Security protection method and device for industrial network, medium and equipment

Abstract

The invention provides a security protection method and device for an industrial network, a medium and equipment. The method comprises the following steps: acquiring session data initiated by equipment in an industrial network; if the session data is first session data, extracting feature information of the first session data based on a communication protocol type of the first session data; the first session data is session data generated based on an industrial communication protocol; and matching the feature information of the first session data with a pre-constructed white list, and if the feature information of the first session data exists in the white list, allowing the first session data to enter an industrial network. According to the method and the device, feature extraction is performed on the session data based on the communication protocol type, white list matching is performed according to the extracted feature information of the session data, and the session data initiated by the device is allowed to enter the industrial network after successful matching with the white list, so that the security of the industrial network is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a security protection method, device, medium and equipment for an industrial network. Background Art

[0002] Industrial control systems are widely used in industrial production. The working process of industrial control systems will generate industrial session data. In order to ensure the safety and stability of production, it is necessary to detect the industrial session data to determine whether the industrial session data is normal data or abnormal data.

[0003] In the related art, port-level access control strategies are usually used to protect data traffic in industrial networks. However, when protecting data traffic based on ports, it is impossible to accurately track and detect dynamic port protocol messages, resulting in poor accuracy in determining whether industrial session data is normal data or abnormal data, which in turn allows abnormal session data that may pose a security risk to the industrial control system to enter the industrial control system, affecting the security of the industrial control system. Summary of the invention

[0004] In view of this, the present disclosure provides a security protection method, device, medium and equipment for an industrial network, which can improve the security of the industrial control network.

[0005] According to a first aspect of an embodiment of the present disclosure, a method for protecting an industrial network is provided, the method comprising:

[0006] Get session data initiated by devices in industrial networks;

[0007] If the session data is first session data, extracting characteristic information of the first session data based on the communication protocol type of the first session data; the first session data is session data generated based on an industrial communication protocol;

[0008] The characteristic information of the first session data is matched with a pre-built white list, and if the characteristic information of the first session data exists in the white list, the first session data is allowed to enter the industrial network.

[0009] In one embodiment, the method further comprises:

[0010] If the session data is second session data, matching is performed based on the IP address information of the second session data and the preset network segment; the second session data is session data generated based on a universal communication protocol;

[0011] If the IP address information of the second session data is not in the preset network segment, the second session data is intercepted.

[0012] In one embodiment, matching the characteristic information of the first session data with a pre-built whitelist includes:

[0013] Based on the source IP address, the destination IP address and the application layer protocol in the characteristic information of the first session data, matching the first level linked list corresponding to the first session data in the whitelist;

[0014] Based on the function code in the characteristic information of the first session data, matching the secondary linked list corresponding to the first session data in the whitelist;

[0015] Based on the operation address in the characteristic information of the first session data, matching the three-level linked list corresponding to the first session data in the whitelist;

[0016] If the whitelist contains a primary linked list, a secondary linked list, and a tertiary linked list corresponding to the first session data, and the operation value in the characteristic information of the first session data matches the operation value in the tertiary linked list, it means that the characteristic information of the first session data exists in the whitelist.

[0017] In one embodiment, matching the first-level linked list corresponding to the first session data in the whitelist based on the source IP address, the destination IP address, and the application layer protocol in the characteristic information of the first session data includes:

[0018] Performing hash calculation on the source IP address, the destination IP address, and the application layer protocol in the characteristic information of the first session data to obtain a hash value;

[0019] According to the hash value, a primary linked list corresponding to the first session data is determined in the rule index table.

[0020] In one embodiment, the whitelist is constructed by the following steps:

[0021] Acquire historical session data generated based on the industrial communication protocol in the industrial network;

[0022] Extracting feature information of the historical session data based on the communication protocol type of the historical session data;

[0023] Based on the characteristic information of the historical session data, a target linked list is generated, and an index linked list is generated according to the target linked list; the index linked list includes index information, and the index information is used to find the target linked list corresponding to each session data;

[0024] The whitelist is determined based on the target linked list and the index linked list.

[0025] In one embodiment, the characteristic information includes at least: a source IP address, a destination IP address, an application layer protocol, a function code, an operation address, and an operation value;

[0026] The generating a target linked list based on the feature information of the historical session data includes:

[0027] Generate a primary linked list of the historical session data based on the source IP address, destination IP address, and application layer protocol of each session data in the historical session data;

[0028] Based on the function code of each session data in the historical session data, a secondary linked list of the historical session data is generated;

[0029] Based on the operation address and operation value of each session data in the historical session data, a three-level linked list of the historical session data is generated.

[0030] In one embodiment, the index chain table includes a rule index table, a function code index table and an address index table, and the generation process of the address index table includes:

[0031] Determine a target number of bits of the operation address according to the number of the operation addresses in the historical session data;

[0032] A hash value of a target number of bits of the operation address is calculated to determine an index value in the address index table.

[0033] According to a second aspect of an embodiment of the present disclosure, there is provided a security protection device for an industrial network, the device comprising:

[0034] A first acquisition unit, used to acquire session data initiated by a device in the industrial network;

[0035] A first extraction unit is configured to extract feature information of the first session data based on a communication protocol type of the first session data if the session data is first session data; the first session data is session data generated based on an industrial communication protocol;

[0036] The first matching unit is configured to match the feature information of the first session data with a pre-built white list, and allow the first session data to enter the industrial network if the feature information of the first session data exists in the white list.

[0037] In one embodiment, the device further comprises:

[0038] a second matching unit, configured to match the session data with a preset network segment based on the IP address information of the second session data if the session data is second session data; the second session data is session data generated based on a general communication protocol;

[0039] The interception unit is used to intercept the second session data if the IP address information of the second session data is not in the preset network segment.

