Trusted DCS log arrangement and collection method and system

Abstract

The invention discloses a trusted DCS log arrangement and collection method and system, and belongs to the technical field of industrial control security, and the method comprises the steps: obtaining logs of a trusted DCS system in real time, the logs being divided into security logs, audit logs, alarm logs, operation logs and business logs; judging whether the current log is an alarm log or not; if yes, when an alarm is caused by abnormity, an alarm log is uploaded to a trusted management center in a long-time link pushing mode; if not, whether the log is an audit log or a security log is judged, if yes, a regular non-busy-hour pushing mechanism is adopted, and the trusted node judges the cache of the sending queue and the load rate of the CPU and uploads the log to a trusted management center; if not, the log is a running log or a business log, and an instruction for waiting for manual log collection of operation and maintenance personnel is sent out. According to the method, the problems of more types of trusted DCS logs and complicated log extraction are solved.

Description

Technical Field

[0001] The invention belongs to the technical field of industrial control safety, and relates to a trusted DCS log sorting and collection method and system. Background Art

[0002] In modern industrial control systems, distributed control systems (DCS) are an important control system that is widely used in power, chemical, petroleum, natural gas and other industries. DCS systems are usually composed of multiple control nodes, each of which is responsible for a specific control task and realizes data exchange and coordination through network communication. In order to ensure the security and reliability of the DCS system, it is necessary to record and analyze the system's operating status, operation records, and alarm information in detail, which is the function of logging. With the continuous development of trusted technology, trusted DCS systems have gradually become the mainstream of industrial control systems. Based on the traditional DCS system, the trusted DCS system has added functions such as trusted computing, network security, and information confidentiality, which improves the security and reliability of the system. However, the logging and collection of trusted DCS systems still face some challenges.

[0003] In the engineering practice of thermal power plant industrial control systems based on trusted technology, there are a large number of trusted devices in various forms in the power plant, such as workstations, servers, controllers, switches, etc. The forms, operating systems, communications and processing capabilities of different devices are different. At the same time, there are many types of logs inside the trusted system, such as security logs, audit logs, alarm logs, operation logs, and business logs. In order to simplify the efficiency of log collection to the maximum extent, the impact on the control system has been reduced.

[0004] Existing trusted DCS systems usually adopt a centralized log collection method, that is, a log server is set up in the trusted management center, and each control node sends log information to the log server for centralized storage and management. The advantage of this method is that logs can be centrally managed, which is convenient for query and analysis, but it also has some disadvantages. First, centralized log collection requires a large amount of network bandwidth and storage space, which can easily become a performance bottleneck of the system. Secondly, centralized log collection may lead to the leakage of log information, which poses certain security risks.

[0005] The existing trusted DCS system has some problems in log collection. First, due to the various types of control nodes in the trusted DCS system, different operating systems and communication capabilities, how to effectively collect and organize logs of different types of nodes is a difficult problem. Secondly, there are many types of logs in the trusted DCS system, such as security logs, audit logs, alarm logs, operation logs, business logs, etc. How to efficiently process different types of logs is also a challenge. In addition, the existing centralized log collection method has performance bottlenecks and security risks, and it is necessary to find a more efficient and secure decentralized log collection method. Summary of the invention

[0006] The purpose of the present invention is to provide a method for collating and collecting trusted DCS logs, which solves the problem that there are many types of trusted DCS logs and the log extraction is complicated.

[0007] To achieve the above purpose, the present invention adopts the following technical means: The first aspect of the present invention is to provide a trusted DCS log collection method, comprising: Obtain the logs of the trusted DCS system in real time. The logs are divided into security logs, audit logs, alarm logs, operation logs, and business logs. Determine whether the current log is an alarm log; If so, when an abnormality causes an alarm, the alarm log is sent to the trusted management center through long-term link push; If not, determine whether it is an audit log or a security log: If yes, a regular non-busy-hour push mechanism is adopted, and the trusted node judges the load rate of the sending queue cache and CPU and sends it to the trusted management center; If not, it is an operation log or business log, and an instruction to wait for manual log collection by the operation and maintenance personnel is issued.

