Networking industrial equipment identification method based on time sequence state model

Abstract

The invention provides a networking industrial equipment identification method based on a time sequence state model. Constructing a multifunctional network detection data packet for networked industrial equipment capable of returning equipment information, and performing deep detection on the networked industrial equipment; filtering and grouping the network detection data to obtain grouped data related to equipment operation; feature data packet extraction is carried out on each group of data; constructing a group time sequence state model based on the feature data packet; aggregating all groups of related time sequence state models for each device to form a device time sequence state model set; and constructing an unknown networked industrial equipment identification mechanism based on the equipment time sequence state model set. According to the method, the time sequence state model set of the networked industrial equipment under the condition of different detection data packets is established, so that the network characteristics of different industrial equipment are described relatively comprehensively, and the real identity information of unknown industrial equipment exposed on the network can be identified more accurately.

Description

Technical Field

[0001] The invention relates to the field of network security of industrial control systems, and in particular to a method for identifying networked industrial equipment based on a temporal state model. Background Art

[0002] With the continuous development of industrial information technology, more and more industrial equipment is connected to the enterprise information network and even the Internet to support the integrated operation management of enterprises and the remote maintenance of industrial equipment manufacturers. Due to the limited computing and storage resources of industrial equipment, it is impossible to deploy various security protection measures like traditional IT systems, and it is difficult to achieve timely remediation of security vulnerabilities. Therefore, comprehensive discovery of such networked industrial equipment and accurate identification of its type, manufacturer, model and other information can effectively help related companies design more targeted protection measures and reduce the attack surface of industrial operation networks.

[0003] Existing networked industrial equipment identification technologies are mainly concentrated in the field of the Internet of Things. There is relatively little research on industrial control equipment identification technologies. The relevant technologies can be roughly divided into identification technologies based on network traffic content modeling and identification technologies based on data flow statistical feature modeling. Identification technologies based on network traffic content modeling distinguish different industrial control devices by extracting semantic features related to the industrial protocol load at the application layer, and they have a strong dependence on specific industrial protocols. Identification technologies based on data flow statistical feature modeling mainly characterize the network behavior of different industrial control devices by extracting some statistical features of the data flow, such as flow duration, statistical values ​​of packet time intervals, and statistical values ​​of packet sizes, but the granularity of feature extraction is relatively coarse and the recognition accuracy is limited.

[0004] Using the directed length of data packets to characterize device behavior characteristics has become an important way to identify IoT devices, but there are essential differences between industrial control devices and IoT devices in terms of application fields, device resources, and operating modes, resulting in the fact that the directed length of data packets is insufficient to fully characterize the software and hardware characteristics of industrial control devices. Therefore, the present invention proposes a timing state model to describe the network behavior characteristics of industrial control devices, which not only uses the directed length of data packets to characterize the basic semantic information of data packets, but also introduces the spatial location information and timing state information of data packets to more accurately characterize the spatiotemporal state of data packets. The set of industrial equipment timing state models established based on the above ideas can more accurately identify unknown industrial equipment exposed on the Internet. Summary of the invention

[0005] The present invention proposes a method for identifying networked industrial equipment based on a temporal state model, which aims to solve the problem that the existing active detection method of networked industrial equipment cannot obtain relevant information of unknown devices (networked industrial equipment that cannot directly return device information) to support the risk assessment of networked industrial equipment.

[0006] The technical solution adopted by the present invention to achieve the above-mentioned purpose is:

[0007] A method for identifying networked industrial equipment based on a time series state model comprises the following steps:

[0008] 1) Based on networked industrial devices that can return device information, a multifunctional network detection data package is constructed to conduct in-depth detection;

[0009] 2) Filter and group the network detection data to obtain group data related to device operation;

[0010] 3) Extract characteristic data packets for each operation group;

[0011] 4) constructing a group timing state model based on characteristic data packets;

[0012] 5) Aggregate all group-related timing state models for each device to form a device timing state model set;

[0013] 6) Based on the set of equipment timing state models, a mechanism for identifying unknown networked industrial equipment is constructed to realize the identification of networked industrial equipment.

