Industrial flow collection method, device, computer equipment and storage medium

Abstract

The application relates to an industrial flow collection method and device, computer equipment and a storage medium. The method comprises the following steps: collecting industrial flows of each workshop through each flow collection port arranged on a flow collection device; identifying the industrial flows collected by each flow collection port according to an identification model corresponding to each flow collection port to obtain an identification result; and collecting the industrial flows collected by each flow collection port according to the identification result to obtain a collection result. The flow collection ports of the flow collection device are used to collect the flows of multiple workshops, so that the industrial flows are sequentially transmitted, the possibility of data leakage is reduced by transmitting the industrial flows through the ports, and the safety of collecting the industrial flows is improved. In addition, collection nodes do not need to be arranged in each workshop, and the operation and maintenance complexity of collecting the industrial flows is reduced.

Description

Technical Field

[0001] This application relates to the field of data analysis technology, and in particular to a method, apparatus, computer equipment, and storage medium for collecting industrial flow. Background Technology

[0002] In modern industrial production, with the rapid development of technology and increasingly fierce market competition, enterprises have an increasingly urgent need to improve production efficiency, reduce costs, ensure production safety, and realize intelligent manufacturing and Industry 4.0 strategies. Industrial flow acquisition and monitoring technology has emerged in this context and is gradually becoming an indispensable and important part of modern industrial production.

[0003] Traditionally, traffic is collected by mirroring traffic through industrial switches. However, this method carries the risk of data leakage, and the disorderly propagation of mirrored traffic can exacerbate the chaos of data interaction in the workshop. Therefore, traditional traffic collection methods have low security. Summary of the Invention

[0004] Therefore, it is necessary to provide an industrial flow collection method, apparatus, computer equipment, and storage medium that can improve the security of industrial flow collection in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for collecting industrial flow, applied to a flow acquisition device, the method comprising:

[0006] The industrial flow of each workshop is collected through the flow acquisition ports set on the flow acquisition equipment;

[0007] Based on the identification model corresponding to each flow acquisition port, the industrial flow collected by each flow acquisition port is identified, and the identification results are obtained.

[0008] The industrial traffic collected from each traffic acquisition port is summarized based on the identification results to obtain the collection results.

[0009] In one embodiment, the industrial flow collected by each flow acquisition port is identified according to the identification model corresponding to each flow acquisition port, and the identification result is obtained, including:

[0010] Based on the number of workshops corresponding to each flow acquisition port, determine the identification model corresponding to each flow acquisition port; the identification model is either the first identification model or the second identification model.

[0011] Feature extraction is performed on the industrial traffic collected from each traffic acquisition port to obtain the access characteristics and traffic characteristics of each industrial traffic.

[0012] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results.

[0013] In one embodiment, the identification model corresponding to each traffic acquisition port is determined based on the number of workshops corresponding to each traffic acquisition port, including:

[0014] If the number of workshops corresponding to the traffic acquisition port is the first number, then the identification model corresponding to the traffic acquisition port is determined to be the first identification model; the first identification model is used to identify the protocol type.

[0015] If the number of workshops corresponding to the traffic acquisition port is the second number, then the identification model corresponding to the traffic acquisition port is determined to be the second identification model; the second identification model is used to identify the protocol type and workshop type.

[0016] In one embodiment, the access characteristics and flow characteristics of each industrial flow are input into the corresponding identification model to obtain the identification results, including:

[0017] If the number of workshops corresponding to the traffic acquisition port is the first number, then the first workshop identification result corresponding to each industrial traffic is determined according to the workshop identifier of each industrial traffic, and the access characteristics and traffic characteristics of each industrial traffic are input into the first identification model to obtain the first protocol identification result.

[0018] If the number of workshops corresponding to the traffic acquisition port is the second number, then the access characteristics and traffic characteristics of each industrial traffic are input into the first identification model to obtain the first workshop identification result and the second protocol identification result.

[0019] In one embodiment, the method further includes:

[0020] The port characteristics of each industrial flow are input into the third identification model to obtain the candidate workshop information corresponding to each industrial flow.

[0021] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results, including:

[0022] The information of each candidate workshop, each access feature, and each traffic feature are input into the corresponding recognition model to obtain the recognition results.

[0023] In one embodiment, the method further includes:

[0024] The five-tuple features of each industrial flow are input into the fourth recognition model to obtain the probability value of the protocol information corresponding to each industrial flow.

[0025] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results, including:

[0026] Each quintuple feature, each access feature, and each traffic feature is input into the corresponding recognition model to obtain the recognition result.

[0027] Secondly, this application also provides an industrial flow collection device, comprising:

[0028] The data acquisition module is used to collect industrial flow data from each workshop through the various flow acquisition ports set on the flow acquisition device.

[0029] The identification module is used to identify the industrial flow collected by each flow acquisition port according to the identification model corresponding to each flow acquisition port, and obtain the identification result;

[0030] The aggregation module is used to aggregate the industrial traffic collected from each traffic acquisition port based on the identification results, and obtain the collection results.

[0031] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0032] The industrial flow of each workshop is collected through the flow acquisition ports set on the flow acquisition equipment;

[0033] Based on the identification model corresponding to each flow acquisition port, the industrial flow collected by each flow acquisition port is identified, and the identification results are obtained.

