Self-learning intelligent asset discovery method and monitoring system for industrial control system

Abstract

The invention discloses a self-learning intelligent asset discovery method for an industrial control system and a monitoring system. The method comprises the following steps: S1, constructing an equipment database, initializing known equipment information of the system, and configuring self-learning intelligent passive and active scanning tools; s2, capturing real-time network traffic, and extracting equipment information through a self-learning intelligent matching and equipment identification method; s3, lightweight scanning is carried out through a dynamic active scanning strategy, equipment response data is acquired, and equipment information is extracted; step S4, the database matches the network traffic and the device information extracted by active scanning, updates known device information, and triggers an alarm for unknown devices; and S5, manually auditing unknown equipment, collecting feedback data, and optimizing self-learning intelligent matching, an equipment identification method and a dynamic active scanning strategy. According to the method, the effectiveness of active scanning can be enhanced, the real-time performance and accuracy of equipment information extraction are improved, and comprehensive discovery and real-time monitoring of industrial control system equipment are ensured.

Description

Technical Field

[0001] The present invention relates to a discovery method and a monitoring system, and in particular to a self-learning intelligent asset discovery method and a monitoring system for an industrial control system. Background Art

[0002] Industrial control systems (ICS) are systems used to monitor and control physical devices in industrial environments and are widely used in manufacturing, energy, transportation, and infrastructure. As ICS become more digital and connected, it is critical to ensure the security and reliability of the system. Comprehensive discovery and real-time monitoring of asset information in the system are important steps to ensure ICS security. However, due to the diversity and complexity of ICS devices, comprehensive discovery and real-time monitoring of these devices face huge challenges.

[0003] Existing asset discovery technologies mainly include passive scanning technology based on network traffic and active scanning technology based on detection packets:

[0004] Passive scanning technology identifies and discovers devices in the network by monitoring network traffic without causing additional load on the network. Passive scanning mainly relies on analyzing captured data packets to extract device feature information, such as IP address, MAC address, device type and model, etc. However, when processing large amounts of real-time complex network data, passive scanning has a high computational overhead, and there are delays in device information extraction and updating, making it difficult to achieve real-time monitoring, resulting in the inability to respond to new devices or device changes in a timely manner.

[0005] Active scanning technology identifies and discovers devices by sending probe requests to devices in the network and analyzing their responses. It can discover devices that are not communicating and obtain more detailed information. However, active scanning will cause a certain load on the network and devices, affecting normal business. Existing active scanning lacks intelligent decision-making capabilities and cannot dynamically adjust scanning frequency and strategy based on real-time network status and device priority, resulting in low efficiency, waste of resources and insufficient scanning effect.

[0006] In summary, among the existing asset discovery technologies, the passive scanning technology based on network traffic has high computational overhead when processing large amounts of real-time complex network data, and there are delays when extracting and updating device information, making it impossible to achieve real-time monitoring and updating of device information; the active scanning technology based on detection packets lacks intelligent decision-making capabilities, and does not fully consider the real-time network conditions and device priorities to dynamically adjust the scanning frequency and strategy, resulting in low scanning efficiency, waste of network resources and insufficient scanning effectiveness. Summary of the invention

[0007] In order to solve the deficiencies of the above technologies, the present invention provides a self-learning intelligent asset discovery method and monitoring system for industrial control systems.

[0008] In order to solve the above technical problems, the technical solution adopted by the present invention is: a self-learning intelligent asset discovery method for an industrial control system, comprising the following steps:

[0009] Step S1, build a device database, initialize the known device information of the system, and configure self-learning intelligent passive and active scanning tools;

[0010] Step S2, capturing real-time network traffic and extracting device information through self-learning intelligent matching and device identification methods;

[0011] Step S3: Perform lightweight scanning through a dynamic active scanning strategy to obtain device response data and extract device information;

[0012] Step S4: The database matches the network traffic and the device information extracted by active scanning, updates the known device information, and triggers an alarm for unknown devices;

[0013] Step S5: Manually review unknown devices, collect feedback data, optimize self-learning intelligent matching, device identification methods and dynamic active scanning strategies, and realize real-time monitoring of internal devices of the industrial control system.

