; s2, collecting flow data, carrying out direction modeling, analyzing and detecting abnormal links based on communication frequency, and filtering short-time interference links; s3, integrating active detection and passive acquisition equipment and link information, and realizing equipment and link merging based on the unique identifier of the equipment; and S4, performing link clustering, feeding back to an active detection module and a passive acquisition module, and optimizing an initiating node of the next round of active detection and an acquisition node of flow acquisition. The efficient and accurate network topology construction method is provided for solving the problems of multiple IP identifiers, complex topology links, noise link interference and the like of equipment in an industrial network, the noise link interference can be remarkably reduced, and the efficiency and accuracy of network management are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of machine learning, and in particular to a method and system for constructing industrial network topology based on active and passive linkage. Background Art

[0002] As the scale and complexity of industrial networks continue to increase, network topology construction has become a key task in industrial network management. Existing active detection methods rely on actively sending detection messages (such as ICMP ping or traceroute) to obtain device and link information. Although this method can quickly obtain network topology, it is susceptible to problems such as detection data loss, access permission restrictions, and confusion of multi-port devices. Current passive collection methods infer network topology by monitoring traffic and device logs. This method requires processing a large amount of data, and due to the lack of real-time performance, it is susceptible to link fluctuations and short-term interference.

[0003] In addition, in the industrial network environment, the topology links are complex and there are multiple link redundancies in the network, which makes it difficult to judge the link status; there are many noisy links, and due to unstable data collection and a large amount of industrial intrusion attack traffic, a large number of short-term interference links are introduced, affecting the topology accuracy. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide an industrial network topology construction method and system based on active and passive linkage, which integrates the advantages of active detection and passive collection, adopts link stability evaluation and interference link identification mechanism, and realizes the robustness and accuracy of topology construction.

[0005] To achieve the above object, the present invention adopts the following technical solution: a method for constructing industrial network topology based on active and passive linkage, comprising the following steps: Step S1, extracting device interface information and neighbor link relationships through SNMP protocol, combining multi-point routing link detection and time series analysis to screen links; Step S2: Collect traffic data, perform directional modeling, detect abnormal links based on communication frequency analysis, and filter short-term interference links; Step S3, integrating the active detection of step S1 and the passive collection of device and link information of step S2, and merging the device and link based on the device unique identifier; Step S4: perform link clustering to obtain various core nodes, and feed them back to the active detection and passive collection modules to optimize the initiating node of the next round of active detection and the collection node of traffic collection.

[0006] In a preferred embodiment, in step S1, the device interface information and neighbor link relationship are extracted through the SNMP protocol, and a dynamic adaptive retry algorithm is designed for devices with packet loss or response delay: in, is the timeout threshold, For a single retry interval, dynamically adjust the number of retries , improve the collection success rate.

[0007] In a preferred embodiment, in step S1, the combination of multi-point routing link detection and time series analysis to screen links specifically includes recording timestamps of link detection and analyzing link stability. The link stability evaluation method is as follows: in, T W is the time window, V c is the number of effective detections of the link within a unit time t; the stability of the link satisfies , retain the link, is the link stability threshold obtained through active detection.

[0008] In a preferred embodiment, in step S2, the traffic data specifically includes classified traffic in the communication direction, longitudinal traffic in cross-subnet communication, and lateral traffic in the same subnet communication; the abnormal link is detected based on the communication frequency analysis, and the communication frequency is calculated as follows: in, C p Indicates link P In the time window ∆T The number of times it was detected within the range; In the time window ∆T Middle Link P The number of occurrences of or , then mark the link P It is an abnormal link; is the mean link frequency; is the link frequency standard deviation, k is the anomaly detection factor.

[0009] In a preferred embodiment, in step S3, the device and link merging is implemented based on the device unique identifier; the device merging is specifically to merge the device information recorded in different data sources to form a unified device view; the link merging is specifically to retain the same link only once, and the link with the highest weight is retained first; the link weight is determined by the link stability and communication frequency: in, W p Indicates link P The corresponding link weight, is the weight coefficient, which is used to adjust the impact of stability and frequency on link priority.

[0010] In a preferred embodiment, the device information includes MAC address and interface information.

[0011] In a preferred embodiment, step S4 comprises the following steps: 1) Calculate the link similarity matrix M ; 2) Convert the similarity matrix into a distance matrix D ; 3) Use DBSCAN to cluster the links; 4) Identify core nodes in each cluster; 5) Feedback core nodes to active detection and passive collection modules.

[0012] In a preferred embodiment, the link similarity matrix is ​​calculated M ,link and The similarity between them is calculated as follows: in Indicates link The endpoint node set, Indicates link The endpoint node set of The distance matrix D : .