[0034] The industrial traffic collected from each traffic acquisition port is summarized based on the identification results to obtain the collection results.

[0035] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0036] The industrial flow of each workshop is collected through the flow acquisition ports set on the flow acquisition equipment;

[0037] Based on the identification model corresponding to each flow acquisition port, the industrial flow collected by each flow acquisition port is identified, and the identification results are obtained.

[0038] The industrial traffic collected from each traffic acquisition port is summarized based on the identification results to obtain the collection results.

[0039] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0040] The industrial flow of each workshop is collected through the flow acquisition ports set on the flow acquisition equipment;

[0041] Based on the identification model corresponding to each flow acquisition port, the industrial flow collected by each flow acquisition port is identified, and the identification results are obtained.

[0042] The industrial traffic collected from each traffic acquisition port is summarized based on the identification results to obtain the collection results.

[0043] The aforementioned industrial traffic collection method, apparatus, computer equipment, and storage medium collect industrial traffic from each workshop through traffic acquisition ports set on the traffic acquisition device; identify the industrial traffic collected by each traffic acquisition port according to the identification model corresponding to each traffic acquisition port, and obtain the identification result; summarize the industrial traffic collected by each traffic acquisition port based on the identification result, and obtain the collection result. Collecting traffic from multiple workshops through the acquisition ports of the traffic acquisition device ensures orderly transmission of industrial traffic, and the port-based transmission of industrial traffic reduces the possibility of data leakage, thereby improving the security of industrial traffic collection; furthermore, it eliminates the need to set up acquisition nodes in each workshop, reducing the operational complexity of industrial traffic collection. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a diagram illustrating the application environment of an industrial flow collection method in one embodiment.

[0046] Figure 2 This is a flowchart illustrating a method for collecting industrial flow in one embodiment;

[0047] Figure 3 This is a schematic diagram illustrating a deployment scenario of the traffic acquisition device in one embodiment;

[0048] Figure 4 This is a flowchart illustrating a method for collecting industrial flow in another embodiment;

[0049] Figure 5 This is a flowchart illustrating a method for collecting industrial flow in another embodiment;

[0050] Figure 6 This is a flowchart illustrating a method for collecting industrial flow in another embodiment;

[0051] Figure 7 This is a flowchart illustrating a method for collecting industrial flow in another embodiment;

[0052] Figure 8 This is a flowchart illustrating a method for collecting industrial flow in another embodiment;

[0053] Figure 9 This is a flowchart illustrating a method for collecting industrial flow in another embodiment;

[0054] Figure 10 This is a structural block diagram of an industrial flow collection device in one embodiment;

[0055] Figure 11 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0057] Traditional technologies typically employ two approaches to collect industrial traffic. One approach involves using industrial switches for traffic mirroring. While this captures and replicates network traffic, the mirrored traffic may contain sensitive information. Improper handling or attacks could easily lead to data breaches, threatening enterprise network security. Furthermore, the disorderly propagation of mirrored traffic can exacerbate data exchange chaos between workshops, affecting the stability and efficiency of the production network. The other approach involves deploying acquisition nodes in each workshop to collect industrial traffic. While this method allows for accurate data collection and aggregation, each workshop requires the installation and maintenance of independent acquisition nodes, resulting in high installation costs and complex operation and maintenance. Additionally, the potential for duplicate or conflicting IP address traffic data between different workshops makes effective classification and integration of traffic data difficult.

[0058] The industrial flow collection method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, the flow acquisition device 102 communicates with the electronic equipment 104 in the workshop via a network. A data storage system can store the data that the server 104 needs to process. The data storage system can be integrated into the flow acquisition device 102, or it can be placed in the cloud or on other network servers. The flow acquisition device 102 collects industrial flow from each workshop through various flow acquisition ports set on the device. The flow acquisition device 102 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0059] In one embodiment, such as Figure 2As shown, an industrial flow collection method is provided, which can be applied to... Figure 1 Taking the flow acquisition device in the middle as an example, the following is an explanation:

[0060] S201 collects the industrial flow of each workshop through the flow acquisition ports set on the flow acquisition device.

[0061] Industrial traffic refers to the amount of data transmitted in the Industrial Internet, including various types of information and instructions. It serves as the carrier for data transmission in industrial control systems and information systems, and is crucial for ensuring the safe, stable, and efficient operation of industrial production.

[0062] In this application embodiment, the deployment scenario of the traffic acquisition device is as follows: Figure 3 As shown, port information and Media Access Control Address (MAC) are pre-configured on the electronic equipment in each workshop according to the network conditions, and the pre-configuration information is sent to the traffic acquisition device, so that each traffic acquisition port on the traffic acquisition device establishes a connection with the electronic equipment in each workshop. Furthermore, the industrial traffic in each workshop is transmitted to the traffic acquisition device through each traffic acquisition port set on the traffic acquisition device.

[0063] Optionally, the port performance of each traffic acquisition port set on the traffic acquisition device can be determined first, as well as the traffic attributes of each workshop. For example, port performance may include transmission rate, stability, and security, while traffic attributes may include traffic type and data volume. Based on the port performance of each traffic acquisition port and the traffic attributes of each workshop, the corresponding traffic acquisition port can be matched for each workshop to obtain pre-configuration information.