[0040] In one embodiment, the first matching unit is specifically configured to:

[0041] Based on the source IP address, the destination IP address and the application layer protocol in the characteristic information of the first session data, matching the first level linked list corresponding to the first session data in the whitelist;

[0042] Based on the function code in the characteristic information of the first session data, matching the secondary linked list corresponding to the first session data in the whitelist;

[0043] Based on the operation address in the characteristic information of the first session data, matching the three-level linked list corresponding to the first session data in the whitelist;

[0044] If the whitelist contains a primary linked list, a secondary linked list, and a tertiary linked list corresponding to the first session data, and the operation value in the characteristic information of the first session data matches the operation value in the tertiary linked list, it means that the characteristic information of the first session data exists in the whitelist.

[0045] In one embodiment, the first matching unit is specifically configured to:

[0046] Performing hash calculation on the source IP address, the destination IP address, and the application layer protocol in the characteristic information of the first session data to obtain a hash value;

[0047] According to the hash value, a primary linked list corresponding to the first session data is determined in the rule index table.

[0048] In one embodiment, the device further comprises:

[0049] A second acquisition unit, used to acquire historical session data generated based on the industrial communication protocol in the industrial network;

[0050] A second extraction unit, configured to extract feature information of the historical session data based on a communication protocol type of the historical session data;

[0051] A generating unit, configured to generate a target linked list based on the characteristic information of the historical session data, and to generate an index linked list according to the target linked list; the index linked list includes index information, and the index information is used to find the target linked list corresponding to each session data;

[0052] A determination unit is used to determine the whitelist based on the target linked list and the index linked list.

[0053] In one embodiment, the characteristic information includes at least: a source IP address, a destination IP address, an application layer protocol, a function code, an operation address, and an operation value;

[0054] The generating unit is specifically used for:

[0055] Generate a primary linked list of the historical session data based on the source IP address, destination IP address, and application layer protocol of each session data in the historical session data;

[0056] Based on the function code of each session data in the historical session data, a secondary linked list of the historical session data is generated;

[0057] Based on the operation address and operation value of each session data in the historical session data, a three-level linked list of the historical session data is generated.

[0058] In one embodiment, the generating unit is specifically used for:

[0059] Determine a target number of bits of the operation address according to the number of the operation addresses in the historical session data;

[0060] A hash value of a target number of bits of the operation address is calculated to determine an index value in the address index table.

[0061] According to a third aspect of an embodiment of the present disclosure, there is provided a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of any method described in the first aspect are implemented.

[0062] According to a fourth aspect of an embodiment of the present disclosure, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any method described in the first aspect are implemented.

[0063] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0064] Based on the communication protocol type, feature extraction is performed on the session data generated by the industrial protocol, and whitelist matching is performed based on the feature information of the extracted session data. Only after the whitelist is successfully matched, the session data initiated by the device can enter the industrial network. This achieves fine-grained access control of the industrial network and improves the security of the industrial network. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 is a flow chart of a security protection method for an industrial network shown in an exemplary embodiment of the present disclosure;

[0066] Figure 2is a flow chart of a method for building a whitelist shown in an exemplary embodiment of the present disclosure;

[0067] Figure 3 is a flow chart of a method for constructing a target linked list shown in an exemplary embodiment of the present disclosure;

[0068] Figure 4 is a flow chart of a method for constructing an index linked list shown in an exemplary embodiment of the present disclosure;

[0069] Figure 5 is a flow chart of a method for matching a whitelist shown in an exemplary embodiment of the present disclosure;

[0070] Figure 6 is a flow chart of a method for detecting second session data shown in an exemplary embodiment of the present disclosure;

[0071] Figure 7 is a flow chart of generating whitelist rules shown in an exemplary embodiment of the present disclosure;

[0072] Figure 8 is a flow chart of detecting flow data of an industrial network shown in an exemplary embodiment of the present disclosure;

[0073] Fig. 9 is a block diagram of a security protection device for an industrial network shown in an exemplary embodiment of the present disclosure;

[0074] Fig.10 It is a hardware structure diagram of a computer device shown in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0075] The technical solution of the present disclosure will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described implementation is a part of the implementation of the present disclosure, rather than all the implementations. Based on the implementation in the present disclosure, all other implementations obtained by ordinary technicians in the field without creative work are within the scope of protection of the present disclosure. In addition, the technical features involved in the different implementations of the present disclosure described below can be combined with each other as long as they do not conflict with each other.

[0076] Industrial control systems are widely used in critical infrastructure such as manufacturing, energy, transportation, and water treatment. If industrial control systems are attacked by cyber attacks, it will cause huge economic losses, so risk management of industrial control systems is crucial. However, since most of the equipment in industrial control networks is industrial equipment, the processing power of industrial equipment itself is weak, and the ability to identify and resist malicious network attacks is also relatively weak. In addition to conventional network attack methods or virus infection, the security threats currently faced by industrial networks also include attacks on industrial communication protocols and control equipment's own security flaws and vulnerabilities, which bring more serious harm to industrial control systems. Therefore, fine-grained access control has become a key factor in the construction of industrial control network security.

[0077] Traditional access control strategies can be mainly divided into three categories: port-based protection methods, traffic feature statistics-based protection methods, and original payload-based protection methods.

[0078] Among them, the principle of the port-based protection method is to use the port number in the data packet header of the industrial flow data to check the known applications. The port-based protection method is simple and easy, but because many applications use dynamic ports or even hide themselves by using the ports of other applications, it is difficult for the port-based method to identify industrial flow data, resulting in poor accuracy in determining whether industrial session data is normal data or abnormal data, which in turn allows abnormal session data that may pose a security risk to the industrial control system to enter the industrial control system, affecting the security of the industrial control system.