[0013] In a preferred embodiment, the core node is identified in each cluster, and the core node in each cluster is the link with the highest link weight in cluster C. The nodes included , the node that appears most frequently in the entire cluster.

[0014] The present invention also provides an industrial network topology construction system based on active and passive linkage, which runs the industrial network topology construction method based on active and passive linkage, including an active detection module, a passive acquisition module, a link integration module and a link clustering module: The active detection module is used to send detection messages from the detection node to the network to obtain device interface information and link connection status; The passive collection module is used to monitor traffic on the collection point device and obtain device communication behavior and link traffic data; The link integration module is used to integrate active detection and passive collection data, merge multi-source link and device information, and generate a unified device view and link model; The link clustering module is used to cluster links according to their similarity, identify core nodes in the network, and feed the core nodes back to the active detection and passive collection modules.

[0015] Compared with the prior art, the present invention has the following beneficial effects: the present invention effectively compensates for the limitations of a single method through active and passive linkage, combines stability scoring with communication frequency analysis to screen trusted links, and significantly reduces noise link interference. By introducing a dynamic timeout retry mechanism and a core node feedback mechanism, active detection efficiency is higher, and key devices and links can be quickly discovered; by using link clustering and core node identification, key devices and links in the network can be accurately located, providing a priority basis for subsequent traffic collection and network management, and optimizing resource allocation. The present invention provides a more efficient, accurate and robust solution in the field of industrial network topology. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of an industrial network topology construction method based on active and passive linkage is provided for the application.

[0017] Figure 2 A structural diagram of an industrial network topology construction method based on active and passive linkage provided for the application. DETAILED DESCRIPTION

[0018] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0019] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0020] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0021] like Figure 1-2 As shown, the present invention provides an industrial network topology construction method based on active and passive linkage, comprising the following steps: S1. Extract device interface information and neighbor link relationships through SNMP (Simple Network Management Protocol), combine multi-point routing link detection and time series analysis to select stable and reliable links; Design a dynamic adaptive retry algorithm for devices with packet loss or response delay: in, is the timeout threshold. The interval between single retries. Dynamically adjust the number of retries , improve the collection success rate.

[0022] Record the timestamp of link detection and analyze link stability. The link stability evaluation method is as follows: in, T W is the time window, V c is the number of effective detections of the link within a unit time t; the stability of the link satisfies , retain the link, is the link stability threshold obtained through active detection.

[0023] S2, collect traffic data, perform directional modeling, detect abnormal links based on communication frequency analysis, and filter short-term interference links; Traffic is classified according to the communication direction, which is the vertical traffic for cross-subnet communication and the horizontal traffic for communication within the same subnet. Calculate the communication frequency of the link: in, C p Indicates link P In the time window ∆T The number of times a time window is detected within a range; for example, if a 1-hour time window is selected for analysis, Cp Indicates the number of times link P is detected within 1 hour.

[0024] In the time window ∆T Middle Link P The number of occurrences of . If or , then mark the link P This is an abnormal link. is the mean link frequency, is the link frequency standard deviation, k is the anomaly detection factor.

[0025] S3, integrating the device and link information of active detection and passive collection, and merging the devices and links based on the unique device identifier; Merge the device information (such as MAC address, interface information) recorded in different data sources to form a unified device view. The link is merged, and the same link (multiple link records between the same device) is only retained once, and the link with the highest weight is retained first. The link weight is determined by the link stability and communication frequency: in, W p Indicates link P The corresponding link weight, is a weight coefficient used to adjust the impact of stability and frequency on link priority. Preferably, The value is 1.

[0026] S4. Perform link clustering to obtain various core nodes, and feed them back to the active detection and passive collection modules to optimize the initiating node of the next round of active detection and the collection node of traffic collection.

[0027] The following steps are involved: 1) Calculate the link similarity matrix M ; link and The similarity between them is calculated as follows: in Indicates link The endpoint node set, Indicates link The endpoint node collection.

[0028] 2) Convert the similarity matrix into a distance matrix D ; Distance Matrix D : .

[0029] 3) Use DBSCAN to cluster the links; 4) Identify core nodes in each cluster; Select the core node in each cluster as the link with the highest link weight in cluster C Contained nodes The node that appears most frequently in the entire cluster.

[0030] 5) Feedback core nodes to active detection and passive collection modules.

[0031] like Figure 2 As shown, the present invention provides an architecture diagram of an industrial network topology construction method based on active and passive linkage, including the following modules: an active detection module, a passive acquisition module, a link integration module and a link clustering module.