[0064] Optionally, traffic acquisition ports can be matched one-to-one with workshops, or one traffic acquisition port can correspond to multiple workshops.

[0065] Optionally, the Data Plane Development Kit (DPDK) technology can be used to achieve high-performance traffic reception and forwarding, enabling the present invention to maintain extremely low latency and extremely high throughput when processing high-concurrency, high-volume data. This high performance ensures the real-time requirements of industrial control scenarios and provides strong support for the continuity and stability of the production process.

[0066] Optionally, a bypass function can be used to intelligently switch network paths in the event of network anomalies, preventing network interruptions. This provides dual protection for the security and stability of industrial networks. During equipment failure or maintenance, the bypass mechanism ensures the normal transmission of network traffic.

[0067] S202, based on the identification model corresponding to each flow acquisition port, identify the industrial flow collected by each flow acquisition port and obtain the identification result.

[0068] The identification results may include workshop identification results and / or protocol identification results, wherein the workshop identification results represent the workshop information corresponding to the industrial flow, and the protocol identification results represent the protocol information used by the industrial flow.

[0069] In this embodiment, the industrial traffic from each workshop is collected by each traffic acquisition port, and feature extraction is performed to obtain feature information of each industrial traffic flow. Optionally, the feature information of each industrial traffic flow can be at least one of the five-tuple features, which includes source IP address, destination IP address, source port number, destination port number, and transport layer protocol. Further, the feature information of each industrial traffic flow is input into the recognition model corresponding to each traffic acquisition port to obtain the recognition result of each industrial traffic flow.

[0070] Optionally, the characteristic information of each industrial flow can be input into the identification model corresponding to each flow acquisition port to obtain the workshop identification result and protocol identification result of each industrial flow; or, the characteristic information of each industrial flow can be input into the first identification model corresponding to each flow acquisition port to obtain the workshop identification result of each industrial flow, and the characteristic information of each industrial flow can be input into the second identification model corresponding to each flow acquisition port to obtain the protocol identification result of each industrial flow.

[0071] As another alternative implementation method, data of target fields in industrial flow can be extracted, and the extracted data can be input into the recognition model corresponding to each flow acquisition port to obtain the recognition results of each industrial flow.

[0072] S203, based on the identification results, summarize the industrial traffic collected by each traffic acquisition port to obtain the collection results.

[0073] In this embodiment, each industrial flow and its corresponding identification result can be encapsulated, and all encapsulated industrial flows can be used as the collection result; or, the industrial flows collected by each flow acquisition port can be labeled according to the identification result, and all labeled industrial flows can be used as the collection result.

[0074] Optionally, the collected results can be stored in a preset storage location; or, the collected results can be analyzed to obtain the working status of each workshop and realize the monitoring of anomalies in each workshop.

[0075] In the aforementioned method for collecting industrial traffic, industrial traffic from each workshop is collected through various traffic acquisition ports set up on the traffic acquisition device. Based on the identification model corresponding to each traffic acquisition port, the industrial traffic collected by each port is identified, yielding an identification result. The industrial traffic collected by each port is then aggregated based on the identification results to obtain the collection result. Collecting traffic from multiple workshops through the acquisition ports of the traffic acquisition device ensures orderly transmission of industrial traffic. Furthermore, transmitting industrial traffic through ports reduces the possibility of data leakage, thereby improving the security of industrial traffic collection. Additionally, it eliminates the need to set up acquisition nodes in each workshop, reducing the operational complexity of industrial traffic collection.

[0076] In one embodiment, one implementation of the above-described S202 is provided, such as... Figure 4 As shown, the above-mentioned "identifying the industrial flow collected by each flow acquisition port according to the identification model corresponding to each flow acquisition port, and obtaining the identification result" includes:

[0077] S301, determine the identification model corresponding to each traffic acquisition port based on the number of workshops corresponding to each traffic acquisition port; the identification model is either the first identification model or the second identification model.

[0078] In this embodiment, a model correspondence between the number of workshops and the identification model is pre-established. Based on this correspondence, the identification model corresponding to each traffic acquisition port is determined from the first and second identification models. Optionally, the identification model corresponding to each traffic acquisition port can be determined based on the range of workshop numbers corresponding to each traffic acquisition port. If the number of workshops corresponding to a traffic acquisition port is greater than or equal to 1 and less than or equal to 3, then the identification model corresponding to that traffic acquisition port is determined to be the first identification model; if the number of workshops corresponding to a traffic acquisition port is greater than 3, then the identification model corresponding to that traffic acquisition port is determined to be the second identification model.

[0079] Optional, such as Figure 5 As shown, the above "determining the identification model corresponding to each traffic acquisition port based on the number of workshops corresponding to each traffic acquisition port" includes:

[0080] S401, if the number of workshops corresponding to the traffic acquisition port is the first number, then the identification model corresponding to the traffic acquisition port is determined to be the first identification model; the first identification model is used to identify the protocol type.

[0081] In this embodiment of the application, the first quantity can be 1, that is, the traffic acquisition port and the workshop are in a one-to-one correspondence. Then, the workshop type of industrial traffic can be determined according to the traffic acquisition port, the first identification model can be determined as the identification model corresponding to the traffic acquisition port, and the protocol type of industrial traffic can be determined through the first identification model.