[0014] The multifunctional network detection data packet is a device information acquisition data packet related to the industrial control protocol and contains multiple device access function codes, and is used to realize the functions of reading the data area, register and device status of industrial equipment.

[0015] The step 2) comprises the following steps:

[0016] 2.1) Filter out the unrepresentative data packets or data packets caused by communication anomalies in the network detection data, including three-way handshake data packets, retransmission data packets and Rest data packets;

[0017] 2.2) According to the five-tuple format of <source IP, source port, destination IP, destination port, transport layer protocol>, the data packets are aggregated into different data streams;

[0018] 2.3) Divide the data stream into different operation groups according to the function code of the detection data.

[0019] The step 3) comprises the following steps:

[0020] 3.1) Construct the spatiotemporal expression of the data packet:

[0021] p i = <t i ,l i ,d i >

[0022] Among them, p i represents the i-th data packet in a data stream; l i Indicates p i Relative position in the data stream; d i Indicates p i The directional length in the data stream is the combination of the direction and length of the data packet; t i Indicates p i Relative time in the data stream:

[0023]

[0024] Among them, T i Indicates data packet p i Timestamp; T 0 Indicates the first data packet p in the data stream 0 The timestamp of FlowDuration indicates the duration of the entire data flow;

[0025] 3.2) Use the DBSCAN clustering algorithm to cluster all the data packets in the operation group into initial clusters, where the distance between the data packets is represented by the directed length d i To calculate; if the directions of the data are different, the distance is the maximum; if the directions are the same, the distance is the absolute value of the difference in the length of the data packets;

[0026] 3.3) For the initial cluster obtained, all the data packets in it are divided according to data flow and relative position l i Sorting is performed, and data packets with the same sequence number after sorting in different data streams are aggregated into a new cluster;

[0027] 3.4) For new clusters, a threshold is set according to the number of data flows in the operation group, clusters whose sizes are within the threshold range are retained, and all data packets in the cluster are determined as characteristic data packets.

[0028] The step 4) comprises the following steps:

[0029] 4.1) Reaggregate the characteristic data packets into different data flow sets according to the device IP and operation type;

[0030] 4.2) Align the data stream set, select the data stream with the largest number of characteristic data packets and directed length sequence in the set as the representative data stream of the corresponding operation, and use it to construct the time series state model;

[0031] 4.3) Construct a group timing state model based on all representative data flows of the same operation type of the same device.

[0032] The group of sequential state models is based on a finite state machine, wherein the directed length and relative time of the characteristic data packets are used as transition conditions between states, and all transition conditions are matched in sequence as matching conditions of the sequential state model, specifically:

[0033] TSM = {Length, Time}

[0034] Length=(d 0 ,d 1 ,......,d n )

[0035] Time=(0:(μ 0 ,σ 0 ),1:(μ 1 ,σ 1 ),......,n:(μ n ,σ n ))

[0036] Among them, TSM is the time series state model; Length is the directed length sequence; Time is the relative time distribution corresponding to the directed length; d i , μ i , σ i They represent the directional length of the data packet at position i, the average value of the relative time, and the standard deviation of the relative time.

[0037] The relative time judgment method of the timing state model is:

[0038] μ-nσ<t i <μ+nσ

[0039] Wherein, μ and σ are the mean and standard deviation of the Gaussian distribution of the relative time of the corresponding position in the representative data stream; n is an integer in the range of {1,2,3}, corresponding to the 1σ, 2σ and 3σ criteria of the Gaussian distribution, respectively.

