Industrial control asset identification method and device based on communication relationship, and storage medium

Abstract

The invention provides an industrial control asset identification method and device based on a communication relationship and a storage medium, and relates to the technical field of industrial control, and the method comprises the steps: constructing an industrial control asset fingerprint database; capturing message data in the industrial control network; cleaning the message data to obtain industrial control session data; training a behavior pattern recognition model, wherein the model is used for predicting asset detection message sequences under different industrial control protocols; according to the industrial control session data, using an unsupervised learning algorithm to predict a multi-network card condition of the PLC device; according to a preset active detection strategy, detecting the online equipment in a multi-stage detection mode; based on the detection message sequence predicted by the behavior pattern recognition model, sending an asset detection message sequence to the detected online equipment and receiving a response packet; and analyzing the response packet, and obtaining asset detail data in combination with the asset fingerprint database. The method can automatically adapt to different protocols and scenes, efficiently process the condition of multiple network cards, reduce manual intervention, and improve the success rate and efficiency of asset detection.

Description

Technical Field

[0001] The present invention relates to the field of industrial control technology, and in particular to a method, device and storage medium for industrial control asset identification based on communication relationships. Background Art

[0002] In large-scale industrial control networks (ICS), asset detection is a key link to ensure network security, optimize resource allocation, and achieve efficient operation and maintenance. With the rapid development of Internet of Things (IoT) technology, modern industrial control networks have gradually evolved into a highly integrated, complex and changeable system, covering many components from sensors and actuators to large industrial equipment, PLC (programmable logic controller), SCADA (supervisory control and data acquisition) systems, etc. In this context, how to accurately and efficiently detect and identify assets in industrial control networks has become a technical problem that needs to be solved urgently.

[0003] At present, there are some technical solutions in the field of industrial control asset detection. For example, the Chinese patent application with publication number CN116318936A - a networked industrial control asset identification method based on an improved decision tree, which identifies the device type by training to obtain the detection fingerprint features of industrial control equipment. There is also a Chinese patent application with publication number CN116996355A - a neural network-based industrial control network asset discovery method, which sets a threshold for message training and combines artificial marking features to identify assets. However, these existing technical solutions still have the following technical problems:

[0004] First, traditional asset detection methods usually use fixed detection messages or strategies, which are difficult to adapt to dynamically changing network environments. Since different protocols require different message sequences to achieve asset detection in different scenarios, fixed detection methods often lead to low detection success rates. This limitation is particularly evident in complex industrial control network environments.

[0005] Second, in actual industrial control networks, PLC devices usually have multiple network cards, which brings new challenges to asset detection. Traditional detection methods require technicians to manually check the connection status of all network cards, which is not only a huge workload, but also prone to omissions or errors. For example, different network cards of the same PLC device may be used to connect to different host computers, or there may be primary and backup network cards, all of which increase the complexity of asset identification and management. In addition, due to the various information structures generated during asset detection, managing this information in a conventional way will seriously affect system performance. Summary of the invention

[0006] The purpose of the present invention is to provide an industrial control asset identification method, device and storage medium based on communication relationships, which can automatically adapt to different protocols and scenarios, efficiently handle multiple network card situations, and reduce manual intervention to improve the success rate and efficiency of asset detection.

[0007] To achieve the above object, the present invention is implemented through the following technical solutions:

[0008] A method for identifying industrial control assets based on communication relationships comprises the following steps:

[0009] S1: Build an industrial control asset fingerprint library, which contains industrial control equipment models, equipment series, equipment types and their corresponding parameter codes;

[0010] S2: Capture message data in the industrial control network;

[0011] S3: Clean the message data to remove irrelevant information and obtain industrial control session data;

[0012] S4: training a behavior pattern recognition model, wherein the behavior pattern recognition model is used to predict asset detection message sequences under different industrial control protocols;

[0013] S5: predicting the multi-network card situation of the PLC device using an unsupervised learning algorithm according to the industrial control session data;

[0014] S6: According to the preset active detection strategy, a multi-level detection method is used to detect online devices;

[0015] S7: Based on the detection message sequence predicted by the behavior pattern recognition model, send an asset detection message sequence to the detected online device and receive a response packet;

[0016] S8: Parse the response packet and obtain asset detail data in combination with the asset fingerprint library.