[0082] Optionally, as industrial traffic passes through various traffic acquisition ports, the traffic acquisition ports mark the industrial traffic to form industrial traffic labeling information. Based on this labeling information, the port information of the industrial traffic is determined, and further, the workshop type corresponding to that port information is determined. For example, the traffic acquisition ports can mark industrial traffic using Multi-Protocol Label Switching (MPLS) within a Virtual Local Area Network (VLAN). VLAN is a technology that divides LAN devices into several logical LANs, achieving logical isolation while physically sharing the same network devices. MPLS maps IP addresses to short, fixed-length labels, replacing traditional IP table lookups with label switching. This enables highly refined management and analysis of industrial network traffic. This flexible classification method greatly improves the efficiency and accuracy of data processing, providing strong support for subsequent traffic monitoring and analysis.

[0083] S402, if the number of workshops corresponding to the traffic acquisition port is the second number, then the identification model corresponding to the traffic acquisition port is determined to be the second identification model; the second identification model is used to identify the protocol type and workshop type.

[0084] In this embodiment of the application, the first quantity can be any positive integer other than 1. That is, if the traffic acquisition port corresponds to multiple workshops, then it is necessary to classify the industrial traffic acquired by the traffic acquisition port, determine the workshop type corresponding to each industrial traffic, and the protocol type corresponding to each industrial traffic. Therefore, the second identification model is determined as the identification model corresponding to the traffic acquisition port, so as to determine the workshop type and protocol type of the industrial traffic through the second identification model.

[0085] S302 extracts features from the industrial traffic collected by each traffic acquisition port to obtain the access features and traffic features of each industrial traffic.

[0086] Among them, the access characteristics of industrial traffic can be the MAC characteristics of industrial traffic; the traffic characteristics of industrial traffic can be the data format, data volume, traffic generation time, etc.

[0087] In this embodiment, access features and traffic features of industrial traffic can be extracted from industrial traffic using statistical feature extraction methods, dimensionality reduction feature extraction methods, etc. Optionally, a first field corresponding to the access features and a second field corresponding to the traffic features can be preset, thereby reading the first and second fields in the industrial traffic to obtain the access features and traffic features of the industrial traffic.

[0088] S303: Input the access characteristics and flow characteristics of each industrial flow into the corresponding recognition model to obtain the recognition result.

[0089] In this embodiment of the application, the access characteristics and flow characteristics of industrial traffic are input into a first identification model to obtain an identification result; or, the access characteristics and flow characteristics of industrial traffic are input into a second identification model to obtain an identification result.

[0090] In the above-mentioned application embodiments, the identification model corresponding to each traffic acquisition port is determined according to the number of workshops corresponding to the traffic acquisition port, which improves the matching degree between the identification model and the industrial traffic, thereby improving the accuracy of the identification results output by the identification model. Furthermore, feature extraction is performed on the industrial traffic, and the extracted access features and traffic features are used as inputs to the model, reducing the interference of useless information on the identification process and further improving the accuracy of the identification results output by the identification model.

[0091] In one embodiment, an implementation of the above S303 is provided, such as... Figure 6 As shown, the above-mentioned "inputting the access characteristics and flow characteristics of each industrial flow into the corresponding recognition model to obtain the recognition result" includes:

[0092] S501, if the number of workshops corresponding to the traffic acquisition port is the first number, then determine the first workshop identification result corresponding to each industrial traffic according to the workshop identifier of each industrial traffic, and input the access characteristics and traffic characteristics of each industrial traffic into the first identification model to obtain the first protocol identification result.

[0093] The first identification model is an identification model trained based on historical industrial flow.

[0094] In this embodiment of the application, the first quantity can be 1, that is, the traffic acquisition port and the workshop are in a one-to-one correspondence. Then, the first workshop identification result corresponding to the industrial traffic can be determined according to the workshop identifier. The access characteristics and traffic characteristics of the industrial traffic are used as the input data of the first identification model. The first protocol identification result corresponding to the industry is determined through the first identification model.

[0095] Optionally, the construction process of the first identification model may include: using the access features and traffic features in the package sequence as input to the first identification model, where the package sequence can be represented as P = {P mac ,P flow ,P port},in, and P represents access characteristics, traffic characteristics, and port characteristics, respectively. * i The table shows the features of the i-th package. Further, a linear layer P is used. i Perform the transformation and use the Sigmoid function to obtain the output feature Z. mf ,in P represents i The output features after the l-th linear transformation are then processed by the hidden layer to obtain the recognition result. The hidden layer has H neurons and can be represented as shown in Equations 1 and 2.

[0096]

[0097] Z l+1 =σ(Linear(Z) l (Equation 2)

[0098] in, It is the weight from layer (l-1) to layer l. σ is the bias, σ is the Sigmoid activation function, and δ is the Softmax activation function.

[0099] In this embodiment, the output result of the output layer is the output result corresponding to the protocol type, which can be expressed as Equations 3 and 4:

[0100]

[0101] in, Indicates the weight of the protocol type. δ represents the bias of the protocol type, and δ represents the softmax activation function.

[0102] S502, if the number of workshops corresponding to the traffic acquisition port is the second number, then the access characteristics and traffic characteristics of each industrial traffic are input into the first identification model to obtain the first workshop identification result and the second protocol identification result.

[0103] The second identification model is an identification model trained based on historical industrial flow.

