Data analysis method, system and equipment based on multiple message analysis rule tables

Abstract

The embodiment of the invention provides a data analysis method, system and equipment based on multiple message analysis rule tables, and belongs to the technical field of industrial data control. The data analysis method based on the multiple message analysis rule tables comprises the following steps: collecting communication protocol messages in an industrial control network communication process; performing network layer protocol parameter analysis on the communication protocol message, and determining a target message type; determining a plurality of pieces of industrial control behavior information according to the communication protocol message of the target message type; the multiple pieces of industrial control behavior information are combined, and industrial control behavior process information is determined; and performing visual display according to the communication protocol message and the industrial control behavior process information. According to the embodiment of the invention, the industrial control behavior information can be quickly identified by analyzing the communication protocol message, the efficiency and accuracy of industrial control are improved, and visual display provided by the embodiment of the invention realizes the intuition of industrial control and improves the use feeling.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial data control, and in particular to a data parsing method based on multiple message parsing rule tables, a data parsing system based on multiple message parsing rule tables, an electronic device and a readable storage medium. Background Art

[0002] In the petroleum, chemical and other industries, maintaining the safety of industrial control systems is of paramount importance. Therefore, Safety Instrumented System (SIS) is widely used as a system for monitoring and controlling industrial process safety. However, there is a problem of unstable communication when using SIS systems to monitor and control industrial processes, which leads to abnormal communication in SIS systems during monitoring and controlling industrial processes, causing safety hazards. Summary of the invention

[0003] The purpose of the embodiments of the present invention is to provide a data parsing method, system and device based on multiple message parsing rule tables to solve the above technical problems.

[0004] In order to achieve the above object, an embodiment of the present invention provides a data parsing method based on multiple message parsing rule tables, the method comprising:

[0005] Collect communication protocol messages during industrial control network communication;

[0006] Performing network layer protocol parameter analysis on the communication protocol message to determine the target message type;

[0007] Determine multiple industrial control behavior information according to the communication protocol message of the target message type;

[0008] Combining multiple pieces of industrial control behavior information to determine industrial control behavior process information;

[0009] Visual display is performed based on the communication protocol message and the industrial control behavior process information.

[0010] Optionally, the performing network layer protocol parameter parsing on the communication protocol message to determine the target message type includes:

[0011] Respectively identifying the message link layer field, the network layer field and the transport layer field of the communication protocol message, and parsing to obtain message parameter information; wherein the message parameter information includes device load information, protocol type, port number information and protocol number information;

[0012] The target message type is determined according to the message parameter information and the preset protocol identification rule query table.

[0013] Optionally, the determining the target message type by querying a table according to the message parameter information and a preset protocol identification rule includes:

[0014] Based on the device load information, the protocol type, the port number information and the protocol number information, a first preset mapping relationship is used for mapping to obtain a protocol identification rule sequence number;

[0015] The protocol identification rule serial number is matched with a preset identification rule serial number in a preset protocol identification rule query table, and if they match, the target message type is determined.

[0016] Optionally, if the protocol identification rule serial number does not match a preset identification rule serial number in a preset protocol identification rule query table, the industrial control behavior corresponding to the protocol identification rule serial number is determined to be an abnormal behavior, and a visual warning message is generated.

[0017] Optionally, the determining of multiple industrial control behavior information based on the communication protocol message of the target message type includes:

[0018] Extracting message application layer parameters of the communication protocol message of the target message type to obtain device feature values ​​and industrial control behavior feature codes;

[0019] Based on the device characteristic value, the industrial control behavior characteristic code and a preset behavior characteristic analysis rule query table, a plurality of industrial control behavior information are determined.

