Abnormal recognition method, electronic equipment and storage medium

Abstract

The invention relates to the technical field of industrial control, and provides an exception recognition method and device, electronic equipment and a storage medium. According to the method, a target memory area is monitored, wherein the target memory area is a memory running area of a programmable logic controller program; if it is monitored that the information in the target memory area is updated, memory updating information is obtained; and determining whether the program of the programmable logic controller is abnormal or not based on the memory update information, so that whether the program is abnormal or not is determined by monitoring the target memory area, the problem that dynamic security threats of a control system cannot be resisted in related technologies is avoided, and the reliability of the program is improved. And the system, the data and the behaviors cannot be integrally protected in the operation process.

Description

Technical Field

[0001] The present application relates to the field of industrial control technology, and in particular to an abnormality identification method, an electronic device and a storage medium. Background Art

[0002] Traditional programmable logic controllers (PLCs) mainly focus on usability indicators such as functionality, reliability, and real-time performance. Product design focuses more on function realization, with weak security awareness and basically no consideration of security protection. They only rely on traditional security mechanisms such as boundary isolation or peripheral protection for security protection. PLC control systems are very different from traditional computer systems. The computing power of control systems is limited. The additional delays caused by layered protection through traditional information system security protection methods will affect the timing of the control system, delay data collection and transmission, affect the control performance of the system, and have a significant impact on the real-time performance of the system. When the delay is large, it may even cause catastrophic consequences such as instability. Therefore, many information security protection measures in traditional computer systems cannot be directly adopted in industrial control systems. The existing abnormal detection mechanisms of industrial control systems (including bad value alarms, measurement abnormality alarms, error data detection mechanisms and other security defense strategies) can detect accidental / accidental transmission failures and errors, and promptly discard erroneous data, instructions, and operations so that they do not affect the industrial control system. However, a large number of studies have shown that attackers can evade these traditional anomaly detection mechanisms and successfully inject them into industrial control systems through rigorous logical design while meeting certain constraints.

[0003] Traditional information security protection and anomaly detection alone cannot defend against dynamic security threats faced by control systems. PLC has the characteristics of real-time, high availability, and high robustness. From the perspective of security focus, PLC's primary consideration is the business continuity of all system components, with availability and integrity taking higher priority. The traditional security protection measures of existing information systems primarily consider confidentiality, with less consideration given to PLC-specific requirements such as reliability and real-time. The security protection of PLC cannot directly copy the security protection measures of information systems. It is necessary to study the PLC control process in a targeted manner based on the complex heterogeneity, strong real-time, and resource-constrained characteristics of the control system, so that timely and accurate warnings can be issued before the attack behavior has a bad impact on the control system. Summary of the invention

[0004] In view of this, an embodiment of the present application provides an abnormality identification method, an electronic device and a storage medium to solve or partially solve the above-mentioned problems.

[0005] According to a first aspect of an embodiment of the present application, a method for identifying an abnormality is provided, the method comprising: monitoring a target memory area, wherein the target memory area is a memory running area of ​​a programmable logic controller program; if an information update in the target memory area is monitored, memory update information is obtained; and based on the memory update information, determining whether the programmable logic controller program has an abnormality.

[0006] According to a third aspect of an embodiment of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0007] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, which stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0008] The beneficial effects of the embodiments of the present application compared with the prior art are as follows: the embodiment of the present application has an abnormality identification method, the method comprising: monitoring a target memory area, the target memory area being a memory running area of ​​a programmable logic controller program; if information updates in the target memory area are monitored, then obtaining memory update information; determining whether the programmable logic controller program has an abnormality based on the memory update information. The present application achieves determining whether a program abnormality exists by monitoring the target memory area, thereby avoiding the problem in the related art of being unable to resist dynamic security threats to the control system and being unable to provide overall protection for the system, data, and behavior during operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0010] Figure 1 It is a basic schematic diagram of a PLC system provided in an embodiment of the present application;

[0011] Figure 2 It is a schematic diagram of a PLC internal behavior monitoring system process provided by an embodiment of the present application;

[0012] Figure 3 It is a schematic diagram of an abnormal behavior rule determination model provided in an embodiment of the present application;

[0013] Figure 4 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0014] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0015] An abnormality identification method according to an embodiment of the present application will be described in detail below with reference to the accompanying drawings.

[0016] The present application provides an exception identification method, which includes: monitoring a target memory area, where the target memory area is a memory running area of ​​a programmable logic controller program; if information update in the target memory area is monitored, then memory update information is obtained; and based on the memory update information, determining whether the programmable logic controller program has an exception.