[0017] Further: the step S4 comprises:

[0018] S41: performing feature vector conversion on the industrial control session data to obtain a session feature vector sequence;

[0019] S42: constructing a multi-task behavior pattern recognition model, wherein the multi-task behavior pattern recognition model includes a session filtering task and a message filtering task;

[0020] S43: Training the multi-task behavior pattern recognition model based on the session feature vector sequence to obtain asset detection sequences of different industrial control protocols.

[0021] Further: the step S41 includes: converting the timestamp, port number, protocol type and industrial control feature code of each message in the session into a feature vector; the industrial control feature code includes a function code and an industrial control message string; the message string is grouped according to a preset number of bytes.

[0022] Furthermore: the session filtering task is used to filter sessions that do not contain asset detection function codes; the message filtering task is used to filter messages whose occurrence probability in the session is lower than a preset threshold.

[0023] Further: the step S5 comprises:

[0024] S51: extracting the destination port, average communication duration, communication frequency and average data packet size from the industrial control session data;

[0025] S52: normalizing the extracted data, calculating the distance between conversation groups, and obtaining a first clustering result;

[0026] S53: extracting IP and MAC information from the industrial control session data, performing density clustering with MAC as a parameter, and obtaining a second clustering result;

[0027] S54: Determine a correspondence relationship between multiple network cards of the same PLC device based on the first clustering result and the second clustering result.

[0028] Furthermore: a red-black tree structure is used to manage asset information, wherein the red-black tree uses MAC as a key value and IP as a substructure key value.

[0029] Furthermore: the substructure of the red-black tree includes: operating system, network card information, network card manufacturer, slot number, device model, firmware version, log information, error information, memory usage, CPU usage, transmission speed, network card model, timer, submodule list and device code.

[0030] The present invention also provides an industrial control asset identification device based on communication relationship, which performs the steps of any of the above methods, including:

[0031] Asset fingerprint library construction module, message collection module, data cleaning module, behavior pattern recognition module, multi-network card recognition module, active detection module, message sending module and data analysis module.

[0032] The present invention also provides a computer-readable storage medium storing a computer program, wherein the program implements the steps of any of the above methods when executed by a processor.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] 1. The present invention can accurately identify the message sequence that successfully reads PLC asset data under different industrial control protocols by converting the feature vector of industrial control session data and constructing a multi-task behavior pattern recognition model including session filtering tasks and message filtering tasks. The model does not need to use fixed detection messages, but automatically generates detection message sequences based on actual communication characteristics, thereby effectively solving the problem that traditional detection methods are difficult to adapt to dynamic network environments and improving the success rate of asset detection.

[0035] Second, the present invention adopts a two-stage clustering method to identify the multi-network card situation of PLC equipment. By performing the first clustering of communication features (such as destination port, communication duration, etc.) and the second clustering of IP and MAC information, it is possible to determine from multiple dimensions whether the network card belongs to the same PLC device. This method significantly reduces the workload of technicians to manually check the connection status of the network card, and effectively avoids omissions and errors in the manual verification process.

[0036] 3. The industrial control asset identification method provided by the present invention can adapt to the asset detection needs under different protocols and scenarios, and at the same time realizes the intelligent identification of PLC multi-network card situations, effectively improving the accuracy and efficiency of industrial control asset detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 The present invention is a flowchart of the steps of a method for identifying industrial control assets based on communication relationships in an embodiment. DETAILED DESCRIPTION

[0038] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0040] like Figure 1 As shown: A method for identifying industrial control assets based on communication relationships, comprising the following steps:

[0041] S1: Build an industrial control asset fingerprint library, which contains industrial control equipment models, equipment series, equipment types and their corresponding parameter codes; among which, the industrial control equipment models must include all models, sub-modules and CPUs, etc.