[0020] Optionally, the determining of multiple industrial control behavior information based on the device characteristic value, the industrial control behavior characteristic code and a preset behavior characteristic parsing rule query table includes:

[0021] Based on the device characteristic value and the industrial control behavior characteristic code, a second preset mapping relationship is used for mapping to obtain a behavior characteristic rule sequence number of the communication protocol message;

[0022] The behavior feature rule serial number is matched with a preset feature rule serial number in a preset behavior feature analysis rule query table to determine a plurality of industrial control behavior information; wherein the industrial control behavior information includes communication start information, file transfer information and communication end information.

[0023] Optionally, combining multiple pieces of industrial control behavior information to determine industrial control behavior process information includes:

[0024] Based on the device characteristic value, the industrial control behavior characteristic code and the preset industrial control behavior process specification, multiple industrial control behavior information are sequentially combined to obtain industrial control behavior process information; wherein the industrial control behavior process information includes download file process information and upload file process information.

[0025] Optionally, the performing visual display according to the communication protocol message and the industrial control behavior process information includes:

[0026] Structuring the communication protocol message and the industrial control behavior process information to obtain an industrial control behavior message data packet;

[0027] The working condition behavior message data packet is parsed for effective information to obtain effective working condition behavior message information, and the effective working condition behavior message information is visualized.

[0028] In a second aspect of an embodiment of the present invention, a data parsing system based on multiple message parsing rule tables is provided, the system comprising:

[0029] Data acquisition module, used to collect communication protocol messages during industrial control network communication;

[0030] A type determination module, used to parse the network layer protocol parameters of the communication protocol message to determine the target message type;

[0031] A behavior determination module, used to determine multiple industrial control behavior information according to a communication protocol message of a target message type;

[0032] An information combination module, used to combine multiple industrial control behavior information to determine industrial control behavior process information;

[0033] The visualization module is used to perform visualization display according to the communication protocol message and the industrial control behavior process information.

[0034] Optionally, the type determination module is specifically used to:

[0035] Respectively identifying the message link layer field, the network layer field and the transport layer field of the communication protocol message, and parsing to obtain message parameter information; wherein the message parameter information includes device load information, protocol type, port number information and protocol number information;

[0036] Based on the device load information, the protocol type, the port number information and the protocol number information, a first preset mapping relationship is used for mapping to obtain a protocol identification rule sequence number;

[0037] Matching the protocol identification rule serial number with the preset identification rule serial number in the preset protocol identification rule query table, and if they match, determining the target message type;

[0038] The type determination module is further specifically used for:

[0039] If the protocol identification rule serial number does not match the preset identification rule serial number in the preset protocol identification rule query table, it is determined that the industrial control behavior corresponding to the protocol identification rule serial number is an abnormal behavior, and a visual warning message is generated.

[0040] Optionally, the behavior determination module is specifically used to:

[0041] Extracting message application layer parameters of the communication protocol message of the target message type to obtain device feature values ​​and industrial control behavior feature codes;

[0042] Based on the device characteristic value and the industrial control behavior characteristic code, a second preset mapping relationship is used for mapping to obtain a behavior characteristic rule sequence number of the communication protocol message;

[0043] The behavior feature rule serial number is matched with a preset feature rule serial number in a preset behavior feature analysis rule query table to determine a plurality of industrial control behavior information; wherein the industrial control behavior information includes communication start information, file transfer information and communication end information.

[0044] A third aspect of the present application provides an electronic device configured to execute the above-mentioned data parsing method based on multiple message parsing rule tables.

[0045] A fourth aspect of the present application provides a machine-readable storage medium having instructions stored thereon, which, when executed by a processor, configures the processor to execute the above-mentioned data parsing method based on multiple message parsing rule tables.

[0046] The embodiment of the present invention collects communication protocol messages in the process of industrial control network communication, and then performs network layer protocol parameter analysis on the communication protocol messages to determine the target message type, and determines multiple industrial control behavior information according to the communication protocol messages of the target message type, and combines the multiple industrial control behavior information to determine the industrial control behavior process information, and finally performs visual display according to the communication protocol messages and the industrial control behavior process information. That is, the embodiment of the present invention can quickly identify the industrial control behavior information by parsing the communication protocol messages, thereby improving the efficiency and accuracy of industrial control, and the visual display provided by this implementation realizes the intuitiveness of industrial control and improves the sense of use.