[0017] It can be understood that the system behavior, network access behavior, network interaction behavior, and control behavior of the programmable logic controller program in the PLC system will cause the information in the memory area to be updated. In order to determine whether the programmable logic controller program is abnormal, this example is implemented by monitoring the memory area.

[0018] In some examples, the memory update information includes: at least one variable identifier and a change amount corresponding to each variable identifier; determining whether the programmable logic controller program has an abnormality based on the memory update information includes: determining a target selection rule set from a selection rule set based on the variable identifier; determining a verification result of the variable identifier based on the change amount corresponding to the variable identifier and the target selection rule set, the verification result being used to determine whether the variable identifier has an abnormality; determining whether the programmable logic controller program corresponding to the variable identifier has an abnormality based on the verification result.

[0019] In some examples, the selection rule set includes rules corresponding to identification values ​​and marking values; determining a target selection rule set from the selection rule set based on the variable identification includes: matching each of the variable identifications with the identification values ​​included in the selection rule set one by one to obtain a target identification value; generating the target selection rule set based on the rules corresponding to the target identification values ​​and the target marking values.

[0020] In some examples, the verification result of the variable identifier is determined based on the change amount corresponding to the variable identifier and the target selection rule set, including: determining the rule corresponding to the change amount corresponding to the variable identifier from the target selection rule set; determining whether the change amount corresponding to the variable identifier matches the determined rule, and if the change amount corresponding to the variable representation fails to match the determined rule, determining that the verification result of the variable identifier is abnormal.

[0021] It can be understood that the abnormality identification method provided in this example is applied to a PLC system, such as Figure 1 As shown in the figure, the PLC system is internally provided with a data monitoring module, a behavior analysis module, an abnormal behavior rule determination model, and an abnormal blocking module, and the above modules are independent of the original PLC program compilation and download operation architecture, which can be divided into safety time and operation time, specifically involving:

[0022] A behavior rule compiler in the host computer, a PLC compiler, a downloader, a real-time system (RTS) in the slave computer, a PLC program running in the slave computer, and an internal behavior monitoring system of the PLC device; the behavior rule compiler in the host computer is used to compile the behavior rules into the abnormal behavior rule judgment model; the host computer PLC compiler is used to compile the PLC program code written by the user in POU units for downloading; the downloader is used to download the internal behavior monitoring system and the compiled RTS and the PLC program running inside it to the slave computer at the same time; the real-time system is used to schedule multiple PLC programs in multiple POU units, communicate with the host computer, etc.

[0023] Among them, the operation description of the PLC internal behavior monitoring system: the operating system in the lower computer regards the real-time system as a thread execution, and the PLC device internal behavior monitoring system as another thread, and the two are executed concurrently; the PLC device internal behavior monitoring system is used when the PLC program is running normally, so that the data monitoring module regularly monitors a batch of specific memory address changes of the lower computer (the specific area is passed in by the upper computer compiler to the control logic representation information, which is handed over to the behavior analysis module for analysis during initialization and then passed in to the data monitoring module); the lower computer memory address refers to all running memory areas of the lower computer, which are loaded with data information and code instruction information of the real-time system and the PLC device internal behavior monitoring system, and all executable programs on the lower computer - that is, the real-time system and the PLC device internal behavior monitoring system For the monitoring system, all memory areas of the lower computer can be directly accessed with real addresses; after the data monitoring module finds memory changes, the change information is passed to the behavior analysis module for analysis; after the behavior analysis module performs behavior analysis, the behavior information is stored in the database, and the behavior information is passed to the abnormal behavior rule judgment model; the abnormal behavior rule judgment model performs rule judgment after data call operation and other logic (pre-operation is determined by the behavior rules set in advance) to determine whether there is an abnormal rule trigger. If so, the abnormal blocking module is called to alarm or execute an abnormal blocking command. If not, the abnormal behavior rule judgment model waits for the next behavior information input, that is, the data monitoring module receives the behavior information input again after the behavior analysis module, until the internal behavior monitoring system of the PLC device stops monitoring.

[0024] The initialization control logic characterization information passed to the behavior analysis module by the host computer compiler includes the execution environment of the system default execution behavior (start, stop, etc.), the execution context information of the network access behavior (host computer connection, modbus connection, etc.), and the variable-address mapping table of the process control behavior (variable modification, forcing, etc.). After compiling the PLC executable program, the host computer compiler records the above control logic characterization information and passes it to the compiler for compiling the comprehensive behavior identification processing program, and compiles it together with the above behavior description information, the above behavior rule list, and the above blocking strategy set to generate a comprehensive behavior identification processing program.