[0079] The protection method based on traffic feature statistics uses supervised and unsupervised machine learning algorithms to classify industrial network traffic into predefined categories of known applications. However, this method requires experts to rely on a lot of experience to count traffic information, which consumes a lot of manpower. In addition, the precision that can be achieved is also low. Since the network traffic of different industrial manufacturing industries is significantly different, it is difficult to deal with it with one or several models. As a result, machine learning is likely to learn illegal traffic that exists in the industrial network itself, which leads to poor accuracy in determining whether industrial session data is normal data or abnormal data.

[0080] The principle of the protection method based on the original payload is to use deep learning and other methods to learn the intrinsic characteristics of the original industrial flow data. However, when learning the intrinsic characteristics of the data, the deep learning method has the disadvantages of data information loss and incomplete feature extraction. It is also unable to distinguish illegal messages in the learning traffic, resulting in poor accuracy in determining whether the industrial session data is normal data or abnormal data.

[0081] And the same message may represent different operation meanings at different times. For example, the same message may represent a read data operation at one time, but may represent a write data operation at another time. This is determined by its context-based parsing characteristics. In other words, dynamic port messages must be deeply parsed and tracked to understand their actual operation instructions.

[0082] Based on this, the embodiments of the present disclosure provide a risk detection method for industrial control networks. The method can be applied to industrial control systems or computer devices. According to the characteristic information of different communication protocols, the session data in the industrial control network is detected and protected, thereby improving the security of the industrial network. In some embodiments, the method can be divided into three stages, namely a learning stage, a testing stage, and a protection stage. In the learning stage, whitelist rules for entering the industrial network can be generated based on historical session data. The testing stage is used to test whether the whitelist rules are accurate. If there are protection errors, the whitelist rules can be manually modified to improve the accuracy of the whitelist rules. In the protection stage, session data in the industrial network can be detected according to the whitelist rules, and illegal traffic that does not comply with the rules can be intercepted, thereby improving the security of the industrial network. The security protection method for industrial networks proposed in the present disclosure will be described below through embodiments. Please refer to Figure 1 The flowchart shown includes:

[0083] S101, obtaining session data initiated by a device in an industrial network.

[0084] In the protection phase, the session data initiated by the device in the industrial network is first obtained. The session data is the data generated by the communication between the device and other devices in the industrial network. Since there are many industrial devices such as single-chip microcomputers, PLCs (Programmable Logic Controllers), and host devices such as computers in the industrial network, the session data in the industrial network may be diverse. The traffic between industrial devices in the industrial control system network is mostly automatically generated by industrial control equipment according to the production process, and often has a certain periodicity, which is very different from the general Internet traffic that is mostly generated by humans and has randomness.

[0085] Therefore, after obtaining the session data in the industrial network, the session data can be preliminarily identified to determine whether the session data is generated based on an industrial communication protocol or a general communication protocol. The industrial communication protocol refers to the communication standards and rules used in industrial automation systems to connect different devices, systems, sensors, actuators, and control systems. For example: Modbus RTU, IEC104, DNP3, S7, IEC61850MMS, OPC Classic, PROFINET, Ethernet / IP and other industrial communication protocols. The general communication protocol is a protocol designed for communication between different devices or systems. It is suitable for a wide range of application scenarios and usually focuses on data exchange and network interconnection, and is not specifically targeted at industrial control systems. For example, Bluetooth protocol, Hypertext Transfer Protocol, Transmission Control Protocol, etc.

[0086] After determining the type of communication protocol used by the session data, different strategies can be used to protect the session data according to different communication protocol types. If the session data is generated based on an industrial communication protocol, the compliance of the session data can be detected by whitelist matching. If the session data is generated based on a general communication protocol, the compliance of the session data can be detected by matching the IP information of the session data with the preset network segment allowed to enter the industrial network.

[0087] The following is an explanation of the process of detecting session data generated based on the industrial communication protocol.

[0088] S102: If the session data is first session data, extract characteristic information of the first session data based on a communication protocol type of the first session data.

[0089] After determining that the session data is the first session data generated based on the industrial communication protocol, the first session data can be deeply analyzed to extract the characteristic information of each message of the session data. The characteristic information is used to identify the communication information of each message. For example, the characteristic information may include a triplet of source address, destination address, and application layer protocol information, or the characteristic information may include a quadruple of source address, destination address, destination port, and application layer protocol information. Because the source port information is variable in some industrial communication protocols, the source port information may not be extracted. It should be noted that in some embodiments, the application layer protocol can be numbered in the whitelist, so when extracting the characteristic information in the first session data, the application layer protocol information can also be identified by numbering. For example, the Modbus protocol is numbered 1 and the IEC104 protocol is numbered 2.

[0090] After extracting the characteristic information of the message in the first session data, the characteristic information of the message can be matched with the whitelist to determine whether the extracted characteristic information exists in the whitelist. The specific process is as follows:

[0091] S103: Match the characteristic information of the first session data with a pre-built whitelist, and if the characteristic information of the first session data exists in the whitelist, allow the first session data to enter the industrial network.

[0092] According to the characteristic information of the message in the first session data, a search is performed in the whitelist to determine whether the characteristic information of the message in the first session data exists in the preset whitelist. When searching in the whitelist, the characteristic information can be retrieved by traversing the whitelist, or by generating a characteristic information index value and directly indexing in the whitelist. If the characteristic information of the message in the first session data exists in the whitelist, it means that the first session data is data that complies with the rules of the industrial network, and therefore the first session data can be allowed to enter the industrial network. Correspondingly, if the characteristic information of the message in the first session data does not exist in the whitelist, it means that the first session data is data that does not comply with the rules of the industrial network, and therefore the first session data can be intercepted from entering the industrial network to improve the security of the industrial network.