[0014] Through the frequency strategy of active scanning and the effectiveness screening of real-time network traffic, the targeted processing of different types of traffic packets is optimized, and ultimately real-time monitoring of internal equipment of the industrial control system is achieved while minimizing resource overhead and minimizing the impact on the internal industrial control system.

[0015] Preferably, in step S1, all currently known device information is collected and entered, including device type, model, IP address, MAC address, open ports, running services and protocol information, and the device database serves as the initial asset information library of the system.

[0016] Preferably, step S2 specifically includes the following steps:

[0017] S21. Real-time data packet collection: collect data packets in the network in real time, use intelligent matching mechanism (i.e., intelligently optimized regular expressions) to filter out data packets containing device information, and then use multi-level cache mechanism, short, medium and long-term different cache mechanisms to optimize and manage frequent data packets, periodic data packets and low-frequency data packets respectively (i.e., optimize through cache mechanism), and reduce redundant data processing;

[0018] S22, protocol identification and information extraction: perform protocol identification on the screened data packets and determine the network protocol of the data packets; including TCP, UDP, HTTP, Modbus, DNP3 and other network protocols;

[0019] The self-learning regular expression library based on the network protocol matches the header and payload of the data packet to extract the key information of the device. The intelligent matching mechanism identifies the device information according to the specific patterns in the packet size, IP address and payload (regular matching and other features).

[0020] Among them, the header and payload of the data packet are the basic components of network communication, which are used to describe the structure and content of the data packet.

[0021] Preferably, in step S2, short-term caching is used for frequent data packets, and a short-life sliding window is used for the dynamic update strategy. The window size is set to 500ms to 5 seconds. Only the latest frequent data packets are retained each time the cache is updated, and outdated data are discarded. The cache elimination mechanism adopts an LRU (least recently used) strategy.

[0022] A sliding window means that the window "slides" forward over time, always keeping an eye on the data in the current time period.

[0023] When new data packets arrive, the window slides forward, while old data that is outside the window time range is eliminated.

[0024] After each update, only the latest frequent data packets within the window time range are retained, and outdated data are discarded.

[0025] Periodic data packets use medium-term cache, establish time series cache (establish time series linked list to record the device corresponding to the data packet and the arrival time of the data packet), record the arrival time of the periodic data packet to confirm its periodicity; for data packets with unstable periodic characteristics, trigger alarms or mark them as abnormal; use time series analysis algorithms (such as autoregressive analysis) to detect periodic fluctuations and dynamically adjust the cache size; use incremental update mechanism in the cache to store only the latest data and changed content;

[0026] Low-frequency data packets are cached for a long time and managed using persistent storage (such as a file system or database), and the cache content is cleaned up regularly. Index management is performed to establish query indexes based on time, device ID, and data type dimensions to improve data retrieval efficiency.

[0027] Preferably, step S3 specifically includes the following steps:

[0028] S31, Scanning tool configuration: Use the configured scanning tool to initiate lightweight scanning requests, including Ping scanning, TCP Syn port scanning, and service detection;

[0029] S32, response data extraction: collect the device's response data to the scan request, extract the device's IP address, MAC address, open ports, running services and protocol information, and if the device does not respond, record the device information for further follow-up;

[0030] S33. Dynamic scanning adjustment: Based on the scanning results and feedback data (referring to the response data obtained from the scan, the completeness and validity of the response time and the corresponding content information), self-learning optimizes the scanning strategy and frequency.

[0031] Preferably, in step S3, the dynamic active scanning strategy is: let L represent the network load, and L represent the current network bandwidth usage rate, ranging from [0, 1], where 0 represents no load and 1 represents full load;

[0032] F represents the scanning frequency, in times / minute; H represents the device priority, which is calculated based on factors such as the importance of the device, risk level, and historical scanning feedback information, and ranges from [0, 1]. The dynamic adjustment value of the scanning frequency F is F new It is expressed as:

[0033] F new =F base *(ω L *(1-L)+ω H *H),

[0034] Among them, F base is the basic scanning frequency, i.e. the default scanning frequency without load and risk influence; ω L and ω H Respectively represent the weights of network load and device priority, and adjust according to specific needs;

[0035] The calculation formula of device priority H is:

[0036] H=ω I *I+ω R *R+ω P *P,

[0037] Among them, ω I ,ω R ,ω P They represent the weights of the device importance I, the device risk level R, and the device historical scan feedback information P, respectively. I +ω R +ω P=1; the importance of the device I, ranging from [0, 1], close to 0 means not important, close to 1 means very important; the risk level of the device R, ranging from [0, 1], close to 0 means no risk, close to 1 means high risk, obtained from the system security log, is the ratio of the number of alarms of the device to the total number of alarms of similar devices; historical scan feedback information P, ranging from [0, 1], close to 0 means good feedback information, close to 1 means very poor feedback information.