[0104] In this embodiment, the process of establishing the second identification model can be the same as that of establishing the first identification model. The output results of the output layer are the output results corresponding to the protocol type and the output results corresponding to the workshop type. The output results corresponding to the protocol type can be expressed as Equations 3 and 4 above, and the output results corresponding to the workshop type can be expressed as Equations 5 and 6.

[0105]

[0106] in, The weight representing the workshop type, δ represents the bias of the workshop type, and δ represents the softmax activation function.

[0107] Optionally, during the training of the first and second recognition models, the loss function can be expressed as Equation 7:

[0108]

[0109] Where K and M represent the number of workshop and protocol categories, respectively. These represent the actual category labels for workshop and protocol categories, respectively.

[0110] In the above application embodiments, the access characteristics and traffic characteristics of each industrial flow are input into the identification model that matches the industrial flow to obtain the identification result, which improves the matching degree between the identification result and the industrial flow. Moreover, when the number of workshops is the first number, there is no need to identify the workshop category, which improves the efficiency of identifying industrial flow.

[0111] In one embodiment, such as Figure 7 As shown, the above-mentioned inputting the access characteristics and flow characteristics of each industrial flow into the corresponding recognition model to obtain the recognition result also includes:

[0112] S304. Input the port characteristics of each industrial flow into the third identification model to obtain the candidate workshop information and candidate protocol information corresponding to each industrial flow.

[0113] In this embodiment of the application, the port characteristics of the package sequence are... As input, a multilayer perceptron model is trained based on port features to construct a port recognition loss function: Combining the loss function L1 and the port recognition loss function L2 from Equation 7 above yields the total loss function: Here, α and β represent the weight ratios of the two loss functions (0 < α < 1, 0 < β < 1). A third recognition model is obtained by jointly training the network using MAC features, flow characteristics, and port features. Then, by inputting the port features into the third recognition model, candidate workshop information and candidate protocol information corresponding to each industrial flow are obtained.

[0114] Based on this, the aforementioned "inputting the access characteristics and flow characteristics of each industrial flow into the corresponding recognition model to obtain the recognition result" includes:

[0115] S305: Input the information of each candidate workshop, each candidate protocol, each access feature, and each traffic feature into the corresponding recognition model to obtain the recognition result.

[0116] In this embodiment of the application, each candidate workshop information, each candidate protocol information, each access feature, and each traffic feature are input into the corresponding identification model to determine the workshop type corresponding to each industrial traffic from the candidate workshop information, and / or to determine the protocol type corresponding to each industrial traffic from the candidate protocol information.

[0117] In the above application embodiments, the candidate workshop type and candidate protocol type are determined by the third identification model. Based on the determination of the candidate range, the industrial traffic is identified according to the access characteristics and various traffic characteristics, which improves the accuracy of the identification results.

[0118] In the embodiments of this application, such as Figure 8 As shown, the above-mentioned inputting the access characteristics and flow characteristics of each industrial flow into the corresponding recognition model to obtain the recognition result also includes:

[0119] S306, input the five-tuple features of each industrial flow into the fourth recognition model to obtain the probability value of the protocol information corresponding to each industrial flow.

[0120] In this embodiment, the quintuple characteristic of industrial flow can be represented as: f t = (src_IP, dst_IP, src_port, dsst_port, protocol), where f c For protocol content characteristics; f b As behavioral features, the protocol content features and behavioral features are used as inputs, and the probability of each protocol type is estimated using the fourth identification model:

[0121]

[0122] Where, f = (f t ,f c ,f b ) is the merged feature vector. w m It is the weight vector corresponding to protocol type m; exp is the exponential function used to convert linear combinations into probability values.

[0123] Based on this, the aforementioned "inputting the access characteristics and flow characteristics of each industrial flow into the corresponding recognition model to obtain the recognition result" includes:

[0124] S307: Input the probability values ​​of each protocol information, each access feature, and each traffic feature into the corresponding recognition model to obtain the recognition result.

[0125] In this embodiment, the probability values ​​of each protocol information are used as reference data and input together with each access feature and each traffic feature into the corresponding identification model to obtain the identification result. Optionally, the identification result may include the workshop type, or the workshop type and the protocol type.

[0126] In the above application embodiments, the probability value of each protocol information is determined by the fourth identification model. Given the probability value of each protocol information, industrial traffic is identified based on access characteristics and traffic characteristics, thereby improving the accuracy of the identification results.

[0127] In one embodiment, a complete method for collecting industrial flow is provided, such as Figure 9 As shown, the above method includes:

[0128] S1 collects the industrial flow of each workshop through the flow acquisition ports set on the flow acquisition device.

[0129] S2, based on the identification model corresponding to each flow acquisition port, identifies the industrial flow collected by each flow acquisition port and obtains the identification result.

[0130] S3: Input the access characteristics and flow characteristics of each industrial flow into the corresponding recognition model to obtain the recognition results.

[0131] S4. Determine whether the number of workshops corresponding to the traffic acquisition port is the first number or the second number. If the number of workshops corresponding to the traffic acquisition port is the first number, then execute S5-S7; if the number of workshops corresponding to the traffic acquisition port is the second number, then execute S8-S10.