[0008] As a further improvement of the present invention, after the alarm log is sent to the trusted management center by long-term link push, the controller is interrupted for high priority processing; The transmission interval of the alarm log is 1 second, the transmission channel is a long-term connection, and the transmission protocol is TCP / IP.

[0009] As a further improvement of the present invention, in the trusted DCS system, for a workstation, when the CPU utilization is less than 20% and the network load is less than 20%, the audit log and the security log can be sent to the trusted management center.

[0010] For the controller, within a 200ms period, when the single-core CPU utilization is less than 70% and the network port buffer occupancy is less than 20kbyte, the sending of audit logs and security logs is allowed; The transmission interval of audit logs and security logs is 10 minutes, the transmission channel is a non-busy-hour connection, and the transmission protocol is TCP / IP.

[0011] As a further improvement of the present invention, the workstation or server transmits the instruction of packing logs through the encrypted transmission channel between the trusted node, and the instruction requires the operation and maintenance personnel to input the required log file path according to the maintenance document; After receiving the command to pack logs, the trusted node packs the log folder under the specified path. The file name is node name + date + the last section of the log path. After the command is executed, the packed result is sent to the local log of the trusted management platform through an encrypted transmission channel. The encryption algorithm of the encrypted transmission channel is AES-256, and the transmission protocol is HTTPS.

[0012] As a further improvement of the present invention, the controller device requires operation and maintenance personnel to collect logs on-site by directly connecting to the serial port or replacing the memory card.

[0013] As a further improvement of the present invention, the step of real-time monitoring of key performance indicators of the trusted DCS system is also included, specifically including: Obtain logs of the trusted DCS system in real time, and buffer and transmit them through the message queue; process and analyze the logs, extract key information and conduct preliminary analysis; the key information includes: processing speed, throughput, latency, number of abnormal logs and resource utilization; Store the processed log data in Elasticsearch; Create dashboards and charts to display real-time statistics and trend analysis of log data; Set threshold warnings to automatically trigger warning notifications when key information exceeds the normal range; Set custom alarm rules according to business needs, and send alarm notifications to operation and maintenance personnel when the processing speed decreases or the number of abnormal logs increases sharply.

[0014] As a further improvement of the present invention, the step of dynamically adjusting the push policy is also included, specifically including: Collect data on system load and network status in real time; Formulate appropriate push strategies based on the collected data; strategies include: automatically reducing the frequency of log push when network congestion is detected; appropriately increasing the amount of log push when the system load is low; predicting future system load and network conditions, and adjusting push strategies in advance based on the prediction results; Enforce the established policies by programming or configuring the log push system; Continuously monitor system load and network status, adjust strategies based on actual conditions, and perform performance evaluation and optimization.

[0015] As a further improvement of the present invention, an intelligent cache management step is also included, specifically including: Establish a log importance assessment model based on business needs; assess the importance of logs based on factors such as their level and content; Configure priority caching, dynamic adjustment of cache size, deduplication and compression strategies. Priority caching means that important logs should be kept in the cache even if the storage space is tight. Dynamic adjustment of cache size means dynamically adjusting the cache size according to the available storage space of the system and the log generation speed. When the storage space is tight, reduce the retention time of old logs in the cache or delete some low-priority logs. Deduplication and compression means deduplication of duplicate logs or logs with similar contents. Use compression algorithm to compress and store logs in the cache. Monitor the system's available storage space in real time to ensure that the implementation of cache policies does not lead to storage space exhaustion; set storage space usage thresholds, and trigger an early warning mechanism when the threshold is reached to remind the administrator or automatically perform cache cleanup operations; Regularly evaluate the performance of cache management strategies and make optimization adjustments based on the evaluation results.

[0016] The second aspect of the present invention is to provide a trusted DCS log collection system, comprising: The acquisition module is used to obtain the logs of the trusted DCS system in real time. The logs are divided into security logs, audit logs, alarm logs, operation logs, and business logs; The judgment module is used to determine whether the current log is an alarm log; if so, when an alarm occurs due to an abnormality, the alarm log is sent to the trusted management center by long-term link push; if not, determine whether it is an audit log or a security log: if so, a regular non-busy-hour push mechanism is used, and the trusted node judges the sending queue cache and CPU load rate and sends it to the trusted management center; if not, it is an operation log or a business log, and an instruction is issued to wait for the operation and maintenance personnel to manually collect the log.