[0038] Preferably, in step S4, database matching is: determining whether the device information extracted through network traffic in step S2 already exists in the device database, and determining whether the device information extracted through active scanning in step S3 already exists in the device database;

[0039] Updating the information of known devices includes updating the newly collected features of the devices, the latest status of existing features, and the online status of the devices;

[0040] Trigger an alarm for unknown devices, record the unknown devices, identification methods, and original identification data.

[0041] Preferably, in step S5, the unknown device is manually reviewed to determine whether it actually exists in the industrial control system;

[0042] Collect relevant data packets of unknown devices, continuously update and optimize the intelligent matching mechanism (i.e., intelligently optimized regular expressions), device identification methods, and dynamic active scanning strategies, so that they can adapt to new devices, new protocols, and changes in the network environment.

[0043] For unknown devices captured by active scanning, analyze the probe data packets and the return data packets they receive, optimize the active scanning strategy, and add new devices to the scanning strategy.

[0044] For unknown devices identified by capturing network data packets, analyze the characteristics of the data packets containing unknown device information and optimize the intelligent filtering regular expressions.

[0045] A monitoring system for a self-learning intelligent asset discovery method for an industrial control system, the monitoring system comprising:

[0046] Equipment database module: used to store asset information and asset status in the industrial control system. This module is the storage and matching center for all asset information;

[0047] Self-learning intelligent passive scanning module: Filters and extracts device information from real-time network traffic through a self-learning mechanism (based on extracted device information and optimized intelligent matching regular expressions);

[0048] Dynamic policy active scanning module: used to use dynamic active scanning strategy to perform lightweight active scanning of assets in the system, and adjust the scanning strategy and frequency according to network conditions and device priority to reduce network load;

[0049] Database matching and alarm module: used to match the extracted device information with the device database, update known device information, and trigger unknown device alarms;

[0050] Manual review and feedback module: used to manually review unknown devices, collect feedback data, optimize self-learning data packet screening, device information extraction methods and dynamic active scanning strategies.

[0051] A computer system, comprising:

[0052] one or more processors;

[0053] A memory stores operable instructions, which, when executed by one or more processors, cause the one or more processors to perform operations, including a process of executing a self-learning intelligent asset discovery method for an industrial control system.

[0054] The present invention establishes a self-learning intelligent asset discovery method suitable for industrial control systems through the organic combination of self-learning intelligent matching, device identification and dynamic active scanning strategies. This method not only optimizes the real-time extraction and update of device information in complex network environments, but also realizes the intelligent integration of active and passive scanning by dynamically adjusting the scanning strategy. In this way, the system can adaptively optimize the asset discovery strategy, thereby improving the comprehensiveness, real-timeness and security of ICS assets while ensuring the efficient use of network resources. The present invention can effectively reduce resource overhead, enhance the effectiveness of active scanning, improve the real-time and accuracy of device information extraction, and ensure comprehensive discovery and real-time monitoring of industrial control system equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 The figure is a flow chart of the method of the present invention.

[0056] Figure 2 It is a system framework diagram of the present invention. DETAILED DESCRIPTION

[0057] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0058] Example

[0059] like Figure 1 A self-learning intelligent asset discovery method for an industrial control system is shown, comprising the following steps:

[0060] S1. Build a device database, initialize the known device information of the system, and configure self-learning intelligent passive and active scanning tools;

[0061] Self-learning intelligent passive tool configuration: Deploy the traffic capture program and the self-learning intelligent passive device identification program on the core nodes of the industrial control system to identify the system device information contained in the data packet. The active scanning tool is a detection packet construction and analysis program based on the dynamic active scanning strategy.

[0062] Build a device database, initialize the known device information of the system, collect and enter all currently known device information, including device type, model, IP address, MAC address, open ports, running services and protocols, etc. The device database serves as the initial asset information base of the system.