[0132] S5, determine the identification model corresponding to the traffic collection port as the first identification model; the first identification model is used to identify the protocol type;

[0133] S6. Input the five-tuple features of each industrial flow into the fourth recognition model to obtain the probability value of the protocol information corresponding to each industrial flow.

[0134] S7. Determine the first workshop identification result corresponding to each industrial flow based on the workshop identifier of each industrial flow, and input each candidate workshop information, each candidate protocol information, each access feature, and each flow feature into the first identification model to obtain the first protocol identification result.

[0135] S8, determine the identification model corresponding to the traffic acquisition port as the second identification model; the second identification model is used to identify the protocol type and workshop type.

[0136] S9 inputs the port characteristics of each industrial flow into the third identification model to obtain the candidate workshop information and candidate protocol information corresponding to each industrial flow.

[0137] S10, input the candidate workshop information, candidate protocol information, access characteristics and traffic characteristics of each industrial flow into the second identification model to obtain the first workshop identification result and the second protocol identification result.

[0138] In the aforementioned method for collecting industrial traffic, industrial traffic from each workshop is collected through various traffic acquisition ports set up on the traffic acquisition device. Based on the identification model corresponding to each traffic acquisition port, the industrial traffic collected by each port is identified, yielding an identification result. The industrial traffic collected by each port is then aggregated based on the identification results to obtain the collection result. Collecting traffic from multiple workshops through the acquisition ports of the traffic acquisition device ensures orderly transmission of industrial traffic. Furthermore, transmitting industrial traffic through ports reduces the possibility of data leakage, thereby improving the security of industrial traffic collection. Additionally, it eliminates the need to set up acquisition nodes in each workshop, reducing the operational complexity of industrial traffic collection.

[0139] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0140] Based on the same inventive concept, this application also provides an industrial flow collection device for implementing the above-described industrial flow collection method. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations of one or more embodiments of the industrial flow collection device provided below can be found in the limitations of the industrial flow collection method described above, and will not be repeated here.

[0141] In one embodiment, such as Figure 10 As shown, an industrial flow collection device is provided, comprising: a collection module 10, an identification module 11, and a summarization module 12, wherein:

[0142] The acquisition module 10 is used to acquire the industrial flow of each workshop through the flow acquisition ports set on the flow acquisition device.

[0143] The identification module 11 is used to identify the industrial flow collected by each flow acquisition port according to the identification model corresponding to each flow acquisition port, and obtain the identification result.

[0144] The aggregation module 12 is used to aggregate the industrial traffic collected by each traffic acquisition port according to the identification results, and obtain the collection results.

[0145] In one embodiment, the identification module 11 includes: a determining unit, an extraction unit, and a first identification unit, wherein:

[0146] The determining unit is used to determine the identification model corresponding to each traffic acquisition port based on the number of workshops corresponding to each traffic acquisition port; the identification model is either the first identification model or the second identification model.

[0147] The extraction unit is used to extract features from the industrial traffic collected by each traffic acquisition port to obtain the access features and traffic features of each industrial traffic.

[0148] The first identification unit is used to input the access characteristics and flow characteristics of each industrial flow into the corresponding identification model to obtain the identification result.

[0149] In one embodiment, the determining unit is specifically used to determine the identification model corresponding to the traffic acquisition port as a first identification model if the number of workshops corresponding to the traffic acquisition port is a first number; the first identification model is used to identify the protocol type; if the number of workshops corresponding to the traffic acquisition port is a second number, the identification model corresponding to the traffic acquisition port is determined as a second identification model; the second identification model is used to identify the protocol type and the workshop type.

[0150] In one embodiment, the first identification unit is specifically configured to: if the number of workshops corresponding to the traffic acquisition port is a first number, determine the first workshop identification result corresponding to each industrial traffic based on the workshop identifier of each industrial traffic, and input the access characteristics and traffic characteristics of each industrial traffic into the first identification model to obtain the first protocol identification result; if the number of workshops corresponding to the traffic acquisition port is a second number, input the access characteristics and traffic characteristics of each industrial traffic into the second identification model to obtain the first workshop identification result and the second protocol identification result.

[0151] In one embodiment, the aforementioned industrial flow collection device further includes: a second identification unit, wherein:

[0152] The second identification unit is used to input the port characteristics of each industrial flow into the third identification model to obtain the candidate workshop information and candidate protocol information corresponding to each industrial flow.

[0153] The first identification unit is used to input the information of each candidate workshop, each candidate protocol, each access feature, and each traffic feature into the corresponding identification model to obtain the identification result.

[0154] In one embodiment, the aforementioned industrial flow collection device further includes: a third identification unit, wherein:

[0155] The third identification unit is used to input the five-tuple features of each industrial flow into the fourth identification model to obtain the probability value of the protocol information corresponding to each industrial flow.

[0156] The first identification unit is used to input the probability values ​​of each protocol information, each access feature, and each traffic feature into the corresponding identification model to obtain the identification result.

[0157] Each module in the aforementioned industrial flow collection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0158] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 11 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores collected industrial flow data. The I / O interfaces are used for information exchange between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When executed by the processor, the computer program implements an industrial flow collection method.

[0159] Those skilled in the art will understand that Figure 11 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0160] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0161] The industrial flow of each workshop is collected through the flow acquisition ports set on the flow acquisition equipment;

[0162] Based on the identification model corresponding to each flow acquisition port, the industrial flow collected by each flow acquisition port is identified, and the identification results are obtained.