[0017] A third aspect of the present invention is to provide an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the trusted DCS log collating and collecting method when executing the computer program.

[0018] A fourth aspect of the present invention is to provide a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the trusted DCS log sorting and collection method is implemented.

[0019] Compared with the prior art, the present invention has the following beneficial effects: The present invention minimizes the impact of log extraction on each trusted node, especially on the controller device, by classifying the logs. Direct log collection of the controller without evaluation may cause delay, congestion or other abnormal results of the control logic. Effective log extraction can reduce the load of the trusted system and enhance the reliability of the trusted system. A decentralized log collection method is adopted to avoid the performance bottleneck and security risk of centralized log collection. By setting different priorities and push mechanisms on different nodes, different types of logs can be processed more efficiently, and the efficiency and accuracy of log collection can be improved. Encrypted transmission channels and instructions for packaging logs are adopted to enhance the security of log transmission and avoid the leakage of log information. At the same time, for the controller device, the operation and maintenance personnel are required to collect logs on the spot by directly connecting the serial port or replacing the memory card, which further ensures the security of the log. Allowing the operation and maintenance personnel to collect logs manually facilitates the operation and maintenance personnel to query and analyze the logs. At the same time, after the trusted management platform completes the collection, the operation and maintenance personnel are notified to extract the logs, which further simplifies the operation process of the operation and maintenance personnel and improves the convenience of maintenance. The present invention is applicable to various types of trusted nodes, including workstations, servers, controllers, etc., and has strong applicability. In general, compared with the existing technology, this technical solution not only improves the efficiency and security of log collection, but also reduces the impact on the system and facilitates maintenance. It has strong practicality and superiority. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A flow chart of a trusted DCS log collection method provided by the present invention; Figure 2 This is a schematic diagram of the trusted DCS log collection method in Example 1; Figure 3 A credible DCS log sorting and collection system is provided by the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein.

[0023] In addition, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or elements is not necessarily limited to those steps or elements explicitly listed, but may include other steps or elements not explicitly listed or inherent to such process, method, product, or apparatus.

[0024] The first object of the present invention is to provide a reliable DCS log collection method. Figure 1 As shown, the following steps are included: S1, real-time acquisition of logs of the trusted DCS system, which are divided into security logs, audit logs, alarm logs, operation logs, and business logs; S2, determine whether the current log is an alarm log; If so, when an abnormality causes an alarm, the alarm log is sent to the trusted management center through long-term link push; If not, determine whether it is an audit log or a security log: If yes, a regular non-busy-hour push mechanism is adopted, and the trusted node judges the load rate of the sending queue cache and CPU and sends it to the trusted management center; If not, it is an operation log or business log, and an instruction to wait for manual log collection by the operation and maintenance personnel is issued.

[0025] This method mainly organizes and collects logs of the trusted DCS (Distributed Control System) system. Its core principle is to subdivide the logs of the DCS system into several categories, such as security logs, audit logs, alarm logs, operation logs, and business logs. This classification helps to accurately process and analyze the logs in the future. The system obtains various logs generated by the DCS system in real time. A preliminary judgment is made on the obtained logs to determine their types (such as alarm logs, audit logs, security logs, etc.). Alarm log: When the system determines that the current log is an alarm log and an abnormal situation occurs, a long-term link push method is adopted to ensure that the alarm information can be quickly and reliably sent to the trusted management center for timely response and processing. Audit log and security log: For audit logs and security logs, the system adopts a regular non-busy push mechanism. The trusted node makes a judgment based on the sending queue cache and the CPU load rate, and selects the time period with low system load to push, so as to reduce the impact on the normal operation of the DCS system. Operation log and business log: For operation logs and business logs, the system defaults to issue an instruction to wait for the operation and maintenance personnel to manually collect logs. This method allows operation and maintenance personnel to flexibly arrange log collection and processing time according to actual needs.