[0063] S2. Capture real-time network traffic and extract device information through self-learning intelligent matching (intelligently optimized regular expressions) and device identification methods; specifically, it includes:

[0064] Among them, based on regular expressions, the device-related information contained in the data packet, such as IP, MAC, etc., is extracted. Different regular expressions have different extraction efficiencies. The data packets of the industrial control system have their own business characteristics, mainly based on industrial network protocols.

[0065] 1. Real-time data packet collection (deploy suricata packet capture program on the gateway device to capture real-time data packets in the system): collect data packets in the network in real time, and use the intelligent matching mechanism (matching mechanism based on regular expressions) to filter out data packets containing device information. Then, through a multi-level cache mechanism, use short, medium and long-term different cache mechanisms (the cache mechanism belongs to the existing technology. Here, corresponding cache strategies are designed for different types of data packets to quickly process real-time data packets in the system and save computing and storage resources), respectively manage frequent data packets, periodic data packets and low-frequency data packets accordingly to reduce redundant data processing;

[0066] 2. Protocol identification and information extraction: Perform protocol identification on the filtered data packets (identify by different protocols having their own characteristics in the data packets) and determine the network protocol of the data packet (such as TCP, UDP, HTTP, Modbus, DNP3, etc.). The self-learning regular expression library based on the network protocol (the library is composed of multiple regular expressions, and the corresponding intelligent expressions are added, deleted, and modified according to the needs of system device identification) matches the header and payload of the data packet and extracts the key information of the device (key information includes IP address, MAC address and port number Port; key information is extracted through message parsing). The intelligent matching mechanism identifies device information based on the size of the data packet, IP address, and specific patterns in the payload (features such as regular matching).

[0067] Table 1: Packet type table

[0068]

[0069] Frequent data packets are cached in a short term, and the dynamic update strategy uses a short-life sliding window with a window size of 500ms to 5 seconds. Each time the cache is updated, only the latest frequent data packets are retained and outdated data are discarded. The cache elimination mechanism uses the LRU (least recently used) strategy.

[0070] Sliding window means that the window "slides" forward over time, always keeping an eye on the data in the current time period.

[0071] When new data packets arrive, the window slides forward, while old data that is outside the window time range is eliminated.

[0072] After each update, only the latest frequent data packets within the window time range are retained, and outdated data are discarded.

[0073] Periodic data packets use medium-term cache, establish time series cache (establish time series linked list to record the device corresponding to the data packet and the arrival time of the data packet), and record the arrival time of the periodic data packet to confirm its periodicity. For data packets with unstable periodic characteristics, trigger alarms or mark them as abnormal. Use time series analysis algorithms (such as autoregressive analysis) to detect periodic fluctuations and dynamically adjust the cache size; for periodic data packets, use incremental update mechanism in the cache to store only the latest data and changed content.

[0074] Low-frequency data packets are cached for a long time and managed using persistent storage (such as a file system or database), and the cache content is cleaned up regularly. Index management is performed to establish efficient query indexes based on dimensions such as time, device ID, and data type to improve data retrieval efficiency.

[0075] S3. Perform lightweight scanning through dynamic active scanning strategy (i.e., only detect specific protocols of industrial control systems (such as Modbus, DNP3, etc.); prioritize scanning open common ports (such as 80, 443, 502, etc.) and skip irrelevant ports; determine whether the target is online by sending lightweight handshake packets (SYN or PING) without completing a complete connection), obtain device response data, and extract device information; specifically include the following steps:

[0076] 1. Scanning tool configuration: Use the configured scanning tool to initiate lightweight scanning requests, mainly including Ping scanning, TCP Syn port scanning, service detection, etc.

[0077] 2. Response data extraction: Collect the device's response data to the scan request, and extract the device's IP address, MAC address, open ports, running services and protocols, etc. If the device does not respond, record the device information for further follow-up;

[0078] 3. Dynamic scanning adjustment: Based on the scanning results and feedback data (referring to the response data obtained from the scan, the completeness and validity of the response time and the corresponding content information), self-learning optimizes the scanning strategy and frequency.