[0025] The PLC internal behavior monitoring system process is as follows Figure 2 As shown, the description is as follows:

[0026] Step 1: Initialize the data monitoring module and behavior analysis module.

[0027] Step 2: Initialize the abnormal behavior rule determination model.

[0028] Step 3, the data monitoring module starts to monitor the changes of the target memory area. The target memory area is the memory running area of ​​the programmable logic controller program. The target memory area is the control logic characterization information passed in by the compiler; all memory areas involved in the characterization information need to obtain an initial value when the data monitoring module and the behavior analysis module are initialized, and then determine whether there is a memory data change in the target memory area (the information in the target memory area is updated). If not, repeat step 3; if yes, proceed to step 4.

[0029] Step 4: The data monitoring module finds that the information in the target memory area is updated, and the data monitoring module transmits the memory update information to the behavior analysis module;

[0030] Step 5: The behavior analysis module obtains memory update information, stores the memory update information in a database (so that subsequent relevant personnel can find the memory update information based on the data recorded in the database), and transmits the memory update information to the abnormal behavior rule determination model;

[0031] Step 6: The abnormal behavior rule determination model retrieves database data information according to predefined rules and performs data preprocessing.

[0032] Step 7: The abnormal behavior rule determination model determines whether the behavior state of the PLC program corresponding to the memory update information is an abnormal state. If so, jump to step 8; if not, jump to step 9;

[0033] Step 8. Step 5. A warning is issued to the maintenance personnel, and the abnormal blocking module issues an alarm or issues an abnormal blocking command to the RTS;

[0034] Step 9: Update the abnormal behavior rule to determine the model status and determine whether the monitoring is completed. If it is completed, the process steps are completed. If not, jump to step 3.

[0035] Among them, the abnormal behavior rule judgment model structure is as follows Figure 3 As shown, the description is as follows:

[0036] The abnormal behavior rule determination model receives memory update information transmitted by the behavior analysis module within a cycle, including an identification variable x, a variable change table containing variable id and variable value, and the current cycle t. The identification variable is to number all variables and arrange them in bits. If the variable changes in this cycle, it corresponds to position 1, and if the variable does not change, it corresponds to position 0. The variable change table only records the variable value and its id that have changed within the cycle t.

[0037] The abnormal behavior rule determination model is provided with a selection rule set (the selection rule set can be in any form of a table, an array, or a key-value pair). Each item in the selection rule set has a rule corresponding to an identification value y and a specific rule. The identification value is obtained by numbering all variables and arranging them in bits. If a variable is involved in this rule, it corresponds to position 1, and if it is not involved, the variable corresponds to position 0.

[0038] During initialization, the behavior acquisition module will pass the initial values ​​of all variables into the abnormal behavior rule determination model. If an abnormal state is entered at this moment, the abnormal blocking module will be directly triggered for processing; the abnormal behavior rule determination model is based on the following assumptions:

[0039] The current anomaly rule determines that the latest variable state stored in the model database is not an abnormal state;

[0040] The abnormal behavior rule determination model receives a memory update message in period t. As long as one of the variables involved in the rule changes, the rule is deemed to match the variable change in the period. The rule corresponding to the identification value y in the rule table is operated with, and if the result is non-zero, the rule is added to the target selection rule set.

[0041] Then, the rules in the target selection rule set are traversed in turn to determine whether the variable violates the rules in the target selection rule set after changing by the corresponding amount, so as to obtain the violation rule set; the processing measures corresponding to the violation rule set are input into the abnormal blocking module, and the abnormal blocking module makes corresponding alarms and subsequent processing.

[0042] In some examples, after determining whether the programmable logic controller program has an exception based on the memory update information, the method further includes: if the programmable logic controller program has an exception, generating an exception message to notify the real-time system so that the real-time system performs exception processing on the programmable logic controller program.

[0043] Specifically, the abnormal blocking module acts as an adapter between the abnormal behavior rule determination model calling function and the RTS execution intervention operation function. It will not directly and arbitrarily interfere with the normal operation of the PLC program, but will give a message notification to let the RTS handle it by itself.

[0044] In some examples, monitoring the target memory area includes: receiving control logic characterization information transmitted by a host computer; determining the target memory area according to the control logic characterization information, and monitoring the target memory area.

[0045] It can be understood that the variables and rules in the target selection rule set are pre-set. Specifically, the steps of defining the target selection rule set are as follows:

[0046] Step S02: define behaviors, extract corresponding feature values ​​according to the characteristics of each behavior, and form corresponding behavior description information.