[0047] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0049] Figure 1 It is a flow chart of a data parsing method based on multiple message parsing rule tables provided by an embodiment of the present invention;

[0050] Figure 2 It is a functional module diagram of a data parsing system based on multiple message parsing rule tables provided by an embodiment of the present invention;

[0051] Figure 3 It is a structural schematic diagram of a data parsing system based on multiple message parsing rule tables provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0054] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0055] Embodiment 1

[0056] Please refer to Figure 1 , Figure 1 It is a flowchart of a data parsing method based on multiple message parsing rule tables provided in this embodiment.

[0057] It can be understood that this embodiment can realize the control and monitoring of industry by using the SIS system, that is, the control and monitoring of industry can be realized by using the communication between the operation station of the SIS system and the industrial control module. Since there is a problem of unstable communication during the communication process between devices, this embodiment proposes to parse the communication information of the industrial control network to ensure the stability and accuracy of industrial control.

[0058] Step S100: collecting communication protocol messages during the industrial control network communication process.

[0059] Specifically, this step collects communication protocol messages of the data link layer of the industrial control network by monitoring the SIS system in the industrial control network.

[0060] Step S200: parse the network layer protocol parameters of the communication protocol message to determine the target message type.

[0061] Specifically, since the communication protocol messages in the industrial control network communication process may not only be industrial control messages but also ordinary ICMP and TCP messages, this step respectively identifies the message link layer field, network layer field and transport layer field of the communication protocol message, and parses to obtain the message parameter information; wherein the message parameter information includes device load information, protocol type, port number information and protocol number information, and further maps based on the device load information, protocol type, port number information and protocol number information to obtain the protocol identification rule number, and then matches the protocol identification rule number with the preset identification rule number in the preset protocol identification rule query table. If they match, the target message type is determined.

[0062] It should be understood that in order to improve the matching efficiency, this embodiment sets a matching priority in the preset protocol identification rule query table, and matches the protocol identification rule number with the preset identification rule number in the preset protocol identification rule query table according to the matching priority. For example, the first preset identification rule number that matches the protocol identification rule number is set in the preset protocol identification rule query table as the identification rule number corresponding to the industrial control message of the SIS system. If the protocol identification rule number matches it, the target message type of the communication protocol message is determined.

[0063] Among them, the preset protocol identification rule query table includes the preset identification rule serial number, preset protocol type, preset port number information, preset protocol number information and message type information. The preset identification rule serial number is obtained by mapping the preset protocol type, preset port number information and preset protocol number information using the first preset mapping relationship. Each message type information corresponds to a preset identification rule serial number, and the preset protocol identification rule query table is sorted in a binary heap based on the preset identification rule serial number. Among them, the mapping method can adopt parameter data bit splicing. For example, the first preset mapping relationship can be set to e=10000*a+100*b+10*c+d, where e is the protocol identification rule serial number, a is the device load information, b is the protocol type, c is the port number information, and d is the protocol number information. The ranges of a, b, c and d are all 0-999. If the values ​​of the three parameters are 1, 2, 3, and 4 respectively, the number of digits of a, b, c, and d are filled with 0 and then spliced ​​together, which is 001002003004, that is, the protocol identification rule serial number is 1002003004.

[0064] It should be understood that in addition to matching the protocol identification rule serial number with the preset identification rule serial number in the preset protocol identification rule query table to determine the message type, this embodiment also provides multiple identification rules in the preset protocol identification rule query table, parses the communication protocol message, obtains the parameter field corresponding to each identification rule, matches each parameter field of the communication protocol message with the identification field in the identification rule, and determines the message type. Among them, the attributes of the multiple identification fields in the preset protocol identification rule query table include field name, byte offset, byte length and feature matching value. The byte offset indicates the starting position of the field in the message, the byte length indicates the number of bytes occupied by the field, and the feature matching value indicates the target value of the field. For example, the identification feature of the SIS system industrial control protocol is the source port number of 4600. The source port number is determined by the 35th to 38th bytes of the message. The field name is set to the source port number, the byte offset is set to 35, the byte length is set to 4, and the feature matching value is set to 4600. By matching the identification rules corresponding to the SIS system industrial control protocol one by one, it can be determined whether the communication protocol message is the SIS system industrial control protocol message type.