[0026] The long-term link push method is used for alarm logs to ensure the real-time and efficient alarm information. When an abnormal situation occurs, the alarm information can be quickly conveyed to the trusted management center so that timely measures can be taken to deal with it. Audit logs and security logs use a regular non-busy push mechanism to effectively utilize system resources. By judging the load rate of the sending queue cache and the CPU, the time period with low system load is selected for push, avoiding adding additional burden when the system is busy. For operation logs and business logs, the system defaults to issuing instructions to wait for manual log collection by operation and maintenance personnel. This method gives operation and maintenance personnel greater flexibility and can flexibly arrange log collection and processing time according to actual needs. This method ensures the security and reliability of log data by classifying and processing different types of logs and adopting corresponding push mechanisms. At the same time, the long-term link push method also improves the reliability of data transmission.

[0027] Optionally, detailed classification and orderly processing of logs facilitate subsequent log management and analysis. Operation and maintenance personnel can easily retrieve and analyze various types of log data as needed, providing strong support for the optimization and improvement of the DCS system. This trusted DCS log collection method achieves efficient, safe, and reliable processing and collection of DCS system logs through fine log classification and flexible push mechanism. At the same time, this method also gives operation and maintenance personnel greater flexibility and improves the convenience of log management and analysis.

[0028] As an example, the logs of a trusted DCS system are divided into five categories: security log, audit log, alarm log, operation log, and business log. Among them, the real-time requirement of the alarm log is the highest, the real-time requirement of the security log and audit log is medium, and the real-time requirement of the business log and operation log is the lowest. Therefore, different strategies need to be adopted when processing different types of logs.

[0029] The specific processing steps of the present invention are as follows: When an abnormality causes an alarm, the alarm log needs to be sent to the trusted management center as soon as possible. Therefore, the collection of alarm logs is the highest priority. On the engineer station, the alarm log is sent to the trusted management center by long-term link push. On the controller, the alarm is interrupted for high priority processing.

[0030] Audit logs and security logs generally record information about trusted automatic processing of security threats, so the real-time requirements are not high. A regular non-busy push mechanism is adopted, that is, the trusted node makes judgments based on the sending queue cache and CPU load rate.

[0031] Furthermore, for workstations, when the CPU utilization is less than 20% and the network load is less than 20%, the audit log and security log can be sent to the trusted management center.

[0032] Furthermore, for the controller, within a period of 200ms, when the single-core CPU utilization is less than 70% and the network port buffer occupancy is less than 20kbyte, the sending of audit logs and security logs is allowed.

[0033] The overall files of operation logs and business logs are large and of little use in non-abnormal scenarios. Therefore, they have the lowest priority for transmission and rely on manual log collection by operation and maintenance personnel.

[0034] Furthermore, for workstations or servers, the trusted management platform transmits instructions for packaging logs through an encrypted transmission channel with the trusted nodes. The instructions require the operation and maintenance personnel to input the required log file path based on the maintenance document.

[0035] After receiving the command to package the logs, the trusted node packages the log folder under the specified path. The file name is node name + date + the last section of the log path. After the command is executed, the packaged result is sent to the local log of the trusted management platform through an encrypted transmission channel.

[0036] Furthermore, for controller devices, operation and maintenance personnel are required to collect logs on-site by directly connecting to the serial port or replacing the memory card.

[0037] After the trusted management platform completes the collection, it notifies the operation and maintenance personnel to extract the logs.

[0038] In the process of trusted DCS networking, by classifying logs, the impact of log extraction on each trusted node, especially on the controller device, can be minimized. Direct log collection of the controller without evaluation may cause delays, congestion or other abnormal results in the control logic. Effective log extraction can reduce the load of the trusted system and enhance the reliability of the trusted system.

[0039] Specific embodiments are given below to describe the steps of the present invention in detail: Example 1 In this embodiment, if Figure 2 As shown, a trusted DCS log collection method will be described in detail. The implementation of this method requires the following equipment and conditions: Trusted DCS system, including nodes such as engineer stations and controllers.

[0040] Trusted management center, used to receive and store logs. Encrypted transmission channel, used to transmit log packaging instructions and packaged log files. Serial port direct connection device or memory card replacement device, used to collect logs from controller devices.