[0093] The disclosed embodiment extracts features of session data generated based on industrial protocols based on the communication protocol type, and performs whitelist matching based on the feature information of the extracted session data. Only after the session data initiated by the device successfully matches the whitelist can it enter the industrial network. This achieves fine-grained access control of the industrial network and improves the security of the industrial network.

[0094] In order to better explain the matching process between feature information and whitelist, the following will first explain the process of generating whitelist, and then explain the process of matching the feature information of the first session data according to the whitelist. The process of generating whitelist is mainly carried out in the learning stage. For details, please refer to Figure 2 The flowchart shown includes:

[0095] S201, obtaining historical session data generated based on an industrial communication protocol in the industrial network.

[0096] S202: Extract characteristic information of the historical session data based on the communication protocol type of the historical session data.

[0097] S203, generating a target linked list based on the feature information of the historical session data, and generating an index linked list according to the target linked list.

[0098] S204: Determine the whitelist based on the target linked list and the index linked list.

[0099] The basis for learning and generating whitelists is mainly historical session data generated based on industrial communication protocols in industrial networks. This is because, unlike the randomness of network traffic generated based on general communication protocols, network traffic generated based on industrial communication protocols is stable, periodic, and has relatively small traffic. Therefore, learning and detection methods based on point-to-point industrial fixed traffic can often achieve more significant detection effects than general networks. In addition, in industrial network traffic, the traffic between the same client (source IP) and server (destination IP) is generally periodic, and the production process or business is relatively fixed. Therefore, the DPI whitelist content of industrial network traffic can be learned based on the source IP address, destination IP address, and application layer protocol information in the historical session data.

[0100] After obtaining the historical session data, it is also necessary to parse the historical session data and extract the characteristic information of the messages in the historical session. According to the characteristic information, the application layer protocol type in the characteristic information is determined, and each application layer protocol is numbered to distinguish different application layer protocols by the protocol number. And when the session data is subsequently detected, it is also detected according to different protocols, rather than according to the port information in the session data, to improve the detection accuracy of the session data.

[0101] When parsing historical session data, feature information of historical session data can be extracted in two parts according to the requirements of security policies. Security policy requirements may include basic security policies and protocol DPI (Deep Packet Inspection) rules, wherein the basic security policy is used to detect the basic information of session data, and the protocol DPI rules are used to perform deep content parsing and detection for different network application layer loads. Therefore, in some embodiments, the source IP address, destination IP address, application layer protocol information, input interface, output interface, access direction (one-way or reverse or two-way access) and other information in the historical session data can be extracted based on the basic security policy. Based on the protocol DPI rules, information such as the function code, operation address, and operation value of the application layer protocol operation can be extracted. By detecting session data in the industrial network through the basic security policy and the protocol DPI rules, it is possible to accurately determine whether each session message meets the requirements of the industrial network, thereby improving the security of the industrial network. It should be noted that a basic security policy can correspond to multiple protocol DPI rules, that is, a basic security policy corresponds to a DPI rule set, and each DPI rule set can be uniquely identified by a rule set ID. For example, the basic security policy is the communication policy between the host computer and the single-chip microcomputer. Therefore, the basic security policy may include the source IP address corresponding to the host computer, the destination IP address corresponding to the single-chip microcomputer, the application layer protocol information, and the access reverse direction. However, there may be multiple communication message data between the host computer and the single-chip microcomputer. The operation code, operation address, and operation value in each message data are not the same. The DPI rule set includes a series of operation function codes, operation addresses, and operation value ranges between the host computer and the single-chip microcomputer. For example, {{Function code 1}, {Function code 2, address 2}, {Function code 3, address 3, value range 3}...}, for example: {{Upload}, {Download}, {Restart}, {Read, address 0x50}, {Write, address 0x90, value range 100-200}}.

[0102] After extracting the characteristic information from the historical session data, you can build a target list in the whitelist based on the characteristic information. Figure 3 The flowchart shown includes:

[0103] S301, generating a primary linked list of the historical session data based on the source IP address, destination IP address, and application layer protocol of each session data in the historical session data.

[0104] S302: Generate a secondary linked list of the historical session data based on the function code of each session data in the historical session data.

[0105] S303: Generate a three-level linked list of the historical session data based on the operation address and operation value of each session data in the historical session data.

[0106] Based on the source IP address, destination IP address, and application layer protocol of each session data in the historical session data, a first-level linked list as shown in Table 1 can be generated.

[0107] Table 1

[0108] First level linked list Source Address Destination Address Application layer protocol number Inbound interface Outbound interface Number of hits Session Direction Rule Set ID ... Secondary linked list head pointer

[0109] The first-level linked list is used to detect whether the session data meets the basic security policy requirements. Therefore, the first-level linked list includes at least the source IP address, the destination IP address and the application layer protocol information. The communication flow consisting of each pair of device source address and destination address and application layer protocol is used as the learning object. Using the application layer protocol number instead of the port can realize the effective identification and control of the dynamic port protocol.

[0110] Further, according to the function code of each session data in the historical session data, the function code represents the specific operation of each message, and a secondary linked list as shown in Table 2 can be generated based on the function code information:

[0111] Table 2

[0112]

[0113]

[0114] In addition, a three-level linked list as shown in Table 3 can be generated according to the operation address and operation value of each session data in the historical session data:

[0115] Table 3

[0116] Three-level linked list Operation Address Operation value range ...