[0065] It is understandable that during the communication process, there are situations where messages do not belong to the processable message types. Therefore, this embodiment proposes that the preset protocol identification rule query table also has a warning function, specifically including: when it is determined that the protocol identification rule number does not match the preset identification rule number in the preset protocol identification rule query table, the communication protocol message in the industrial control network communication process is collected again for message type matching, and it is determined that the industrial control behavior corresponding to the protocol identification rule number is abnormal behavior, and a visual warning message is generated to display a warning of message abnormality, thereby avoiding abnormal industrial control behavior and improving the efficiency of message parsing.

[0066] Step S300: determining a plurality of industrial control behavior information according to a communication protocol message of a target message type.

[0067] Specifically, this step extracts the message application layer parameters of the communication protocol message of the target message type, obtains the device characteristic value and the industrial control behavior characteristic code, and then maps based on the device characteristic value and the industrial control behavior characteristic code to obtain the behavior characteristic rule number of the communication protocol message, matches the behavior characteristic rule number with the preset characteristic rule number in the preset behavior characteristic analysis rule query table, and determines multiple industrial control behavior information. Among them, the industrial control behavior information includes communication startup information, file transfer information, and communication end information

[0068] Among them, the preset behavior feature parsing rule query table includes the preset feature rule serial number, preset device feature value, preset industrial control behavior feature code, and the data packet ID number, data packet length value, industrial control behavior parameters, etc. used to parse the industrial control behavior process, the field position, data type and data length information, the preset feature rule serial number is obtained by mapping the preset device feature value and the preset industrial control behavior feature code using the second preset mapping relationship, and the preset behavior feature parsing rule query table is sorted in a binary heap based on the preset feature rule serial number. Among them, the mapping method can use parameter data bit splicing. It can be understood that in order to improve the matching efficiency, a matching priority is set in the preset behavior feature parsing rule query table, and the behavior feature rule serial number is matched with the preset feature rule serial number in the preset behavior feature parsing rule query table according to the matching priority.

[0069] It is understandable that, in addition to matching the behavior feature rule serial number with the preset feature rule serial number in the preset behavior feature analysis rule query table to determine the industrial control behavior information, this embodiment also provides a method of parsing the communication protocol message through multiple identification rules in the preset behavior feature analysis rule query table to obtain the parameter field corresponding to each identification rule, matching each parameter field of the communication protocol message with the identification field in the identification rule to determine the industrial control behavior information. Among them, the attributes of the multiple identification fields in the preset behavior feature analysis rule query table include the source port number, the destination port number, the protocol type and the industrial control behavior feature code.

[0070] Step S400: combining multiple pieces of industrial control behavior information to determine industrial control behavior process information.

[0071] This step specifically includes: based on the device characteristic value, the industrial control behavior characteristic code and the preset industrial control behavior process specification, a plurality of industrial control behavior information are sequentially combined to obtain the industrial control behavior process information.