[0040] The step 5) is specifically as follows:

[0041] Aggregate the timing state models of all operation types related to a device into a set, which uses the operation type as the index and the corresponding timing state model as the value, that is, the timing state model set D of the device. i ; If a device does not support a certain operation type, the corresponding value is NULL, which is expressed as:

[0042] D i ={ <o 1,TSM i1 >, <o 2 ,NULL>,…, <o j ,TSM ij >,…}

[0043] Among them, j Indicates an operation type; TSM ij Indicates that j The corresponding timing state model; NULL means that the device does not support the corresponding operation type.

[0044] The step 6) comprises the following steps:

[0045] 6.1) Use multi-function network detection data packets to scan unknown networked industrial devices and obtain their network detection data;

[0046] 6.2) Filter and group the network detection data to generate a spatiotemporal expression of the data packet, forming a set of the device's operation type and the corresponding representative data stream; for unsupported operation types, the corresponding representative data stream is set to NULL;

[0047] 6.3) Perform operation type support matching, using whether the values ​​corresponding to the operation type are all NULL or not NULL as the judgment standard, and extract all matching known devices;

[0048] 6.4) For all matching known devices, input the representative data streams corresponding to all manipulation types of the device into the corresponding timing state model of the known device; filter out the known devices that can fully match the device, and use the label of the known device as the label of the device.

[0049] A networked industrial equipment identification system based on a temporal state model, comprising:

[0050] A detection packet building module is used to build a multifunctional network detection packet based on networked industrial devices that can return device information to conduct in-depth detection;

[0051] A detection data processing module is used to filter and group the network detection data to obtain group data related to device operation;

[0052] A feature data packet extraction module is used to extract feature data packets for each operation group;

[0053] A timing state model building module, used for building a group timing state model based on a characteristic data packet;

[0054] A model aggregation module, used to aggregate all group-related timing state models for each device to form a device timing state model set;

[0055] The device identification module is used to build an unknown networked industrial device identification mechanism based on a set of device timing state models to realize the identification of networked industrial devices.

[0056] The present invention has the following beneficial effects and advantages:

[0057] 1. By using network features at the packet level, we get rid of the dependence on specific industrial protocols and provide a more fine-grained description of industrial equipment network behavior than data flow statistical features, making this method more applicable than existing industrial control equipment identification methods.

[0058] 2. The use of time series state models can more strictly and accurately describe the network behavior patterns of networked industrial equipment, improve the accuracy of equipment identification, and avoid the long training time and complex data processing flow of machine learning and deep learning methods, and have higher operating efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a schematic flow diagram of the method of the present invention;

[0060] Figure 2 It is a schematic diagram of a data packet sequence generated by performing deep detection on industrial control equipment in an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation schemes, but is not intended to limit the technical solution of the present invention.

[0062] like Figure 1 As shown, a method for identifying networked industrial equipment based on a time series state model includes the following steps:

[0063] 1) Based on networked industrial devices that can return device information, a multifunctional network detection data package is constructed to conduct in-depth detection;

[0064] The construction of the multifunctional network detection data packet is specifically to realize a variety of device access function codes related to the industrial control protocol, including data area reading, register reading, device status reading and other safe and rich device information acquisition data packets.

[0065] 2) Filter and group the network detection data to obtain group data related to device operation:

[0066] 2.1) Filter out the three-way handshake packets, retransmission packets, and Rest packets in the network detection data that are not representative or caused by communication anomalies;

[0067] 2.2) According to the five-tuple format of <source IP, source port, destination IP, destination port, transport layer protocol>, the data packets are aggregated into different data streams;

[0068] 2.3) Divide the data stream into different operation groups according to the function code of the detection data.

[0069] 3) For each operation group, extract feature data packets:

[0070] 3.1) Construct the spatiotemporal expression of the data packet, expressed as:

[0071] p i = <t i ,l i ,d i >

[0072] Among them, p i represents the i-th data packet in a data stream; l i Indicates p i Relative position in the data stream; d i Indicates p i The directional length in the data stream is the combination of the direction and length of the data packet; t i Indicates p i Relative time in the data stream:

[0073]

[0074] Among them, T i Indicates data packet p i Timestamp; T 0 Indicates the first data packet p in the data stream 0 The timestamp of the data flow, FlowDuration indicates the duration of the entire data flow.