[0117] Among them, the above-mentioned first-level linked list, second-level linked list and third-level linked list can be generated according to the characteristic information of the message in a historical session data. After the learning stage is over, the third-level linked list corresponding to each message can be sorted so that the adjacent second-level linked list and / or third-level linked list can be merged later. This is because the data information stored in the second-level linked list and the third-level linked list represents the specific operation information between the two devices, such as read, write, restart, upload, download and other operations, as well as the specific address and value of the operation. The data information stored in the first-level linked list is the information corresponding to the basic security policy between the two devices, so the first-level linked list can be merged. There are also differences in the source IP address, destination IP address and application layer protocol information in the session data, the specific operation code, operation address and operation value range of each message in the session data. The operation value range in the three-level linked list is also determined by merging the operation values ​​of multiple messages.

[0118] In addition, when constructing the target linked list, the new linked list node generated by the forward request message is marked as a temporary node. The temporary node is marked as a formal node only when the reverse response message is received and the operation result is successful. When merging linked lists, the temporary node can be deleted and only the formal nodes are merged. This is because normal session communication in industrial networks has forward requests and reverse responses. If there is only a forward request but no reverse response, then the historical session data can be considered as abnormal session data. Therefore, the characteristic information of the session data does not need to generate a linked list record to the whitelist.

[0119] The purpose of setting up a three-level linked list is that in the subsequent detection phase, it is possible to directly determine whether there is feature information of the session data to be detected in the whitelist according to the index of each linked list, without traversing the entire whitelist to determine whether there is feature information of the session data to be detected, thereby reducing the time complexity of subsequent matching of the whitelist and improving matching efficiency.

[0120] In some embodiments, a hit count may be added to the primary linked list, and the hit count is increased by one after each match in the detection phase, and is subsequently used to characterize the frequency of occurrence of the message stream. A data area may exist in the secondary linked list, and the data area refers to the part of the communication protocol message that carries specific data, which usually contains actual data obtained or sent from the device. The format of the data area varies according to different communication protocols (such as Modbus, Profibus, etc.), so the data area field may not exist in some industrial communication protocols, and the data area field may be set to 0 by default in its corresponding secondary linked list.

[0121] In some embodiments, there may be no operation address in the industrial communication protocol. For such protocols, digital inputs, digital outputs, counters, applications, etc. may be manually encoded, that is, abstracted into address-like objects for processing.

[0122] After the target linked list is generated, an index linked list corresponding to each linked list can be generated based on the target linked list, and the index linked list includes index information, and the index information is used to find the target linked list corresponding to each session data. In other words, according to the index value in the index linked list, it can be quickly determined whether there is characteristic information of a session data in the whitelist, and then determine whether the session data can enter the industrial network.

[0123] In some embodiments, the index chain table includes a rule index table, a function code index table and an address index table. For the process of generating the index chain table according to the target chain table, please refer to Figure 4 The flowchart shown includes:

[0124] S401, performing hash calculation on the source IP address, destination IP address, and application layer protocol information in the first-level linked list to generate a rule index table.

[0125] S402, performing hash calculation on the function codes in the secondary linked list to generate a function code index table.

[0126] S403, performing hash calculation on the operation addresses in the three-level linked list to generate an address index table.

[0127] The rule index table is used to find the primary linked list of each session data; the function code index table is used to find the secondary linked list of each session data; and the address index table is used to find the tertiary linked list of each session data.

[0128] The index rule table includes an index value for the first-level linked list, which is obtained by hashing the source IP address, destination IP address, and application layer protocol information in the first-level linked list. In other words, in the detection phase, the index value can be obtained by hashing the source IP address, destination IP address, and application layer protocol information in the session data to be detected. Based on the index value, it can be directly determined in the whitelist through the index linked list whether there is a corresponding first-level linked list to detect the basic security policy.

[0129] The function code index table includes index values ​​for the secondary linked list. The index values ​​in the function code index table are obtained by performing a hash calculation on the function code in the secondary linked list, or on the function code and the data area. In one embodiment, the function code index value is index = hash (function code, data area), where index represents the function code index and hash represents the hash calculation. For example, the value function code + data area << 4. In this way, when matching the strategy in the subsequent detection stage, the corresponding protocol DPI sub-rule can be directly located based on the function code, data area, etc., achieving an O(1) search efficiency.

[0130] The address index table includes index values ​​for the three-level linked list. The index values ​​in the address index table are obtained by performing a hash calculation on the operation addresses in the three-level linked list. In one embodiment, when calculating the index values ​​in the address index table, the lower n bits of each address can be hashed according to the number of operation addresses in the historical session data to determine the index value. This is because the size of the address space is determined by the number of bits of the address. Usually, in a computer system, the address is represented in binary form. If we want to represent N addresses, we need enough binary bits n so that 2 n ≥N. Here n is the number of bits to be extracted, i.e. the lower n bits. In other words, the n-bit address space can represent at most 2 n different addresses. If the number of addresses we need is N, then the minimum value of n is 2 n ≥N value. It should be noted that when calculating the index value in the address index table, the above n-bit value is a recommended value, and the specific value can be planned according to the actual application situation. The purpose of taking the lower n bits of each address for hash calculation is to avoid hash conflicts, because once a hash conflict occurs, it is necessary to traverse the linked list to determine the security rules corresponding to each message, and traversing the linked list will greatly reduce the efficiency of matching whitelist rules. Therefore, when calculating the index value, try to take the appropriate number of bits in each address for hash calculation.