[0079] Specifically, the dynamic active scanning strategy, let L represent the network load, which represents the current network bandwidth usage rate, ranging from [0, 1], where 0 represents no load and 1 represents full load; F represents the scanning frequency, in times / minute; H represents the device priority, which is calculated based on factors such as the importance of the device, risk level, and historical scanning feedback information, ranging from [0, 1]. The dynamic adjustment value F of the scanning frequency F new It is expressed as:

[0080] F new =F base *(ω L *(1-L)+ω H *H),

[0081] Among them, F base is the basic scanning frequency, i.e. the default scanning frequency without load and risk influence; ω L and ω H They represent the weights of network load and device priority respectively and are adjusted according to specific needs.

[0082] The calculation formula of device priority H is:

[0083] H=ω I *I+ω R *R+ω P *P,

[0084] Among them, ω I ,ω R ,ω P They represent the weights of the device importance I, the device risk level R, and the device historical scan feedback information P, respectively. I +ω R +ω P=1; the importance of the device I, ranging from [0, 1], close to 0 means not important, close to 1 means very important; the risk level of the device R, ranging from [0, 1], close to 0 means no risk, close to 1 means high risk, obtained from the system security log, is the ratio of the number of alarms of the device to the total number of alarms of similar devices; historical scan feedback information P, ranging from [0, 1], close to 0 means good feedback information, close to 1 means very poor feedback information.

[0085] S4, the database matches network traffic and device information extracted by active scanning, updates known device information, and triggers alarms for unknown devices;

[0086] Database matching, determining whether the device information extracted through network traffic in step S2 already exists in the device database, and determining whether the device information extracted through active scanning in step S3 already exists in the device database;

[0087] Updating the information of known devices includes updating the newly collected features of the devices, the latest status of existing features, and the online status of the devices.

[0088] Trigger an alarm for unknown devices, record the unknown devices, identification methods, and original identification data.

[0089] S5. Manually review unknown devices, collect feedback data, optimize (active scanning frequency strategy and real-time network traffic effectiveness screening, targeted processing of different types of traffic packets), self-learning intelligent matching, device identification methods and dynamic active scanning strategies. Realize real-time monitoring of internal equipment in the industrial control system while minimizing resource overhead and minimizing the impact on the internal industrial control system.

[0090] Manually review unknown devices and conduct manual inspections on unknown devices to determine whether they actually exist in the industrial control system; collect and discover relevant data packets of unknown devices, continuously update and optimize regular intelligent matching mechanisms, device identification methods, and dynamic active scanning strategies to enable them to adapt to new devices, new protocols, and changes in network environments.

[0091] Related data packets refer to: for unknown devices captured by active scanning, analyzing the detection data packets and the return data packets received, optimizing the active scanning strategy, and adding new devices to the scanning strategy;

[0092] For unknown devices identified by capturing network data packets, analyze the characteristics of the data packets containing unknown device information and optimize the intelligent filtering regular expressions.

[0093] like Figure 2A monitoring system for a self-learning intelligent asset discovery method for an industrial control system is shown, comprising a device database module, a self-learning intelligent passive scanning module, a dynamic strategy active scanning module, a database matching and alarm module, and a manual review and feedback module;

[0094] Equipment database module: used to store asset information and asset status in the industrial control system. This module is the storage and matching center for all asset information;

[0095] Self-learning intelligent passive scanning module: Through the self-learning mechanism (based on the extracted device information, optimizing the intelligent matching regular expression), it can filter and extract device information from real-time network traffic. This module has the functions of data packet filtering and efficient extraction of device information;

[0096] Dynamic policy active scanning module: used to use dynamic active scanning strategy to perform lightweight active scanning of assets in the system, and adjust the scanning strategy and frequency according to network conditions and device priority to reduce network load;

[0097] Database matching and alarm module: used to match the extracted device information with the device database, update known device information, and trigger unknown device alarms;

[0098] Manual review and feedback module: used to manually review unknown devices, collect feedback data, optimize self-learning data packet screening, device information extraction methods and dynamic active scanning strategies.

[0099] A computer system, comprising:

[0100] one or more processors;

[0101] A memory stores operable instructions, which, when executed by one or more processors, cause the one or more processors to perform operations, including a process of executing a self-learning intelligent asset discovery method for an industrial control system.