[0075] 3.2) Use the DBSCAN clustering algorithm to cluster all the data packets in the operation group into initial clusters, where the distance between the data packets is represented by the directed length d i To calculate; if the directions of the data are different, the distance is the maximum; if the directions are the same, the distance is the absolute value of the difference in the length of the data packets;

[0076] 3.3) For the initial cluster obtained, all the data packets in it are divided according to data flow and relative position l i Sorting is performed, and data packets with the same sequence number after sorting in different data streams are aggregated into a new cluster;

[0077] 3.4) For new clusters, a threshold is set according to the number of data flows in the operation group, clusters whose sizes are within the threshold range are retained, and all data packets in the cluster are determined as characteristic data packets.

[0078] 4) Constructing a group timing state model based on characteristic data packets:

[0079] 4.1) Reaggregate the characteristic data packets into different data flow sets according to the device IP and operation type;

[0080] 4.2) Performing an alignment operation on the above data stream set, selecting the data stream with the most frequent number of characteristic data packets and directed length sequence in the set as the representative data stream of the corresponding operation, for constructing the subsequent time series state model;

[0081] 4.3) Based on all representative data streams of the same device and the same operation type, a group timing state model is constructed; the timing state model is based on a finite state machine, in which the directed length and relative time of the characteristic data packet are used as the transition conditions between each state, and all the transition conditions are matched in sequence as the matching conditions of the timing state model, which is specifically expressed as:

[0082] TSM = {Length, Time}

[0083] Length=(d 0 ,d 1 ,……,d n )

[0084] Time=(0:(μ 0 ,σ 0 ),1:(μ 1 ,σ 1 ),……,n:(μ n ,σ n ))

[0085] Among them, TSM is the time series state model; Length is the directed length sequence; Time is the relative time distribution corresponding to the directed length; d i , μ i , σ i They represent the directional length of the data packet at position i, the average value of the relative time, and the standard deviation of the relative time.

[0086] 4.4) The relative time judgment method of the above timing state model is expressed as:

[0087] μ-nσ<t i <μ+nσ

[0088] Among them, μ and σ are the mean and standard deviation of the Gaussian distribution of the relative time of the corresponding position in the representative data stream, which are obtained by statistical learning of the relative time of the corresponding position in all representative data streams based on the same device and the same operation type; n is an integer with a value range of {1,2,3}, corresponding to the 1σ, 2σ and 3σ criteria of the Gaussian distribution, respectively.

[0089] 5) Aggregate all group-related timing state models for each device to form a device timing state model set:

[0090] Aggregate the timing state models of all operation types related to a device into a set, which uses the operation type as the index and the corresponding timing state model as the value, that is, the timing state model set of the device; if a device does not support a certain operation type, its corresponding value is NULL, expressed as:

[0091] D i ={ <o 1 ,TSM i1 >, <o 2 ,NULL>,…, <o j ,TSM ij >,…}

[0092] Among them, j Indicates an operation type; TSM ij Indicates that j The corresponding timing state model; NULL means that the device does not support the corresponding operation type.

[0093] 6) Build an identification mechanism for unknown networked industrial devices based on a set of device timing state models:

[0094] 6.1) Use multi-functional network detection data packets to scan unknown networked industrial devices and obtain their network detection data.

[0095] 6.2) Filter and group the network detection data to generate a spatiotemporal expression of the data packet, forming a set of the device's operation type and the corresponding representative data stream; for unsupported operation types, the corresponding representative data stream is set to NULL.

[0096] 6.3) Perform operation type support matching, using whether the values ​​corresponding to the operation types are all NULL or not NULL as the judgment standard, and extract all matching known devices.

[0097] 6.4) For all matching known devices, input the representative data streams corresponding to all manipulation types of the device into the corresponding timing state model of the known device; filter out the known devices that can fully match the device, and use the label of the known device as the label of the device.