[0131] When calculating the index value in the address index table, if the operation address is continuous, then after calculating the index according to the lower n bits of the address, the continuous addresses are also stored continuously in the address index table. Therefore, when matching the whitelist in the subsequent detection stage, the operation address can be matched backward in sequence in the address index table, and any single address match can theoretically achieve the highest matching efficiency of O(1).

[0132] After the target linked list and the index linked list corresponding to the target linked list are sorted, the target linked list and the index linked list can be saved to the database and displayed on the web page, supporting expert users to make appropriate modifications and adjustments based on field experience, or they can be directly applied without modification, further improving the accuracy of the whitelist rules.

[0133] After the whitelist is generated, the first session data to be detected in the industrial network can be detected according to the rules in the whitelist. The following describes the process of matching the characteristic information of the first session data with the whitelist. Figure 5 The flowchart shown includes:

[0134] S501 : Based on the source IP address, the destination IP address and the application layer protocol information in the characteristic information of the first session data, matching the first level linked list corresponding to the first session data in the whitelist.

[0135] S502: Based on the function code in the characteristic information of the first session data, match the secondary linked list corresponding to the first session data in the whitelist.

[0136] S503: Based on the operation address in the characteristic information of the first session data, match the three-level linked list corresponding to the first session data in the whitelist.

[0137] S504: If the whitelist contains a primary linked list, a secondary linked list, and a tertiary linked list corresponding to the first session data, and the operation value in the characteristic information of the first session data matches the operation value in the tertiary linked list, it indicates that the characteristic information of the first session data exists in the whitelist.

[0138] After obtaining the characteristic information of the message in the first session data, the source IP address, destination IP address and application layer protocol information in the characteristic information are hashed to obtain the rule index value of the first session data. According to the rule index value, it is determined through the rule index table whether there is a first-level linked list corresponding to the first session data in the whitelist. If there is a first-level linked list in the whitelist, it means that the basic security policy of the first session data has been matched.

[0139] Furthermore, if the first message of the first session data enters the policy matching process, after matching the first-level linked list, the first-level linked list identifier can be saved in the first session data to indicate that the first session data has successfully matched the first-level linked list, and other messages in the first session data can no longer match the first-level linked list. This is because the five-tuple of multiple messages in the same session will not change, and when the basic policy remains unchanged, the matching result will remain unchanged and no need to match again, so as to improve efficiency. Accordingly, when subsequent message data in the first session data is detected, if the first-level linked list identifier does not exist on the first session, it means that the session has not matched the basic policy, so the message can be directly intercepted. In other words, when the first message in the first session data enters the detection phase, if it does not match the first-level linked list, then all the first session data will be intercepted.

[0140] For the message in the first session data that successfully matches the first-level linked list, the second-level linked list can be matched. When matching the second-level linked list, the index value can be calculated based on the function code, data area and other information in the feature information of each message, and the second-level linked list node in the corresponding second-level linked list can be directly located. Finally, the index is calculated based on the operation address, operation value and other information to locate the node on the third-level linked list. If the operation address, operation value and other information are within the rule range, the message in the first session data is allowed to pass.

[0141] In one embodiment, after a message in the first session data is matched to a primary linked list, a secondary linked list identifier (i.e., a set of sub-rule IDs in the secondary linked list) referenced by the primary linked list can also be saved in the first session data, so that multiple secondary linked lists corresponding to the primary linked list can be directly determined according to the secondary linked list identifier, thereby improving the efficiency of calculating index values ​​according to information such as function codes and data areas in the feature information of each message and locating secondary linked list nodes in the corresponding secondary linked list.

[0142] So far, the detection process of session data generated based on industrial communication protocols has been described. The following will describe the detection process of the second session data generated based on the general communication protocol. Figure 6 The flow chart shown:

[0143] S601: If the session data is second session data, matching is performed based on IP address information of the second session data with a preset network segment.

[0144] S602: If the IP address information of the second session data is not in the preset network segment, intercept the second session data.

[0145] The matching process of the second session data is different from that of the first session data. When matching the first session data, the source address, destination address and other information can be specified to achieve point-to-point detection of the message data between the two devices. However, when detecting the second session data generated based on the general communication protocol, the source IP address information and / or destination IP address information of the message in the second session data can be matched with the preset network segment determined in the learning phase that can enter the industrial network. If the source IP address information and / or destination IP address information of the message in the second session data is in the preset network segment, it means that the second session data complies with the rules of the industrial network, so the second session data can be allowed to enter the industrial network. If the source IP address information and / or destination IP address information of the message in the second session data is not in the preset network segment, it means that the second session data does not comply with the rules of the industrial network, so the second session data can be intercepted and not allowed to enter the industrial network to improve the security of the industrial network.

[0146] The preset network segment can be determined during the learning phase based on historical session data in the industrial network. The purpose of detecting the second session data based on the preset network segment is to reduce the false interception rate caused by the randomness of the general communication protocol. For example, during the learning phase, the source IP address of host A is: 192.168.0.1, and host A uses a browser to access the http service of server H: 10.124.10.1. If only a point-to-point detection rule of {192.168.0.1, 10.124.10.1, http} is generated, and due to the randomness of the general protocol, host B does not use a browser to access server H during the learning phase, and subsequent host B's access to server H will be mistakenly intercepted. However, if a coarse-grained detection rule based on network segment is generated in the learning phase, such as {192.168.0.1 / 24, 10.124.10.1 / 24, http}, then any host in the subsequent network segment 192.168.0.1 / 24 can access the http service of server H, thereby reducing the false interception rate caused by randomness of the general communication protocol.

[0147] It should be noted that the preset network segments can be sorted according to the matching frequency, with the network segments with higher frequencies being placed at the front, and the high-frequency network segments being matched first to improve the matching efficiency.