[0072] The industrial control behavior process information includes the file download process information and the file upload process information. For example, the file download process uses the SIS system to control the industry. Step 1: The operation station of the SIS system sends a download file command data packet to the industrial control module, wherein the effective information of the command includes the download process startup feature code of the download file, the relative path of the file download location, the file name, the file type, and the file size; Step 2: The industrial control module replies to the operation station with a data packet of the execution status of the download file command; wherein the effective information of the reply includes the download process startup execution response feature code and the startup execution status; Step 3: The operation station sequentially sends download file data packets to the industrial control module; wherein, in addition to the above-mentioned download file data, the data packet also contains other effective information, including the download file data packet transmission feature code, data packet ID number, and data packet byte length; Step 4: The control module replies to the operation station with the reception status of the download file data packet data packet; wherein, the effective information of the reply includes the response feature code of the reception status of the data packet of the downloaded file, the ID number of the received data packet, the byte length of the received data packet, and the execution status of the data packet reception; step five: repeat the steps three and four of the SIS system downloading process until the last ending data packet of the downloaded file in the SIS system remains; step six: the operation station sends the ending data packet of the downloaded file to the industrial control module; wherein, in addition to the ending data of the downloaded file, the ending data packet also contains other effective information, including the transmission feature code of the ending data packet, the ID number of the ending data packet, the byte length of the ending data packet, and the CRC check code; step seven: the industrial control module replies to the operation station with the reception status data packet of the ending data packet of the downloaded file; wherein, the effective information of the reply includes the response feature code of the reception status of the ending data packet, the ID number of the ending data packet, the byte length of the ending data packet, the execution status of the reception of the ending data packet and the verification and storage of the downloaded file data.

[0073] For example, the process of uploading files is to use the SIS system to control industry. Step 1: The operating station of the SIS system sends an upload file command data packet to the industrial control module; wherein the valid information of the command includes the upload command feature code and file type of the uploaded file; Step 2: The industrial control module uploads the upload file information data packet to the operating station. The valid information includes the process startup feature code, file name, file type, and file size of the uploaded file; Step 3: The operating station replies to the industrial control module with the upload file information reception and execution status data packet; wherein the valid information of the reply includes the upload file process startup execution response feature code and startup execution status; Step 4: The control module sequentially uploads the upload file data packet to the operating station; wherein, in addition to the data of the uploaded file, the data packet also includes other valid information, including the upload file data packet transmission feature code, data packet ID number, and data packet byte length; Step 5: The operating station replies to the industrial control module with the upload file data packet reception status data packet; wherein the valid information of the reply includes the upload file data packet reception status response feature code, the received data packet ID number, and the received data packet byte length. degree, data packet reception execution status; step six: repeat step four and step five of the SIS system file upload process until the last ending data packet remains in the SIS system upload file; step seven: the industrial control module uploads the ending data packet of the uploaded file to the operation station; wherein, the ending data packet contains not only the ending data of the uploaded file, but also other valid information, including the ending data packet transmission feature code, the ending data packet ID number, the ending data packet byte length, and the CRC check code; step eight: the operation station replies to the industrial control module with a data packet of the reception status of the ending data packet of the uploaded file; wherein, the valid information of the reply includes the response feature code of the ending data packet reception status, the ending data packet ID number, the ending data packet byte length, the ending data packet reception and the execution status of the uploaded file data check and storage.

[0074] It should be understood that both downloading files and uploading files require complete data interaction between the operation station and the industrial control module. There is a problem of long data transmission delay during the data transmission process. In order to solve the problem of long transmission delay, this embodiment proposes two data transmission methods. The first data transmission method includes: controlling the data communication between the operation station and the industrial control module to be time-limited transmission. After the first time-limited transmission between the operation station and the industrial control module, the transmission percentage is fed back, the data that has not been completed is identified, and the data that has not been completed is extracted separately. The second transmission is for the data that has not been completed (because the second transmission has excluded a lot of data that has been completed in the first transmission). , so under the same bandwidth, the efficiency of secondary transmission will be higher), so as to improve the overall data transmission efficiency; in order to avoid the occurrence of multiple identical data packets, affecting the first data transmission method to identify the data that has not been transmitted, a second data transmission method is proposed, which specifically includes: firstly, judging whether there is an identical data part in each data packet, if so, adding multiple IDs and sequence numbers to the identical data part, and performing data transmission according to the sequence number. After the identical data is transmitted for the first time, subsequent data transmission directly copies the local data based on the sequence number and ID, and combines the copied data and the downloaded different data into this data packet. This method can reduce the repeated transmission of the identical data and improve the transmission efficiency.