[0098] Example

[0099] The overall process of a method for identifying networked industrial equipment based on a time series state model provided by an embodiment of the present invention specifically includes the following steps:

[0100] Step 1: For networked industrial devices that can return device information, construct a multifunctional network detection data packet to perform in-depth detection. Taking the Modbus / TCP protocol as an example, the constructed multifunctional network detection data packet involves 5 different operation types, corresponding to the following 5 function codes:

[0101] 01(0x01): Read Coils

[0102] 02(0x02):Read Discrete Inputs

[0103] 03(0x03):Read Holding Registers

[0104] 17 (0x11): Report Server ID

[0105] 43(0x2B):Read Device Identification

[0106] Taking the device with IP address 184.75.*.* as an example, the sequence of detection packets obtained is as follows: Figure 2 shown.

[0107] Step 2: Filter and group the network detection data to obtain group data related to device operation. Figure 2 Taking the network data packets as an example, the filtered network data packets include three-way handshake data packets and RST ACK data packets; the data flow labels obtained by aggregating the data packets according to the five-tuple are as follows:

[0108] <<184.75.*.*,502>,<192.168.0.103,58195>,6>

[0109] <<184.75.*.*,502>,<192.168.0.103,50770>,6>

[0110] <<184.75.*.*,502>,<192.168.0.103,58102>,6>

[0111] <<184.75.*.*,502>,<192.168.0.103,65155>,6>

[0112] <<184.75.*.*,502>,<192.168.0.103,56945>,6>

[0113] The data flow is divided into different operation groups according to the operation type as follows:

[0114] 01: <<184.75.*.*,502>,<192.168.0.103,58195>,6>

[0115] 02: <<184.75.*.*,502>,<192.168.0.103,50770>,6>

[0116] 03: <<184.75.*.*,502>,<192.168.0.103,58102>,6>

[0117] 17: <<184.75.*.*,502>,<192.168.0.103,65155>,6>

[0118] 43: <<184.75.*.*,502>,<192.168.0.103,56945>,6>

[0119] Step 3: Extract characteristic data packets for each operation group. Figure 2 Taking the network data packet in as an example, the data flow <<184.75.*.*,502>,<192.168.0.103,58195>,6> contains data packets numbered [4, 5, 6, 7]. The corresponding data packet time-space expression is as follows:

[0120] Round 1:

[0121] Similarly, the spatiotemporal expression of the data stream containing the data packets corresponding to the same operation type and different scanning rounds can be obtained:

[0122] Round 2:

[0123] Round 3:

[0124] The DBSCAN clustering algorithm provided by the machine learning library sklearn is used to cluster all the data packets in the operation group, where the neighborhood parameters (ε, MinPts) are set to (10, 3), and the following initial clusters are obtained:

[0125] C 1 =[p 10 ,p 20 ,p 30 ]

[0126] C 2 =[p 11 ,p 13 ,p 21 ,p 23 ,p 31 ,p 33 ]

[0127] C 3 =[p 12 ,p 22 ,p 32 ]

[0128] For the initial cluster obtained, all the data packets in it are divided by data flow and sorted by relative position. The data packets with the same order after sorting in different data flows are aggregated into a new cluster. The results are as follows:

[0129] C 1 =[p 10 ,p 20 ,p 30 ]

[0130] C 2_1 =[p 11 ,p 21 ,p 31 ]

[0131] C 2_2 =[p 13 ,p 23 ,p 33 ]

[0132] C 3 =[p 12 ,p 22 ,p 32 ]

[0133] The above operation group contains 3 data streams. The judgment threshold is set to [2.7, 3.3], and finally 4 valid clusters are obtained, and all data packets in the clusters are judged as characteristic data packets.