[0163] The industrial traffic collected from each traffic acquisition port is summarized based on the identification results to obtain the collection results.

[0164] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0165] Based on the number of workshops corresponding to each flow acquisition port, determine the identification model corresponding to each flow acquisition port; the identification model is either the first identification model or the second identification model.

[0166] Feature extraction is performed on the industrial traffic collected from each traffic acquisition port to obtain the access characteristics and traffic characteristics of each industrial traffic.

[0167] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results.

[0168] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0169] If the number of workshops corresponding to the traffic acquisition port is the first number, then the identification model corresponding to the traffic acquisition port is determined to be the first identification model; the first identification model is used to identify the protocol type.

[0170] If the number of workshops corresponding to the traffic acquisition port is the second number, then the identification model corresponding to the traffic acquisition port is determined to be the second identification model; the second identification model is used to identify the protocol type and workshop type.

[0171] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0172] If the number of workshops corresponding to the traffic acquisition port is the first number, then the first workshop identification result corresponding to each industrial traffic is determined according to the workshop identifier of each industrial traffic, and the access characteristics and traffic characteristics of each industrial traffic are input into the first identification model to obtain the first protocol identification result;

[0173] If the number of workshops corresponding to the traffic acquisition port is the second number, then the access characteristics and traffic characteristics of each industrial traffic are input into the second identification model to obtain the first workshop identification result and the second protocol identification result.

[0174] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0175] The port characteristics of each industrial flow are input into the third identification model to obtain the candidate workshop information and candidate protocol information corresponding to each industrial flow.

[0176] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results, including:

[0177] The information of each candidate workshop, each candidate protocol, each access feature, and each traffic feature are input into the corresponding recognition model to obtain the recognition results.

[0178] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0179] The five-tuple features of each industrial flow are input into the fourth recognition model to obtain the probability value of the protocol information corresponding to each industrial flow.

[0180] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results, including:

[0181] The probability values ​​of each protocol, each access feature, and each traffic feature are input into the corresponding recognition model to obtain the recognition results.

[0182] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0183] The industrial flow of each workshop is collected through the flow acquisition ports set on the flow acquisition equipment;

[0184] Based on the identification model corresponding to each flow acquisition port, the industrial flow collected by each flow acquisition port is identified, and the identification results are obtained.

[0185] The industrial traffic collected from each traffic acquisition port is summarized based on the identification results to obtain the collection results.

[0186] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0187] Based on the number of workshops corresponding to each flow acquisition port, determine the identification model corresponding to each flow acquisition port; the identification model is either the first identification model or the second identification model.

[0188] Feature extraction is performed on the industrial traffic collected from each traffic acquisition port to obtain the access characteristics and traffic characteristics of each industrial traffic.

[0189] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results.

[0190] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0191] If the number of workshops corresponding to the traffic acquisition port is the first number, then the identification model corresponding to the traffic acquisition port is determined to be the first identification model; the first identification model is used to identify the protocol type.

[0192] If the number of workshops corresponding to the traffic acquisition port is the second number, then the identification model corresponding to the traffic acquisition port is determined to be the second identification model; the second identification model is used to identify the protocol type and workshop type.

[0193] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0194] If the number of workshops corresponding to the traffic acquisition port is the first number, then the first workshop identification result corresponding to each industrial traffic is determined according to the workshop identifier of each industrial traffic, and the access characteristics and traffic characteristics of each industrial traffic are input into the first identification model to obtain the first protocol identification result;

[0195] If the number of workshops corresponding to the traffic acquisition port is the second number, then the access characteristics and traffic characteristics of each industrial traffic are input into the second identification model to obtain the first workshop identification result and the second protocol identification result.

[0196] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0197] The port characteristics of each industrial flow are input into the third identification model to obtain the candidate workshop information and candidate protocol information corresponding to each industrial flow.

[0198] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results, including:

[0199] The information of each candidate workshop, each candidate protocol, each access feature, and each traffic feature are input into the corresponding recognition model to obtain the recognition results.

[0200] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0201] The five-tuple features of each industrial flow are input into the fourth recognition model to obtain the probability value of the protocol information corresponding to each industrial flow.

[0202] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results, including:

[0203] The probability values ​​of each protocol, each access feature, and each traffic feature are input into the corresponding recognition model to obtain the recognition results.

[0204] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0205] The industrial flow of each workshop is collected through the flow acquisition ports set on the flow acquisition equipment;

[0206] Based on the identification model corresponding to each flow acquisition port, the industrial flow collected by each flow acquisition port is identified, and the identification results are obtained.

[0207] The industrial traffic collected from each traffic acquisition port is summarized based on the identification results to obtain the collection results.

[0208] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0209] Based on the number of workshops corresponding to each flow acquisition port, determine the identification model corresponding to each flow acquisition port; the identification model is either the first identification model or the second identification model.

[0210] Feature extraction is performed on the industrial traffic collected from each traffic acquisition port to obtain the access characteristics and traffic characteristics of each industrial traffic.

[0211] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results.

[0212] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0213] If the number of workshops corresponding to the traffic acquisition port is the first number, then the identification model corresponding to the traffic acquisition port is determined to be the first identification model; the first identification model is used to identify the protocol type.