[0075] It can be understood that this embodiment provides a combination logic for how to select the above-mentioned two data transmission methods for data transmission, specifically including: before data transmission, detecting whether there is an identical data part in the data to be transmitted, if so, using the second data transmission method, if not, using the first data transmission method, so as to improve data transmission efficiency and accuracy.

[0076] It should be understood that the technical means for determining the engineering behavior process information in step S400, this embodiment also provides a method for determining the engineering behavior process information, specifically including: parsing the industrial control behavior information determined in step S300, obtaining the step identification field of each step in the industrial control behavior information, matching the step identification field with the preset identification field in the preset data process identification table, and determining the industrial control behavior process information of the communication protocol message. The accuracy of the industrial control behavior process information is improved.

[0077] Step S500: Perform visual display based on the communication protocol message and the industrial control behavior process information.

[0078] Specifically, this embodiment performs structured processing on the communication protocol message and the industrial control behavior process information to obtain the industrial control behavior message data packet, and then performs effective information parsing on the working condition behavior message data packet to obtain effective working condition behavior message information, and then visually displays the effective working condition behavior message information. For example, the communication protocol message and the industrial control behavior process information are packaged and forwarded in aggregatable manner, and the forwarded data packet is stored using the elasticsearch distributed search and analysis engine, and then the stored data packet is parsed for effective information to obtain effective working condition behavior message information, and then the effective working condition behavior message information is visually displayed.

[0079] This embodiment collects communication protocol messages in the process of industrial control network communication, and then parses the network layer protocol parameters of the communication protocol messages to determine the target message type, and determines multiple industrial control behavior information according to the communication protocol messages of the target message type, and combines the multiple industrial control behavior information to determine the industrial control behavior process information, and finally performs visual display according to the communication protocol messages and the industrial control behavior process information. That is, the embodiment of the present invention can quickly identify the industrial control behavior information by parsing the communication protocol messages, thereby improving the efficiency and accuracy of industrial control, and the visual display provided by this implementation realizes the intuitiveness of industrial control and improves the sense of use.

[0080] Embodiment 2

[0081] Please refer to Figure 2 , Figure 2 It is a functional module diagram of a data parsing system 200 based on multiple message parsing rule tables provided in an embodiment of the present application.

[0082] The data acquisition module 210 is used to collect communication protocol messages during the industrial control network communication process;

[0083] The type determination module 220 is used to parse the network layer protocol parameters of the communication protocol message to determine the target message type.

[0084] The type determination module 220 is specifically used to respectively identify the message link layer field, network layer field and transport layer field of the communication protocol message, and parse to obtain the message parameter information; wherein the message parameter information includes device load information, protocol type, port number information and protocol number information; based on the device load information, protocol type, port number information and protocol number information, a first preset mapping relationship is used for mapping to obtain a protocol identification rule number; the protocol identification rule number is matched with a preset identification rule number in a preset protocol identification rule query table, and if they match, the target message type is determined; if the protocol identification rule number does not match the preset identification rule number in the preset protocol identification rule query table, it is determined that the industrial control behavior corresponding to the protocol identification rule number is an abnormal behavior, and a visual warning message is generated.

[0085] The behavior determination module 230 is used to determine multiple industrial control behavior information according to the communication protocol message of the target message type.

[0086] The behavior determination module 230 is specifically used to extract the message application layer parameters of the communication protocol message of the target message type, obtain the device characteristic value and the industrial control behavior characteristic code; based on the device characteristic value and the industrial control behavior characteristic code, use the second preset mapping relationship to perform mapping to obtain the behavior characteristic rule sequence number of the communication protocol message; match the behavior characteristic rule sequence number with the preset characteristic rule sequence number in the preset behavior characteristic analysis rule query table to determine multiple industrial control behavior information. Among them, the industrial control behavior information includes communication startup information, file transfer information and communication end information.