[0102] Compared with the prior art, the present invention has the following beneficial effects:

[0103] 1) Self-learning intelligent matching and device identification:

[0104] Intelligent data packet screening: Useful data packets containing device information can be quickly screened through intelligent matching mechanism, thus reducing unnecessary data processing and improving data packet screening efficiency;

[0105] Multi-level cache mechanism: Utilize short, medium and long-term cache mechanisms to optimize the processing of different types of data packets, avoid repeated processing of the same data packet features, reduce computing overhead, and improve data processing efficiency;

[0106] Efficient device information extraction: Based on the self-learning device identification method, device information is extracted efficiently and accurately from the data packet, and the device database is updated in real time to achieve dynamic monitoring of the device status and ensure the real-time and accuracy of information extraction.

[0107] 2) Dynamically adjusted active scanning strategy:

[0108] Network load perception: Dynamically adjust the frequency of active scanning tasks according to the real-time network load to ensure that the scanning frequency is reduced when the network load is high to avoid affecting normal business;

[0109] Device priority management: Dynamically adjust the scanning priority according to the importance and risk level of the device, and give priority to scanning high-risk devices or devices that have not been scanned for a long time to improve the effectiveness and security of scanning. Self-learning optimization: By continuously collecting scanning results and feedback data, the system can self-learn and optimize the scanning strategy, so that it can be continuously adjusted with changes in the network environment and device status, improving the adaptability and intelligence level of the system.

[0110] 3) Comprehensive analysis of data from passive and active scanning:

[0111] Multi-source data fusion: Match and analyze network traffic data captured by passive scanning with device response data obtained by active scanning, update the device database, and form a complete device information view. Through this multi-source data fusion, device information can be obtained more comprehensively and accurately.

[0112] Intelligent alarm mechanism: During the data matching process, the system triggers an alarm for unknown devices that are not recorded in the database, ensuring that the system can respond promptly when new or abnormal devices appear, enhancing the security and reliability of the industrial control system.

[0113] The above implementation modes are not limitations of the present invention, and the present invention is not limited to the above examples. Changes, modifications, additions or substitutions made by technicians in this technical field within the scope of the technical solution of the present invention also belong to the protection scope of the present invention.

Claims

1. A self-learning intelligent asset discovery method for industrial control systems, characterized in that: The following steps are involved: Step S1, build a device database, initialize the known device information of the system, and configure self-learning intelligent passive and active scanning tools; Step S2, capturing real-time network traffic and extracting device information through self-learning intelligent matching and device identification methods; Step S3: Perform lightweight scanning through a dynamic active scanning strategy to obtain device response data and extract device information; Step S4: The database matches the network traffic and the device information extracted by active scanning, updates the known device information, and triggers an alarm for unknown devices; Step S5: Manually review unknown devices, collect feedback data, optimize self-learning intelligent matching, device identification methods and dynamic active scanning strategies, and realize real-time monitoring of internal devices of the industrial control system.

2. The self-learning intelligent asset discovery method for industrial control systems according to claim 1, characterized in that: In step S1, all currently known device information is collected and entered, including device type, model, IP address, MAC address, open ports, running services and protocol information, and the device database serves as the initial asset information library of the system.

3. The self-learning intelligent asset discovery method for industrial control systems according to claim 1, characterized in that: The step S2 specifically includes the following steps: S21. Real-time data packet collection: collect data packets in the network in real time, use the intelligent matching mechanism to filter out data packets containing device information, and then use the multi-level cache mechanism to use short, medium and long-term different cache mechanisms to optimize the management of frequent data packets, periodic data packets and low-frequency data packets respectively, reducing redundant data processing; S22, protocol identification and information extraction: perform protocol identification on the screened data packets to determine the network protocol of the data packets; The self-learning regular expression library based on the network protocol matches the header and payload of the data packet to extract the key information of the device. The intelligent matching mechanism identifies the device information according to the specific patterns in the packet size, IP address and payload.