[0041] Step 1: Log classification and processing. According to the log type of the trusted DCS system, it is divided into five categories: alarm log, audit log, security log, operation log, and business log, and different collection strategies are adopted for each.

[0042] Step 2: High-priority collection of alarm logs. The real-time performance of alarm logs is the highest requirement, so they are sent from the engineer station to the trusted management center through long-term link push, and are processed with high priority on the controller through interrupts.

[0043] Specifically, the transmission interval of the alarm log is 1 second, the transmission channel is a long-term connection, and the transmission protocol is TCP / IP.

[0044] Step 3: Audit logs and security logs are pushed regularly during non-busy hours. A regular non-busy push mechanism is adopted, and the trusted node judges the load rate of the sending queue cache and the CPU. When the CPU utilization rate is less than 20% and the network load is less than 20%, the audit logs and security logs are sent to the trusted management center. Specifically, the transmission interval of the audit log and security log is 10 minutes, the transmission channel is a non-busy connection, and the transmission protocol is TCP / IP.

[0045] Step 4: Manually collect operation logs and business logs as needed. Since operation logs and business logs are large in size and less useful in non-abnormal scenarios, they have the lowest priority for transmission and rely on manual log collection by operation and maintenance personnel. Specifically, operation and maintenance personnel need to manually collect operation logs and business logs from the engineer station or controller device when needed.

[0046] Among them, the encrypted transmission channel transmits the package log instruction. The trusted management platform transmits the package log instruction through the encrypted transmission channel between the trusted node. The instruction needs to be entered by the operation and maintenance personnel, and then the trusted node packages the log folder under the specified path and sends it to the local log of the trusted management platform through the encrypted transmission channel.

[0047] Specifically, the encryption algorithm of the encrypted transmission channel is AES-256, and the transmission protocol is HTTPS. Step 6: Collect logs of the controller device. Due to the particularity of the controller device, the operation and maintenance personnel need to collect logs on-site by directly connecting the serial port or replacing the memory card.

[0048] Specifically, the operation and maintenance personnel need to use a serial port direct connection device or a memory card replacement device to connect to the controller device, and then manually collect logs on the controller device.

[0049] Step 6: Notification of log collection completion. After the trusted management platform completes the collection, it notifies the operation and maintenance personnel to extract the logs, thereby ensuring the security and confidentiality of the logs. Specifically, the trusted management platform will notify the operation and maintenance personnel via email or SMS after the log collection is completed.

[0050] The above are the specific steps of this embodiment. Through these steps, the effective collection and organization of trusted DCS logs can be achieved, the impact on controller devices can be avoided, the reliability and security of the system can be improved, and the security and confidentiality of the log transmission process can be guaranteed.

[0051] As a preferred solution, the present invention also requires real-time monitoring of key performance indicators (such as processing speed, throughput, latency, etc.) of the log processing system to ensure stable operation of the system, which specifically includes the following steps: 1. The monitoring tools and frameworks are as follows: Log collection tools: Flume: As a log collection tool, Flume supports multiple log collection channels and storage locations, and can efficiently collect log data. Logstash or Fluentd: These tools also have powerful log collection capabilities and can be selected based on actual scenarios and needs.

[0052] Message Queues: Kafka: As a commonly used buffer queue in big data processing, Kafka can handle highly concurrent log data to avoid dragging down subsequent processing logic. Log processing and analysis framework: Spark Streaming: Suitable for real-time data processing scenarios, it can be connected with Kafka to process collected logs in real time. Elasticsearch: Used for log storage and provides efficient log retrieval capabilities. Kibana or Grafana: Used for data visualization, converting complex log data into easy-to-understand charts and dashboards.

[0053] 2. The monitoring indicators are set as follows: Processing speed: Monitor the number of logs or data processed by the log processing system per second to ensure that the processing speed meets business needs.

[0054] Throughput: The total amount of logs that the monitoring system can process within a certain period of time (such as per second or per minute) to ensure that the system can still run stably under high load conditions.

[0055] Latency: The time difference from when the monitoring log is generated to when it is processed and displayed on the monitoring interface. Ensure that the latency is within an acceptable range.