[0214] If the number of workshops corresponding to the traffic acquisition port is the second number, then the identification model corresponding to the traffic acquisition port is determined to be the second identification model; the second identification model is used to identify the protocol type and workshop type.

[0215] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0216] If the number of workshops corresponding to the traffic acquisition port is the first number, then the first workshop identification result corresponding to each industrial traffic is determined according to the workshop identifier of each industrial traffic, and the access characteristics and traffic characteristics of each industrial traffic are input into the first identification model to obtain the first protocol identification result;

[0217] If the number of workshops corresponding to the traffic acquisition port is the second number, then the access characteristics and traffic characteristics of each industrial traffic are input into the second identification model to obtain the first workshop identification result and the second protocol identification result.

[0218] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0219] The port characteristics of each industrial flow are input into the third identification model to obtain the candidate workshop information and candidate protocol information corresponding to each industrial flow.

[0220] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results, including:

[0221] The information of each candidate workshop, each candidate protocol, each access feature, and each traffic feature are input into the corresponding recognition model to obtain the recognition results.

[0222] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0223] The five-tuple features of each industrial flow are input into the fourth recognition model to obtain the probability value of the protocol information corresponding to each industrial flow.

[0224] The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition results, including:

[0225] The probability values ​​of each protocol, each access feature, and each traffic feature are input into the corresponding recognition model to obtain the recognition results.

[0226] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0227] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0228] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for collecting industrial flow, characterized in that, Applied to a flow acquisition device, the method includes: The industrial flow of each workshop is collected through the flow acquisition ports set on the flow acquisition device; Based on the number of workshops corresponding to each of the traffic acquisition ports, the identification model corresponding to each of the traffic acquisition ports is determined; the identification model is a first identification model or a second identification model; the first identification model is used to identify the protocol type, and the second identification model is used to identify the protocol type and the workshop type; Feature extraction is performed on the industrial traffic collected by each of the aforementioned traffic acquisition ports to obtain the access characteristics and traffic characteristics of each of the aforementioned industrial traffic. The access characteristics and flow characteristics of each industrial flow are input into the corresponding recognition model to obtain the recognition result; The industrial traffic collected by each of the traffic acquisition ports is summarized based on the identification results to obtain the collection results.

2. The method according to claim 1, characterized in that, The step of determining the identification model corresponding to each traffic acquisition port based on the number of workshops corresponding to each traffic acquisition port includes: If the number of workshops corresponding to the traffic acquisition port is the first number, then the identification model corresponding to the traffic acquisition port is determined to be the first identification model; If the number of workshops corresponding to the traffic acquisition port is the second number, then the identification model corresponding to the traffic acquisition port is determined to be the second identification model.

3. The method according to claim 1, characterized in that, The step of inputting the access characteristics and flow characteristics of each industrial flow into the corresponding recognition model to obtain the recognition result includes: If the number of workshops corresponding to the traffic acquisition port is a first number, then the first workshop identification result corresponding to each industrial traffic is determined according to the workshop identifier of each industrial traffic, and the access characteristics and traffic characteristics of each industrial traffic are input into the first identification model to obtain the first protocol identification result; If the number of workshops corresponding to the traffic acquisition port is the second number, then the access characteristics and traffic characteristics of each industrial traffic flow are input into the second identification model to obtain the first workshop identification result and the second protocol identification result.

4. The method according to claim 1, characterized in that, The method further includes: The port characteristics of each industrial flow are input into the third identification model to obtain the candidate workshop information and candidate protocol information corresponding to each industrial flow. The step of inputting the access characteristics and flow characteristics of each industrial flow into the corresponding recognition model to obtain the recognition result includes: The candidate workshop information, candidate protocol information, access characteristics, and traffic characteristics are input into the corresponding recognition model to obtain the recognition result.

5. The method according to claim 1, characterized in that, The method further includes: The five-tuple features of each of the industrial flows are input into the fourth recognition model to obtain the probability value of the protocol information corresponding to each of the industrial flows; The step of inputting the access characteristics and flow characteristics of each industrial flow into the corresponding recognition model to obtain the recognition result includes: The probability values ​​of each protocol information, each access feature, and each traffic feature are input into the corresponding recognition model to obtain the recognition result.

6. The method according to any one of claims 1-5, characterized in that, The identification results include workshop identification results and / or protocol identification results, wherein the workshop identification results represent the workshop information corresponding to the industrial flow, and the protocol identification results represent the protocol information used by the industrial flow.

7. An industrial flow collection device, characterized in that, The device includes: The data acquisition module is used to collect industrial flow data from each workshop through the various flow acquisition ports set on the flow acquisition device. The identification module is used to determine the identification model corresponding to each of the traffic acquisition ports based on the number of workshops corresponding to each traffic acquisition port; the identification model is a first identification model or a second identification model; the module extracts features from the industrial traffic collected by each of the traffic acquisition ports to obtain the access features and traffic features of each of the industrial traffic; the module inputs the access features and traffic features of each of the industrial traffic into the corresponding identification model to obtain the identification result; the first identification model is used to identify the protocol type, and the second identification model is used to identify the protocol type and workshop type; The aggregation module is used to aggregate the industrial traffic collected by each of the traffic acquisition ports according to the identification results, and obtain the collection results.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images