[0134] Step 4: Construct a group timing state model based on the characteristic data packets. Based on the above clustering results, the data streams are recombined. Since the data streams are aligned, the following group timing state model can be directly constructed:

[0135] TSM 1 ={Length,Time}

[0136] Length=('C-66','S-63','C-54','S-54')

[0137] Time=(0:(0.0,0.0),1:(0.513208,0.012642),2:(0.513627,0.012667),3:(1.0,0.0))

[0138] Among them, Length is a directed length sequence; Time is the relative time distribution corresponding to the directed length, such as 1:(0.513208,0.012642) means that the average value of the relative time corresponding to the directed length 'S-63' is 0.513208, and the standard deviation is 0.012642. When n is 1, the determination range of the relative time is:

[0139] 0.52585<t i <0.500566

[0140] Step 5: Aggregate all group-related timing state models for each device to form a device timing state model set. Taking the device with IP 184.75.*.* as an example, the device timing state model is as follows:

[0141] D={ <o 1 ,TSM 1 >, <o 2 ,TSM 2 >,…, <o 5 ,TSM 5 >}

[0142] Step 6: Based on the device time series state model set, build an unknown networked industrial device identification mechanism. Assume that an unknown networked industrial device D * The above five operations are also supported, and the data packet sequence corresponding to operation type 01 is as follows:

[0143] 01:

[0144] Since the above packet sequence is consistent with the TSM of device 184.75.*.* 1 The model is consistent, so by determining the operation type, the device timing state model that matches the unknown networked industrial device can be identified, and then the label of the unknown device can be identified. When multiple matching devices are found, the final label of the unknown device is determined by voting.

Claims

1. A method for identifying networked industrial equipment based on a temporal state model, characterized in that: The following steps are involved: 1) Based on networked industrial devices that can return device information, a multifunctional network detection data package is constructed to conduct in-depth detection; 2) Filter and group the network detection data to obtain group data related to device operation; 3) Extract characteristic data packets for each operation group; 4) constructing a group timing state model based on characteristic data packets; 5) Aggregate all group-related timing state models for each device to form a device timing state model set; 6) Based on the set of equipment timing state models, a mechanism for identifying unknown networked industrial equipment is constructed to realize the identification of networked industrial equipment.

2. According to claim 1, a method for identifying networked industrial equipment based on a temporal state model is characterized in that: The multifunctional network detection data packet is a device information acquisition data packet related to the industrial control protocol and contains multiple device access function codes, and is used to realize the functions of reading the data area, register and device status of industrial equipment.

3. According to claim 1, a method for identifying networked industrial equipment based on a temporal state model is characterized in that: The step 2) comprises the following steps: 2.1) Filter out the unrepresentative data packets or data packets caused by communication anomalies in the network detection data, including three-way handshake data packets, retransmission data packets and Rest data packets; 2.2) According to the five-tuple format of <source IP, source port, destination IP, destination port, transport layer protocol>, the data packets are aggregated into different data streams; 2.3) Divide the data stream into different operation groups according to the function code of the detection data.

4. According to claim 1, a method for identifying networked industrial equipment based on a temporal state model is characterized in that: The step 3) comprises the following steps: 3.1) Construct the spatiotemporal expression of the data packet: p i =<t i ,l i ,d i > Among them, p i represents the i-th data packet in a data stream; l i Indicates p i Relative position in the data stream; d i Indicates p i The directional length in the data stream is the combination of the direction and length of the data packet; t i Indicates p i Relative time in the data stream: Among them, T i Indicates data packet p i T0 represents the timestamp of the first data packet p0 in the data flow, and FlowDuration represents the duration of the entire data flow; 3.2) Use the DBSCAN clustering algorithm to cluster all the data packets in the operation group into initial clusters, where the distance between the data packets is represented by the directed length d i To calculate; if the directions of the data are different, the distance is the maximum; if the directions are the same, the distance is the absolute value of the difference in the length of the data packets; 3.3) For the initial cluster obtained, all the data packets in it are divided according to data flow and relative position l i Sorting is performed, and data packets with the same sequence number after sorting in different data streams are aggregated into a new cluster; 3.4) For new clusters, a threshold is set according to the number of data flows in the operation group, clusters whose sizes are within the threshold range are retained, and all data packets in the cluster are determined as characteristic data packets.