[0056] Number of abnormal logs: Monitor and record the number of abnormal logs to detect and handle system abnormalities in a timely manner.

[0057] Resource utilization: Monitor the usage of system resources such as CPU, memory, and disk to prevent resource bottlenecks from affecting system performance.

[0058] 3. The real-time monitoring solution includes the following steps: Log collection and transmission: Use tools such as Flume to collect system logs in real time, and buffer and transmit them through message queues such as Kafka.

[0059] Log processing and analysis: Use tools such as Spark Streaming to process logs in real time, extract key information, and perform preliminary analysis.

[0060] Store the processed log data in Elasticsearch for subsequent retrieval and analysis.

[0061] Data visualization and monitoring: Use tools such as Kibana or Grafana to create dashboards and charts to display statistics and trend analysis of log data in real time.

[0062] Set threshold warnings to automatically trigger warning notifications when key indicators such as processing speed, throughput, and latency exceed normal ranges.

[0063] Alarm mechanism: Set custom alarm rules according to business needs. When specific conditions are met (such as a drop in processing speed, a surge in the number of abnormal logs, etc.), the system automatically sends an alarm notification to relevant personnel.

[0064] Performance optimization and adjustment: Regularly evaluate and optimize the performance of the log processing system, adjust configuration parameters and algorithm logic to improve system performance and stability. According to changes in monitoring data and business needs, flexibly adjust the log level and granularity to avoid information overload and performance loss.

[0065] In summary, by real-time monitoring of the key performance indicators of the log processing system and combining reasonable monitoring tools, frameworks and solutions, we can ensure the stable operation of the system and detect potential problems in a timely manner.

[0066] In order to improve the purpose of dynamic control, the present invention also includes dynamically adjusting the push strategy and intelligent cache management, which are specifically described as follows: 1. Dynamically adjust push strategy 1. The monitoring factors are as follows: System load: Evaluate the current system load by monitoring the system's CPU usage, memory usage, disk I / O and other indicators. Network status: Use network monitoring tools to detect network bandwidth, latency, packet loss rate and other parameters in real time to determine whether the network is congested.

[0067] 2. The strategy is adjusted as follows: When the network is congested: When network congestion is detected, the frequency of log push is automatically reduced to reduce the network bandwidth usage and avoid further aggravation of network congestion.

[0068] When the system load is low: When the system load is low, the amount of log push can be appropriately increased to ensure the timeliness and completeness of the log data.

[0069] Intelligent algorithms: Introduce intelligent algorithms (such as machine learning algorithms) to predict future system load and network conditions, and adjust push strategies in advance based on the prediction results.

[0070] 3. The implementation steps include the following: Data Collection: Collect data on system load and network status in real time.

[0071] Strategy formulation: Develop appropriate push strategies based on the collected data.

[0072] Policy execution: Execute the formulated policies through programming or configuring the log push system.

[0073] Monitoring and feedback: Continuously monitor system load and network status, adjust strategies based on actual conditions, and conduct performance evaluation and optimization.

[0074] 2. Intelligent Cache Management 1. Cache strategy design Log importance assessment: Evaluate the importance of logs based on their level, content, and other factors. For example, error logs and alarm logs are usually more important than ordinary operation logs and business logs. Storage space monitoring: Monitor the available storage space of the system in real time to ensure that the implementation of the cache strategy does not lead to storage space exhaustion.

[0075] 2. Cache strategy implementation Priority caching: Important logs should be kept in the cache even if storage space is limited. This can be achieved by setting different cache levels or priorities.

[0076] Dynamically adjust cache size: Dynamically adjust cache size based on the system's available storage space and log generation speed. When storage space is tight, you can reduce the retention time of old logs in the cache or delete some low-priority logs.

[0077] Deduplication and compression: Deduplication is performed on duplicate logs or logs with similar content to reduce cache space usage. At the same time, a compression algorithm can be used to compress and store logs in the cache.

[0078] 3. The implementation steps are as follows: Establishment of log importance assessment model: Establish a log importance assessment model based on business needs.

[0079] Cache strategy configuration: Configure priority cache, dynamically adjust cache size and other strategies in the log processing system.