[0042] S2: Capture message data in the industrial control network;

[0043] Specifically, when acquiring message data, the present invention first configures the learning time and the industrial control protocol communication flow threshold. Within the preset learning time, the system continuously captures the message data in the industrial control network.

[0044] S3: Clean the message data to remove irrelevant information and obtain industrial control session data;

[0045] S4: training a behavior pattern recognition model, wherein the behavior pattern recognition model is used to predict asset detection message sequences under different industrial control protocols;

[0046] In some embodiments, step S4 includes:

[0047] S41: performing feature vector conversion on the industrial control session data to obtain a session feature vector sequence;

[0048] S42: constructing a multi-task behavior pattern recognition model, wherein the multi-task behavior pattern recognition model includes a session filtering task and a message filtering task;

[0049] S43: Training the multi-task behavior pattern recognition model based on the session feature vector sequence to obtain asset detection sequences of different industrial control protocols.

[0050] Wherein, the step S41 includes: converting the timestamp, port number, protocol type and industrial control feature code of each message in the session into a feature vector; the industrial control feature code includes a function code and an industrial control message string; the message string is grouped according to a preset number of bytes;

[0051] Specifically, the timestamp is converted to the number of milliseconds since the start of learning; the protocol type is converted using one-hot encoding, such as TCP and UDP are represented by 0 and 1 respectively, S7COMM is 0, MODBUS is 1, etc.; the industrial control feature code includes the function code and the industrial control message string, and the message string is grouped according to the preset number of bytes (such as 512 bytes), with each 4 bytes as a group, and a total of 128 groups.

[0052] Take a specific message as an example. Assuming the message content is "00010203040506", the first group (X1) is 66051 (the decimal value of 00010203), and the second group (X2) is 67438080 (the decimal value of 04050600). For each group of data, its change characteristics (Y value) need to be recorded: 0x00 means no change, 0x01 means the first byte changes but there is no sequence structure, and 0x11 means the first byte changes and there is a sequence structure. The converted feature vector is normalized so that each element falls within the interval [0,1].

[0053] In step S42, the session filtering task is used to filter sessions that do not contain asset detection function codes; the message filtering task is used to filter messages whose probability of appearing in the session is lower than a preset threshold. During the model training process, difference value processing is performed to identify the change pattern in the message sequence. For example, when it is found that two sequences only have sequential changes in certain bytes, the model will extract this change pattern for subsequent detection message generation.

[0054] S5: predicting the multi-network card situation of the PLC device using an unsupervised learning algorithm according to the industrial control session data;

[0055] In some embodiments, step S5 includes:

[0056] S51: extracting the destination port, average communication duration, communication frequency and average data packet size from the industrial control session data;

[0057] S52: normalizing the extracted data, calculating the distance between conversation groups, and obtaining a first clustering result;

[0058] S53: extracting IP and MAC information from the industrial control session data, performing density clustering with MAC as a parameter, and obtaining a second clustering result; wherein the second clustering uses a DBSCAN algorithm for density clustering;

[0059] S54: Determine a correspondence relationship between multiple network cards of the same PLC device based on the first clustering result and the second clustering result.

[0060] S6: According to the preset active detection strategy, a multi-level detection method is used to detect online devices;

[0061] S7: Based on the detection message sequence predicted by the behavior pattern recognition model, send an asset detection message sequence to the detected online device and receive a response packet;

[0062] S8: Parse the response packet and obtain asset detail data in combination with the asset fingerprint library.

[0063] In one embodiment, the present invention uses a red-black tree structure to manage asset information, wherein the red-black tree uses MAC as a key value and IP as a substructure key value. The substructure of the red-black tree includes: operating system, network card information, network card manufacturer, slot number, device model, firmware version, log information, error information, memory usage, CPU usage, transmission speed, network card model, timer, submodule list and device code.

[0064] In the active detection phase, the system first uses ICMP and TCP multiple flags (SYN, ACK, FIN) to detect activity. If the device cannot be detected online, it continues to use SNMP and ARP to detect activity. If the online device is still not detected, the common industrial control port is used for TCP and UDP detection. After detecting that the device is online, the system will send an asset detection message sequence based on the detection sequence generated by the behavior pattern recognition model, parse the received response packet, and obtain detailed information about the device in combination with the asset fingerprint library.