5. According to claim 1, a method for identifying networked industrial equipment based on a temporal state model is characterized in that: Step 4) The following steps are involved: 4.1) Reaggregate the characteristic data packets into different data flow sets according to the device IP and operation type; 4.2) Align the data stream set, select the data stream with the largest number of characteristic data packets and directed length sequence in the set as the representative data stream of the corresponding operation, and use it to construct the time series state model; 4.3) Construct a group timing state model based on all representative data flows of the same operation type of the same device.

6. A method for identifying networked industrial equipment based on a temporal state model according to claim 5, characterized in that: The group of sequential state models is based on a finite state machine, wherein the directed length and relative time of the characteristic data packets are used as transition conditions between states, and all transition conditions are matched in sequence as matching conditions of the sequential state model, specifically: TSM={Length,Time} Length=(d0,d1,......,d n ) Time=(0:(μ0,σ0),1:(μ1,σ1),......,n:(μ n ,s n )) Among them, TSM is the time series state model; Length is the directed length sequence; Time is the relative time distribution corresponding to the directed length; d i , μ i , σ i They represent the directional length of the data packet at position i, the average value of the relative time, and the standard deviation of the relative time.

7. A method for identifying networked industrial equipment based on a temporal state model according to claim 6, characterized in that: The relative time judgment method of the timing state model is: μ-nσ<t i <μ+nσ Wherein, μ and σ are the mean and standard deviation of the Gaussian distribution of the relative time of the corresponding position in the representative data stream; n is an integer in the range of {1,2,3}, corresponding to the 1σ, 2σ and 3σ criteria of the Gaussian distribution, respectively.

8. The method for identifying networked industrial equipment based on a temporal state model according to claim 1, characterized in that: The step 5) is specifically as follows: Aggregate the timing state models of all operation types related to a device into a set, which uses the operation type as the index and the corresponding timing state model as the value, that is, the timing state model set D of the device. i ; If a device does not support a certain operation type, the corresponding value is NULL, which is expressed as: D i ={ <o1,TSM i1 >,<o2,NULL> ,…, <o j ,TSM ij >,…} Among them, j Indicates an operation type; TSM ij Indicates that j The corresponding timing state model; NULL means that the device does not support the corresponding operation type.

9. The method for identifying networked industrial equipment based on a temporal state model according to claim 1, characterized in that: The step 6) comprises the following steps: 6.1) Use multi-function network detection data packets to scan unknown networked industrial devices and obtain their network detection data; 6.2) Filter and group the network detection data to generate the spatiotemporal expression of the data packet, forming a set of the device's operation type and the corresponding representative data flow; for unsupported operation types, the corresponding representative data flow is set to NULL ； 6.3) Perform operation type support matching, using whether the values ​​corresponding to the operation type are all NULL or not NULL as the judgment standard, and extract all matching known devices; 6.4) For all matching known devices, input the representative data streams corresponding to all manipulation types of the device into the corresponding timing state model of the known device; filter out the known devices that can fully match the device, and use the labels of the known devices as the labels of the device.

10. A networked industrial equipment identification system based on a temporal state model, characterized in that: include: A detection packet building module is used to build a multifunctional network detection packet based on networked industrial devices that can return device information to conduct in-depth detection; A detection data processing module is used to filter and group the network detection data to obtain group data related to device operation; A feature data packet extraction module is used to extract feature data packets for each operation group; A timing state model building module, used for building a group timing state model based on a characteristic data packet; A model aggregation module is used to aggregate all group-related timing state models for each device to form a device timing state model set; The device identification module is used to build an unknown networked industrial device identification mechanism based on a set of device timing state models to realize the identification of networked industrial devices.

Images