[0087] The information combination module 240 is used to combine multiple industrial control behavior information to determine the industrial control behavior process information; the information combination module 240 is specifically used to sequentially combine multiple industrial control behavior information based on device characteristic values, industrial control behavior characteristic codes and preset industrial control behavior process specifications to obtain industrial control behavior process information; wherein, the industrial control behavior process information includes download file process information and upload file process information.

[0088] The visualization module 250 is used to perform visualization display based on the communication protocol message and the industrial control behavior process information.

[0089] The visualization module 250 is specifically used to: structure the communication protocol message and the industrial control behavior process information to obtain the industrial control behavior message data packet; perform effective information analysis on the working condition behavior message data packet to obtain effective working condition behavior message information, and visualize the effective working condition behavior message information.

[0090] Figure 3This is a structural diagram of the data analysis system 200 based on multiple message analysis rule tables in actual application. The communication protocol message is sent from the operation station of the SIS system. The data analysis system 200 based on multiple message analysis rule tables collects the communication protocol message through the data acquisition module 210, and then determines the target message type through the type determination module 220. The behavior determination module 230 determines multiple industrial control behavior information, and then uses the information combination module 240 to combine the multiple industrial control behavior information to obtain the industrial control behavior process information, and finally uses the visualization module 250 to display it.

[0091] It should be understood that the system corresponds to the above-mentioned data parsing method embodiment based on multiple message parsing rule tables, and can execute the various steps involved in the above-mentioned method embodiment. The specific functions of the system can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here. The system includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the operating system (OS) of the device.

[0092] Embodiment 3

[0093] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0094] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0095] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0096] Embodiment 4

[0097] An embodiment of the present invention further provides a computer-readable storage medium, on which instructions are stored, and when the instructions are executed by a processor, the program having steps of a data parsing method based on multiple message parsing rule tables is suitable for executing.

[0098] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0099] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0100] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0101] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0102] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, the embodiments of the present invention will not further describe various possible combinations.

[0103] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist separately, or two or more modules can be integrated to form an independent part.

[0104] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0105] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A data parsing method based on multiple message parsing rule tables, characterized in that: The method comprises: Collect communication protocol messages during industrial control network communication; Performing network layer protocol parameter analysis on the communication protocol message to determine the target message type; Determine multiple industrial control behavior information according to the communication protocol message of the target message type; Combining multiple pieces of industrial control behavior information to determine industrial control behavior process information; Visual display is performed based on the communication protocol message and the industrial control behavior process information.

2. The data parsing method based on multiple message parsing rule tables according to claim 1, characterized in that: The performing network layer protocol parameter parsing on the communication protocol message to determine the target message type includes: Respectively identifying the message link layer field, the network layer field and the transport layer field of the communication protocol message, and parsing to obtain message parameter information; wherein the message parameter information includes device load information, protocol type, port number information and protocol number information; The target message type is determined according to the message parameter information and the preset protocol identification rule query table.

3. The data parsing method based on multiple message parsing rule tables according to claim 2, characterized in that: The step of determining the target message type according to the message parameter information and the preset protocol identification rule query table includes: Based on the device load information, the protocol type, the port number information and the protocol number information, a first preset mapping relationship is used for mapping to obtain a protocol identification rule sequence number; The protocol identification rule serial number is matched with a preset identification rule serial number in a preset protocol identification rule query table to determine the target message type.

4. The data parsing method based on multiple message parsing rule tables according to claim 3, characterized in that: If the protocol identification rule serial number does not match the preset identification rule serial number in the preset protocol identification rule query table, it is determined that the industrial control behavior corresponding to the protocol identification rule serial number is an abnormal behavior, and a visual warning message is generated.