[0032] The active detection module is used to send detection messages from the detection node to the network to obtain device interface information and link connection status; The passive collection module is used to monitor traffic on the collection point device and obtain device communication behavior and link traffic data; The link integration module is used to integrate active detection and passive collection data, merge multi-source link and device information, and generate a unified device view and link model; The link clustering module is used to cluster links according to their similarity, identify core nodes in the network, and feed the core nodes back to the active detection and passive collection modules.

[0033] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for constructing industrial network topology based on active and passive linkage, characterized in that: The following steps are involved: step S1. Extract device interface information and neighbor link relationships through SNMP protocol, combine multi-point routing link detection and time series analysis to screen links; Step S2: Collect traffic data, perform directional modeling, detect abnormal links based on communication frequency analysis, and filter short-term interference links; Step S3, integrating the active detection of step S1 and the passive collection of device and link information of step S2, and merging the device and link based on the device unique identifier; Step S4: perform link clustering to obtain various core nodes, and feed them back to the active detection and passive collection modules to optimize the initiating node of the next round of active detection and the collection node of traffic collection.

2. The method for constructing an industrial network topology based on active and passive linkage according to claim 1, characterized in that: In step S1, the device interface information and neighbor link relationship are extracted through the SNMP protocol, and a dynamic adaptive retry algorithm is designed for devices with packet loss or response delay: in, is the timeout threshold, For a single retry interval, dynamically adjust the number of retries , improve the collection success rate.

3. The method for constructing industrial network topology based on active and passive linkage according to claim 1, characterized in that: In step S1, the combination of multi-point routing link detection and time series analysis to screen links specifically includes recording the timestamp of link detection and analyzing link stability. The link stability evaluation method is as follows: in, T W is the time window, V c is the number of effective detections of the link within a unit time t; the stability of the link satisfies , retain the link, is the link stability threshold obtained through active detection.

4. The method for constructing industrial network topology based on active and passive linkage according to claim 1, characterized in that: In step S2, the traffic data specifically includes classified traffic in the communication direction, longitudinal traffic in cross-subnet communication, and transverse traffic in the same subnet communication; the abnormal link is detected based on the communication frequency analysis, and the communication frequency is calculated as follows: in, C p Indicates link P In the time window ∆T The number of times it was detected within the range; In the time window ∆T Middle Link P The number of occurrences of or , then mark the link P It is an abnormal link; is the mean link frequency; is the link frequency standard deviation, k is the anomaly detection factor.

5. The method for constructing industrial network topology based on active and passive linkage according to claim 1, characterized in that: In step S3, the device and link merging is implemented based on the device unique identifier; the device merging is specifically to merge the device information recorded in different data sources to form a unified device view; the link merging is specifically to retain the same link only once, and the link with the highest weight is retained first; the link weight is determined by the link stability and communication frequency: in, W p Indicates link P The corresponding link weight, is the weight coefficient, which is used to adjust the impact of stability and frequency on link priority.

6. The method for constructing industrial network topology based on active and passive linkage according to claim 5, characterized in that: Device information includes MAC address and interface information.

7. The method for constructing industrial network topology based on active and passive linkage according to claim 1, characterized in that: The step S4 comprises the following steps: 1) Calculate the link similarity matrix M ; 2) Convert the similarity matrix into a distance matrix D ; 3) Use DBSCAN to cluster the links; 4) Identify core nodes in each cluster; 5) Feedback core nodes to active detection and passive collection modules.

8. The method for constructing industrial network topology based on active and passive linkage according to claim 7, characterized in that: The calculation link similarity matrix M ,link and The similarity between them is calculated as follows: in Indicates link The endpoint node set, Indicates link The endpoint node set of The distance matrix D : .

9. The method for constructing industrial network topology based on active and passive linkage according to claim 8, characterized in that: The core node is identified in each cluster, and the core node in each cluster is the link with the highest link weight in cluster C. The nodes included , the node that appears most frequently in the entire cluster.

10. An industrial network topology construction system based on active and passive linkage, characterized in that An industrial network topology construction method based on active and passive linkage as described in any one of claims 1 to 9 is run, comprising an active detection module, a passive acquisition module, a link integration module and a link clustering module: The active detection module is used to send detection messages from the detection node to the network to obtain device interface information and link connection status; The passive collection module is used to monitor traffic on the collection point device and obtain device communication behavior and link traffic data; The link integration module is used to integrate active detection and passive collection data, merge multi-source link and device information, and generate a unified device view and link model; The link clustering module is used to cluster links according to their similarity, identify core nodes in the network, and feed the core nodes back to the active detection and passive collection modules.

Images