[0080] Storage space monitoring and warning: Set storage space usage thresholds. When the threshold is reached, the warning mechanism will be triggered to remind the administrator or automatically perform cache cleanup operations.

[0081] Performance evaluation and optimization: Regularly evaluate the performance of cache management strategies and make optimization adjustments based on the evaluation results.

[0082] The present invention is an effective means to improve the efficiency and stability of the log processing system by dynamically adjusting the push strategy and intelligent cache management. By real-time monitoring of system load and network conditions, and intelligently evaluating the importance of logs and available storage space, the push strategy and cache strategy can be flexibly adjusted to ensure the timeliness and integrity of log data, while optimizing system performance and resource utilization.

[0083] like Figure 3 As shown, the present invention also provides a trusted DCS log collection system, including: The acquisition module is used to obtain the logs of the trusted DCS system in real time. The logs are divided into security logs, audit logs, alarm logs, operation logs, and business logs; The judgment module is used to determine whether the current log is an alarm log; if so, when an alarm occurs due to an abnormality, the alarm log is sent to the trusted management center by long-term link push; if not, determine whether it is an audit log or a security log: if so, a regular non-busy-hour push mechanism is used, and the trusted node judges the sending queue cache and CPU load rate and sends it to the trusted management center; if not, it is an operation log or a business log, and an instruction is issued to wait for the operation and maintenance personnel to manually collect the log.

[0084] The present invention provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the trusted DCS log sorting and collecting method when executing the computer program.

[0085] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the trusted DCS log sorting and collecting method is implemented.

[0086] The present invention can be widely used in the fields of industrial control, network security, operating system, etc. In the field of industrial control, the technical solution can be applied to various industrial control systems, such as distributed control systems (DCS) in the power, chemical, petroleum, natural gas and other industries.

[0087] By classifying and grading the logs, the impact of log extraction on each trusted node, especially on the controller device, can be effectively reduced, thereby improving the reliability and stability of the system. At the same time, through the decentralized log collection method, the performance bottleneck and security risks of centralized log collection are avoided, and the performance and security of the system are further improved. In the field of network security, this technical solution can be used to record and analyze the operating status, operation records and alarm information of network devices and systems in detail. By classifying and grading the logs, different types of logs can be efficiently processed to improve the monitoring and management efficiency of network security. At the same time, through the decentralized log collection method, the performance bottleneck and security risks of centralized log collection are avoided, and network security is further enhanced. In the field of operating systems, this technical solution can be applied to log recording and collection in various operating systems. By classifying and grading the logs, the impact of log extraction on the operating system can be effectively reduced, and the reliability and stability of the system can be improved. At the same time, through the decentralized log collection method, the performance bottleneck and security risks of centralized log collection are avoided, and the performance and security of the operating system are further improved. In general, this technical solution has broad application prospects in industrial control, network security, operating systems and other fields, meeting the market demand for efficient, secure and reliable log recording and collection.

[0088] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0089] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0090] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0091] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0092] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium).

[0093] As is well known to those of ordinary skill in the art, the term computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storing information (such as computer readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

Claims

1. A trusted DCS log collection method, characterized in that: include: Obtain the logs of the trusted DCS system in real time. The logs are divided into security logs, audit logs, alarm logs, operation logs, and business logs. Determine whether the current log is an alarm log; If so, when an abnormality causes an alarm, the alarm log is sent to the trusted management center through long-term link push; If not, determine whether it is an audit log or a security log: If yes, a regular non-busy-hour push mechanism is adopted, and the trusted node judges the load rate of the sending queue cache and CPU and sends it to the trusted management center; If not, it is an operation log or business log, and an instruction to wait for manual log collection by the operation and maintenance personnel is issued.

2. A trusted DCS log collection method according to claim 1, characterized in that: After the alarm log is sent to the trusted management center by long-term link push, the controller uses interruption to perform high-priority processing; The transmission interval of the alarm log is 1 second, the transmission channel is a long-term connection, and the transmission protocol is TCP / IP.