5. The data parsing method based on multiple message parsing rule tables according to claim 1, characterized in that: The communication protocol message of the target message type is used to determine a plurality of industrial control behavior information, including: Extracting message application layer parameters of the communication protocol message of the target message type to obtain device feature values ​​and industrial control behavior feature codes; Based on the device characteristic value, the industrial control behavior characteristic code and a preset behavior characteristic analysis rule query table, a plurality of industrial control behavior information are determined.

6. The data parsing method based on multiple message parsing rule tables according to claim 5, characterized in that: The determining of multiple industrial control behavior information based on the device characteristic value, the industrial control behavior characteristic code and the preset behavior characteristic analysis rule query table includes: Based on the device characteristic value and the industrial control behavior characteristic code, a second preset mapping relationship is used for mapping to obtain a behavior characteristic rule sequence number of the communication protocol message; The behavior feature rule serial number is matched with a preset feature rule serial number in a preset behavior feature analysis rule query table to determine a plurality of industrial control behavior information; wherein the industrial control behavior information includes communication start information, file transfer information and communication end information.

7. The data parsing method based on multiple message parsing rule tables according to claim 6, characterized in that: The combining of the plurality of industrial control behavior information to determine the industrial control behavior process information includes: Based on the device characteristic value, the industrial control behavior characteristic code and the preset industrial control behavior process specification, multiple industrial control behavior information are sequentially combined to obtain industrial control behavior process information; wherein the industrial control behavior process information includes download file process information and upload file process information.

8. The data parsing method based on multiple message parsing rule tables according to claim 1, characterized in that: The visual display according to the communication protocol message and the industrial control behavior process information includes: Structuring the communication protocol message and the industrial control behavior process information to obtain an industrial control behavior message data packet; The working condition behavior message data packet is parsed for effective information to obtain effective working condition behavior message information, and the effective working condition behavior message information is visualized.

9. A data analysis system based on multiple message analysis rule tables, characterized in that: The system comprises: Data acquisition module, used to collect communication protocol messages during industrial control network communication; A type determination module, used to parse the network layer protocol parameters of the communication protocol message to determine the target message type; A behavior determination module, used to determine multiple industrial control behavior information according to a communication protocol message of a target message type; An information combination module, used to combine multiple industrial control behavior information to determine industrial control behavior process information; The visualization module is used to perform visualization display according to the communication protocol message and the industrial control behavior process information.

10. The data analysis system based on multiple message analysis rule tables according to claim 9, characterized in that: The type determination module is specifically used for: Respectively identifying the message link layer field, the network layer field and the transport layer field of the communication protocol message, and parsing to obtain message parameter information; wherein the message parameter information includes device load information, protocol type, port number information and protocol number information; Based on the device load information, the protocol type, the port number information and the protocol number information, a first preset mapping relationship is used for mapping to obtain a protocol identification rule sequence number; Matching the protocol identification rule serial number with a preset identification rule serial number in a preset protocol identification rule query table to determine the target message type; The type determination module is further specifically used for: If the protocol identification rule serial number does not match the preset identification rule serial number in the preset protocol identification rule query table, it is determined that the industrial control behavior corresponding to the protocol identification rule serial number is an abnormal behavior, and a visual warning message is generated.

11. The data analysis system based on multiple message analysis rule tables according to claim 9, characterized in that: The behavior determination module is specifically used for: Extracting message application layer parameters of the communication protocol message of the target message type to obtain device feature values ​​and industrial control behavior feature codes; Based on the device characteristic value and the industrial control behavior characteristic code, a second preset mapping relationship is used for mapping to obtain a behavior characteristic rule sequence number of the communication protocol message; The behavior feature rule serial number is matched with a preset feature rule serial number in a preset behavior feature analysis rule query table to determine a plurality of industrial control behavior information; wherein the industrial control behavior information includes communication start information, file transfer information and communication end information.

12. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, the data parsing method based on multiple message parsing rule tables described in any one of claims 1 to 8 is executed.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions for enabling a machine to execute the data parsing method based on multiple message parsing rule tables as described in any one of claims 1 to 8.

Images