[0148] The preset network segment is also learned according to the historical session data in the learning phase. In the learning phase, the source IP address, destination IP address, and application layer protocol information triples of the session data generated based on the general communication protocol can be aggregated and divided into two categories: IPv4 and IPv6. For each type of session data, the source IP address and the destination IP address are sorted in ascending order to facilitate subsequent merging by network segment. Adjacent IP addresses generally have certain similarities in their network access relationships and are suitable for aggregation processing. Comprehensively considering the number of addresses and address divergence, IP addresses can be automatically merged according to commonly used network segment masks / 64, / 24, / 16, etc. Finally, the network segments are sorted in descending order according to the hit count field. The top-ranked network segments have a higher frequency of message appearance, and these network segments are matched first, which can improve the overall matching efficiency of the strategy. This not only ensures the legitimate network access relationship, but also reduces the number of addresses, and improves the overall business matching efficiency to a certain extent.

[0149] In one embodiment, a method for generating whitelist rules is as follows: Figure 7As shown. First, the real historical session data in the industrial network is obtained, and then the protocol identification is performed on the historical session data so as to record the message features in the historical session based on the protocol type. In the learning stage, if the session data is determined to be the first session data generated based on the industrial communication protocol, then the first session data is feature extracted to obtain the triplet and DPI protocol information of the message. The triplet is the source IP address, destination IP address, and application layer protocol information of the message session. The triplet can better reflect the business operation details of a fixed industrial generation process periodicity between two fixed industrial equipment. It is reasonable to learn the whitelist baseline rules with triplet, which takes advantage of the periodic characteristics of industrial traffic and achieves effective protection and low false interception rate to the greatest extent. After extracting the triplet features, three levels of linked lists are generated according to the triplet features and DPI protocol information of the historical session data, and a rule base is constructed according to the linked list, and the rule base is pushed to experts, who can manually modify the rule base based on their own experience.

[0150] If it is determined in the learning stage that the session data is the second session data generated based on the general communication protocol, then after extracting the triplet information of the second session data, the source IP address and the destination IP address in the second session data are merged to generate the preset network segment information. This allows the session data in the industrial network to be matched according to the preset network segment in the future. Matching by network segment reduces the number of address objects and policies and improves the matching efficiency. Coarse-grained matching by network segment utilizes the characteristics of the general protocol's burstiness and randomness, which can reduce the general protocol's false interception rate. The addresses of each network segment are arranged in descending order according to the frequency of occurrence of the network segment message in the network, which improves the matching efficiency of high-frequency messages.

[0151] In one embodiment, the method for detecting the security of traffic data in the industrial network is as follows: Figure 8 As shown. That is, firstly obtain the session data to be detected in the industrial network, and then perform protocol identification on the session data. If the session data is the first session data generated based on the industrial communication protocol, extract the triplet feature and DPI protocol information of the first session data, and match the whitelist rule according to the extracted feature. If it meets the whitelist rule, allow the session to enter the industrial network. If it does not meet the whitelist rule, intercept the session.

[0152] If the session data is the second session data generated based on the general communication protocol, extract the triplet feature of the second session data, and determine whether the source IP address and the destination IP address in the triplet feature are in the preset network segment. If they are, allow the second session data to enter the industrial network; if not, intercept the second session data.

[0153] Corresponding to the above-mentioned embodiments of the security protection method for industrial networks, the present disclosure also provides embodiments of the security protection device for industrial networks.

[0154] Please refer to Fig. 9 , Fig. 9 : is a block diagram of a security protection device for an industrial network provided by an embodiment of the present disclosure, the device comprising:

[0155] A first acquisition unit 901 is used to acquire session data initiated by a device in an industrial network;

[0156] A first extraction unit 902 is configured to extract feature information of the first session data based on a communication protocol type of the first session data if the session data is first session data; the first session data is session data generated based on an industrial communication protocol;

[0157] The first matching unit 903 is configured to match the feature information of the first session data with a pre-built whitelist, and allow the first session data to enter the industrial network if the feature information of the first session data exists in the whitelist.

[0158] In one embodiment, the device further comprises:

[0159] a second matching unit, configured to match the session data with a preset network segment based on the IP address information of the second session data if the session data is second session data; the second session data is session data generated based on a general communication protocol;

[0160] The interception unit is used to intercept the second session data if the IP address information of the second session data is not in the preset network segment.

[0161] In one embodiment, the first matching unit 901 is specifically configured to:

[0162] Based on the source IP address, the destination IP address and the application layer protocol in the characteristic information of the first session data, matching the first level linked list corresponding to the first session data in the whitelist;

[0163] Based on the function code in the characteristic information of the first session data, matching the secondary linked list corresponding to the first session data in the whitelist;

[0164] Based on the operation address in the characteristic information of the first session data, matching the three-level linked list corresponding to the first session data in the whitelist;

[0165] If the whitelist contains a primary linked list, a secondary linked list, and a tertiary linked list corresponding to the first session data, and the operation value in the characteristic information of the first session data matches the operation value in the tertiary linked list, it means that the characteristic information of the first session data exists in the whitelist.

[0166] In one embodiment, the first matching unit 901 is specifically configured to:

[0167] Performing hash calculation on the source IP address, the destination IP address, and the application layer protocol in the characteristic information of the first session data to obtain a hash value;

[0168] According to the hash value, a primary linked list corresponding to the first session data is determined in the rule index table.