3. A trusted DCS log collection method according to claim 1, characterized in that: In the trusted DCS system, for a workstation, when the CPU utilization is less than 20% and the network load is less than 20%, the audit log and security log can be sent to the trusted management center; For the controller, within a 200ms period, when the single-core CPU utilization is less than 70% and the network port buffer occupancy is less than 20kbyte, the sending of audit logs and security logs is allowed; The transmission interval of audit logs and security logs is 10 minutes, the transmission channel is a non-busy-hour connection, and the transmission protocol is TCP / IP.

4. A trusted DCS log collection method according to claim 1, characterized in that: The workstation or server transmits the instruction of packing logs through the encrypted transmission channel between the trusted node, and the instruction requires the operation and maintenance personnel to input the required log file path according to the maintenance document; After receiving the command to pack logs, the trusted node packs the log folder under the specified path. The file name is node name + date + the last section of the log path. After the command is executed, the packed result is sent to the local log of the trusted management platform through an encrypted transmission channel. The encryption algorithm of the encrypted transmission channel is AES-256, and the transmission protocol is HTTPS.

5. A trusted DCS log collection method according to claim 1, characterized in that: The controller device requires operation and maintenance personnel to collect logs on-site by directly connecting to the serial port or replacing the memory card.

6. A trusted DCS log collection method according to claim 1, characterized in that: It also includes: steps for real-time monitoring of key performance indicators of the trusted DCS system, specifically including: Obtain logs of the trusted DCS system in real time, and buffer and transmit them through the message queue; process and analyze the logs, extract key information and conduct preliminary analysis; the key information includes: processing speed, throughput, latency, number of abnormal logs and resource utilization; Store the processed log data in Elasticsearch; Create dashboards and charts to display statistics and trend analysis of log data in real time; Set threshold warnings to automatically trigger warning notifications when key information exceeds the normal range; Set custom alarm rules according to business needs, and send alarm notifications to operation and maintenance personnel when the processing speed decreases or the number of abnormal logs increases sharply.

7. A trusted DCS log collection method according to claim 1, characterized in that: It also includes the steps of dynamically adjusting the push policy, including: Collect data on system load and network status in real time; Formulate appropriate push strategies based on the collected data; strategies include: automatically reducing the frequency of log push when network congestion is detected; appropriately increasing the amount of log push when the system load is low; predicting future system load and network conditions, and adjusting push strategies in advance based on the prediction results; Enforce the established policies by programming or configuring the log push system; Continuously monitor system load and network status, adjust strategies based on actual conditions, and perform performance evaluation and optimization.

8. A trusted DCS log collection method according to claim 1, characterized in that: It also includes intelligent cache management steps, including: Establish a log importance assessment model based on business needs; assess the importance of logs based on factors such as their level and content; Configure priority caching, dynamic adjustment of cache size, deduplication and compression strategies. Priority caching means that important logs should be kept in the cache even if the storage space is tight. Dynamic adjustment of cache size means dynamically adjusting the cache size according to the available storage space of the system and the log generation speed. When the storage space is tight, reduce the retention time of old logs in the cache or delete some low-priority logs. Deduplication and compression means deduplication of duplicate logs or logs with similar contents. Use compression algorithm to compress and store logs in the cache. Monitor the system's available storage space in real time to ensure that the implementation of cache policies does not lead to storage space exhaustion; set storage space usage thresholds, and trigger an early warning mechanism when the threshold is reached to remind the administrator or automatically perform cache cleanup operations; Regularly evaluate the performance of cache management strategies and make optimization adjustments based on the evaluation results.

9. A trusted DCS log collection system, characterized in that: include: The acquisition module is used to obtain the logs of the trusted DCS system in real time. The logs are divided into security logs, audit logs, alarm logs, operation logs, and business logs; The judgment module is used to determine whether the current log is an alarm log; if so, when an alarm occurs due to an abnormality, the alarm log is sent to the trusted management center by long-term link push; if not, determine whether it is an audit log or a security log: if so, a regular non-busy-hour push mechanism is used, and the trusted node judges the sending queue cache and CPU load rate and sends it to the trusted management center; if not, it is an operation log or a business log, and an instruction is issued to wait for the operation and maintenance personnel to manually collect the log.

10. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the trusted DCS log sorting and collecting method according to any one of claims 1 to 8 is implemented.

Images