4. The self-learning intelligent asset discovery method for industrial control systems according to claim 3, characterized in that: In step S2, short-term caching is used for frequent data packets, and a short-life sliding window is used for the dynamic update strategy. The window size is set to 500ms to 5 seconds. Only the latest frequent data packets are retained each time the cache is updated, and outdated data are discarded. The cache elimination mechanism adopts the LRU strategy; Periodic data packets use medium-term caching, establish time series caching, and record the arrival time of periodic data packets to confirm their periodicity; for data packets with unstable periodic characteristics, trigger alarms or mark them as abnormal; Use time series analysis algorithms to detect periodic fluctuations and dynamically adjust cache size; use incremental update mechanisms in the cache to store only the latest data and changed content; Low-frequency data packets are cached for a long time, managed using persistent storage, and cache contents are cleaned up regularly; Perform index management and establish query indexes based on time, device ID, and data type dimensions to improve data retrieval efficiency.

5. The self-learning intelligent asset discovery method for industrial control systems according to claim 1, characterized in that: The step S3 specifically comprises the following steps: S31, Scanning tool configuration: Use the configured scanning tool to initiate lightweight scanning requests, including Ping scanning, TCPSyn port scanning, and service detection; S32, response data extraction: collect the device's response data to the scan request, extract the device's IP address, MAC address, open ports, running services and protocol information, and if the device does not respond, record the device information for further follow-up; S33, Dynamic scanning adjustment: Based on the scanning results and feedback data, self-learning optimizes the scanning strategy and frequency.

6. The self-learning intelligent asset discovery method for industrial control systems according to claim 5, characterized in that: In step S3, the dynamic active scanning strategy is: let L represent the network load, and L represent the current network bandwidth usage rate, ranging from [0, 1], where 0 represents no load and 1 represents full load; F represents the scanning frequency, the unit is times / minute; H represents the device priority, the range is [0, 1], the dynamic adjustment value of the scanning frequency F new It is expressed as: F new =F base *(oh L *(1-L)+ω H *H), Among them, F base is the basic scanning frequency, i.e. the default scanning frequency without load and risk influence; ω L and ω H Represent the weights of network load and device priority respectively; The calculation formula of device priority H is: H=ω I *I+ω R *R+ω P *P, Among them, ω I ,ω R ,ω P They represent the weights of the device importance I, the device risk level R, and the device historical scan feedback information P, respectively. I +ω R +ω P =1; the importance of the device I, ranging from [0, 1], close to 0 means not important, close to 1 means very important; the risk level of the device R, ranging from [0, 1], close to 0 means no risk, close to 1 means high risk, obtained from the system security log, is the ratio of the number of alarms of the device to the total number of alarms of similar devices; historical scan feedback information P, ranging from [0, 1], close to 0 means good feedback information, close to 1 means very poor feedback information.

7. The self-learning intelligent asset discovery method for industrial control systems according to claim 1, characterized in that: In step S4, database matching is: determining whether the device information extracted through network traffic in step S2 already exists in the device database, and determining whether the device information extracted through active scanning in step S3 already exists in the device database; Updating the information of known devices includes updating the newly collected features of the devices, the latest status of existing features, and the online status of the devices; Trigger an alarm for unknown devices, record the unknown devices, identification methods, and original identification data.

8. The self-learning intelligent asset discovery method for industrial control systems according to claim 1, characterized in that: In step S5, the unknown device is manually reviewed to determine whether it actually exists in the industrial control system; Collect relevant data packets of unknown devices, continuously update and optimize intelligent matching mechanisms, device identification methods and dynamic active scanning strategies, so that they can adapt to new devices, new protocols and changes in network environment.

9. A monitoring system for a self-learning intelligent asset discovery method for an industrial control system according to any one of claims 1 to 8, characterized in that: The monitoring system includes: Equipment database module: used to store asset information and asset status in the industrial control system. This module is the storage and matching center for all asset information; Self-learning intelligent passive scanning module: Filters and extracts device information from real-time network traffic through a self-learning mechanism; Dynamic policy active scanning module: used to use dynamic active scanning strategy to perform lightweight active scanning of assets in the system, and adjust the scanning strategy and frequency according to network conditions and device priority to reduce network load; Database matching and alarm module: used to match the extracted device information with the device database, update known device information, and trigger unknown device alarms; Manual review and feedback module: used to manually review unknown devices, collect feedback data, optimize self-learning data packet screening, device information extraction methods and dynamic active scanning strategies.

10. A computer system, characterized in that: include: one or more processors; A memory storing operable instructions, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform operations, wherein the operations include executing the process of the self-learning intelligent asset discovery method for an industrial control system as described in any one of claims 1-8.

Images