[0169] In one embodiment, the device further comprises:

[0170] A second acquisition unit, used to acquire historical session data generated based on the industrial communication protocol in the industrial network;

[0171] A second extraction unit, configured to extract feature information of the historical session data based on a communication protocol type of the historical session data;

[0172] A generating unit, configured to generate a target linked list based on the characteristic information of the historical session data, and to generate an index linked list according to the target linked list; the index linked list includes index information, and the index information is used to find the target linked list corresponding to each session data;

[0173] A determination unit is used to determine the whitelist based on the target linked list and the index linked list.

[0174] In one embodiment, the characteristic information includes at least: a source IP address, a destination IP address, an application layer protocol, a function code, an operation address, and an operation value;

[0175] The generating unit is specifically used for:

[0176] Generate a primary linked list of the historical session data based on the source IP address, destination IP address, and application layer protocol of each session data in the historical session data;

[0177] Based on the function code of each session data in the historical session data, a secondary linked list of the historical session data is generated;

[0178] Based on the operation address and operation value of each session data in the historical session data, a three-level linked list of the historical session data is generated.

[0179] In one embodiment, the generating unit is specifically used for:

[0180] Determine a target number of bits of the operation address according to the number of the operation addresses in the historical session data;

[0181] Calculate the hash value of the target number of bits of the operation address and determine the index value in the address index table. The implementation process of the functions and effects of each unit in the above device is detailed in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0182] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0183] The embodiments of the security protection device for industrial networks disclosed in the present invention can be applied to computer devices. The device embodiments can be implemented by software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the computer device in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them. From the hardware level, if Fig.10 As shown, it is a hardware structure diagram of the computer equipment where the security protection device of the industrial network disclosed in the present invention is located. Fig.10 In addition to the processor, memory, network interface, and non-volatile memory shown, the computer device in which the apparatus in the embodiment is located may also include other hardware according to its actual functions, which will not be described in detail.

[0184] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that these operations be performed in the particular order shown or performed sequentially, or requiring that all illustrated operations be performed to achieve the desired results. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system modules and components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single computer program product, or packaged into multiple computer program products.

[0185] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the particular order or sequential order shown to achieve the desired results. In some implementations, multitasking and parallel processing may be advantageous.

[0186] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure shall be included in the scope of protection of the present disclosure.

Claims

1. A security protection method for an industrial network, characterized in that: The method comprises: Get session data initiated by devices in industrial networks; If the session data is first session data, extracting characteristic information of the first session data based on the communication protocol type of the first session data; the first session data is session data generated based on an industrial communication protocol; The characteristic information of the first session data is matched with a pre-built white list, and if the characteristic information of the first session data exists in the white list, the first session data is allowed to enter the industrial network.

2. The method according to claim 1, characterized in that The method further comprises: If the session data is second session data, matching is performed based on the IP address information of the second session data and the preset network segment; the second session data is session data generated based on a universal communication protocol; If the IP address information of the second session data is not in the preset network segment, the second session data is intercepted.

3. The method according to claim 1, characterized in that The matching the characteristic information of the first session data with a pre-built whitelist includes: Based on the source IP address, the destination IP address and the application layer protocol information in the characteristic information of the first session data, matching the first level linked list corresponding to the first session data in the whitelist; Based on the function code in the characteristic information of the first session data, matching the secondary linked list corresponding to the first session data in the whitelist; Based on the operation address in the characteristic information of the first session data, matching the three-level linked list corresponding to the first session data in the whitelist; If the whitelist contains a primary linked list, a secondary linked list, and a tertiary linked list corresponding to the first session data, and the operation value in the characteristic information of the first session data matches the operation value in the tertiary linked list, it means that the characteristic information of the first session data exists in the whitelist.

4. The method according to claim 3, characterized in that The matching of the first-level linked list corresponding to the first session data in the whitelist based on the source IP address, the destination IP address, and the application layer protocol information in the characteristic information of the first session data includes: Performing hash calculation on the source IP address, the destination IP address, and the application layer protocol information in the characteristic information of the first session data to obtain a hash value; According to the hash value, a primary linked list corresponding to the first session data is determined in the rule index table.

5. The method according to claim 1, characterized in that The whitelist is constructed by the following steps: Acquire historical session data generated based on the industrial communication protocol in the industrial network; Extracting feature information of the historical session data based on the communication protocol type of the historical session data; Based on the characteristic information of the historical session data, a target linked list is generated, and an index linked list is generated according to the target linked list; the index linked list includes index information, and the index information is used to find the target linked list corresponding to each session data; The whitelist is determined based on the target linked list and the index linked list.

6. The method according to claim 5, characterized in that The characteristic information includes at least: source IP address, destination IP address, application layer protocol information, function code, operation address and operation value; The generating a target linked list based on the feature information of the historical session data includes: Generate a primary linked list of the historical session data based on the source IP address, destination IP address, and application layer protocol information of each session data in the historical session data; Based on the function code of each session data in the historical session data, a secondary linked list of the historical session data is generated; Based on the operation address and operation value of each session data in the historical session data, a three-level linked list of the historical session data is generated.

7. The method according to claim 5, characterized in that The index chain table includes a rule index table, a function code index table and an address index table, and the generation process of the address index table includes: Determine a target number of bits of the operation address according to the number of the operation addresses in the historical session data; A hash value of a target number of bits of the operation address is calculated to determine an index value in the address index table.

8. A security protection device for an industrial network, characterized in that: The device comprises: A first acquisition unit, used to acquire session data initiated by a device in the industrial network; A first extraction unit is configured to extract feature information of the first session data based on a communication protocol type of the first session data if the session data is first session data; the first session data is session data generated based on an industrial communication protocol; The first matching unit is configured to match the feature information of the first session data with a pre-built white list, and allow the first session data to enter the industrial network if the feature information of the first session data exists in the white list.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

Images