[0065] The present invention also provides an industrial control asset identification device based on communication relationship, which performs the steps of any of the above methods, including:

[0066] Asset fingerprint library construction module, message collection module, data cleaning module, behavior pattern recognition module, multi-network card recognition module, active detection module, message sending module and data analysis module.

[0067] The present invention also provides a computer-readable storage medium storing a computer program, wherein the program implements the steps of any of the above methods when executed by a processor.

[0068] The above embodiments are only for illustrating the technical concept and features of the present invention, and their purpose is to enable people familiar with the technology to understand the content of the present invention and implement it accordingly, and they cannot be used to limit the protection scope of the present invention. Any equivalent transformation or modification made according to the spirit of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying industrial control assets based on communication relationships, characterized in that: The following steps are involved: S1: Build an industrial control asset fingerprint library, which contains industrial control equipment models, equipment series, equipment types and their corresponding parameter codes; S2: Capture message data in the industrial control network; S3: Clean the message data to remove irrelevant information and obtain industrial control session data; S4: training a behavior pattern recognition model, wherein the behavior pattern recognition model is used to predict asset detection message sequences under different industrial control protocols; S5: predicting the multi-network card situation of the PLC device using an unsupervised learning algorithm according to the industrial control session data; S6: According to the preset active detection strategy, a multi-level detection method is used to detect online devices; S7: Based on the detection message sequence predicted by the behavior pattern recognition model, send an asset detection message sequence to the detected online device and receive a response packet; S8: Parse the response packet and obtain asset detail data in combination with the asset fingerprint library.

2. The method for identifying industrial control assets based on communication relationships according to claim 1, characterized in that: The step S4 comprises: S41: performing feature vector conversion on the industrial control session data to obtain a session feature vector sequence; S42: constructing a multi-task behavior pattern recognition model, wherein the multi-task behavior pattern recognition model includes a session filtering task and a message filtering task; S43: Training the multi-task behavior pattern recognition model based on the session feature vector sequence to obtain asset detection sequences of different industrial control protocols.

3. The method for identifying industrial control assets based on communication relationships according to claim 2, characterized in that: The step S41 includes: converting the timestamp, port number, protocol type and industrial control feature code of each message in the session into a feature vector; the industrial control feature code includes a function code and an industrial control message string; and the message string is grouped according to a preset number of bytes.

4. The method for identifying industrial control assets based on communication relationships according to claim 2, characterized in that: The session filtering task is used to filter sessions that do not contain asset detection function codes; the message filtering task is used to filter messages whose occurrence probability in the session is lower than a preset threshold.

5. The method for identifying industrial control assets based on communication relationships according to claim 1, characterized in that: The step S5 comprises: S51: extracting the destination port, average communication duration, communication frequency and average data packet size from the industrial control session data; S52: normalizing the extracted data, calculating the distance between conversation groups, and obtaining a first clustering result; S53: extracting IP and MAC information from the industrial control session data, performing density clustering with MAC as a parameter, and obtaining a second clustering result; S54: Determine a correspondence relationship between multiple network cards of the same PLC device based on the first clustering result and the second clustering result.

6. The method for identifying industrial control assets based on communication relationships according to claim 1, characterized in that: A red-black tree structure is used to manage asset information, wherein the red-black tree uses MAC as a key value and IP as a substructure key value.

7. The method for identifying industrial control assets based on communication relationships according to claim 6, characterized in that: The substructure of the red-black tree includes: operating system, network card information, network card manufacturer, slot number, device model, firmware version, log information, error information, memory usage, CPU usage, transmission speed, network card model, timer, submodule list and device code.

8. An industrial control asset identification device based on communication relationship, characterized in that: The steps of performing the method according to any one of claims 1 to 7 include: Asset fingerprint library construction module, message collection module, data cleaning module, behavior pattern recognition module, multi-network card recognition module, active detection module, message sending module and data analysis module.

9. A computer-readable storage medium, characterized in that: A computer program is stored, and when the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images