[0047] Step S02: define rules. Rules are combination judgment rules of feature values ​​in behavior description information. Feature value judgment conditions in various types of behavior description information are combined to form different behavior rules. Different behavior rules are then collected and integrated to form a behavior rule list.

[0048] Step S03: define a strategy. A strategy refers to a combined operation sequence of behavior anomaly blocking operations. Different anomaly blocking operation sequences that are intended to be performed after various anomalies occur are comprehensively collected to form a blocking strategy set.

[0049] Step S04: compile the behavior description information, the behavior rule list, and the blocking strategy set to generate a target selection rule set, thereby enabling the subsequent anomaly identification method to be executed.

[0050] In some examples, the present application will also download and inject the comprehensive abnormality identification method into the controller; then start the controller, initialize the control parameters according to the behavior identification processing program, and establish the behavior identification processing task; during the dynamic operation process, real-time and transparent monitoring of the characteristic information specified in the defined behavior, perform rule matching, and perform corresponding processing according to the strategy.

[0051] Furthermore, system status parameters are formulated for the system behavior, such as PLC execution status, PLC available memory, PLC CPU occupancy and other parameters; network communication parameters are formulated for the network access interaction behavior, such as host computer connection status, host computer operation information, Mobus communication status, communication information and other parameters; variable control parameters are formulated for the control behavior, such as variable modification operation information, variable forced operation information and the like.

[0052] Furthermore, the control parameter storage method is to record the control parameters that change over a period of time, and the historical control parameters can be comprehensively considered in each judgment.

[0053] The present application also provides a PLC system dynamic behavior identification and active defense system based on control parameters, including:

[0054] Data monitoring module, behavior analysis module, internal behavior detection system database, abnormal behavior rule judgment model, abnormal blocking module and PLC main control system.

[0055] The data monitoring module periodically reads a specific memory area of ​​the lower computer. The monitoring memory area is characterized by control logic information transmitted by the upper computer PLC program compiler, which is parsed when the behavior analysis module is initialized and sent to the data monitoring module; the data monitoring module, when the behavior analysis module is initialized, obtains an initial memory state for each monitoring memory area, and transmits the initial memory state to the behavior analysis module. After the behavior module analyzes the memory changes, it transmits the analyzed behavior information to the abnormal behavior rule judgment model that has not yet been initialized for preliminary judgment, returns whether it is an abnormal result and performs corresponding processing; subsequently, the data monitoring module only records the changed memory change information in each monitoring cycle, and imports the behavior information analyzed by the behavior analysis module into the database, and transmits it to the abnormal behavior rule judgment model.

[0056] The PLC abnormal behavior rule judgment model judgment logic includes the following processes: (1) the model receives behavior information; (2) the model performs an initialization state before each behavior rule judgment. If necessary, a batch of values ​​are taken out from the database and initialized; (3) the model determines whether the behavior occurring within the PLC user program cycle is in a previously defined abnormal state. If it is determined to be in compliance, an alarm is sent to the PLC main control system and maintenance personnel or the abnormal blocking module is called; (4) the model returns to process 1.

[0057] The internal behavior detection system database is characterized in that the database not only provides the required historical behavior information before running the abnormal behavior rule determination model in each cycle, but also can export a list of all monitored behavior information within a certain time range for reference and analysis.

[0058] The exception blocking module acts as an adapter between the abnormal behavior rule judgment model calling the exception blocking function and the RTS executing the intervention operation function. It can alarm or issue an exception blocking command to the RTS to operate the PLC program to stop, disconnect, refuse to upload, refuse to write, etc.; RTS must open the corresponding interface for the exception blocking module to send messages.

[0059] In the abnormality identification method provided by this application,.

[0060] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present application, which will not be described one by one here.

[0061] Figure 4 Schematic diagram of an electronic device 4 provided in an embodiment of the present application. Figure 4As shown, the electronic device 4 of this embodiment includes: a processor 401, a memory 402, and a computer program 403 stored in the memory 402 and executable on the processor 401. When the processor 401 executes the computer program 403, the steps in the above-mentioned method embodiments are implemented. Alternatively, when the processor 401 executes the computer program 403, the functions of the modules / units in the above-mentioned device embodiments are implemented.

[0062] The electronic device 4 may be a desktop computer, a notebook, a PDA, a cloud server, or other electronic device. The electronic device 4 may include, but is not limited to, a processor 401 and a memory 402. Those skilled in the art will appreciate that Figure 4 The electronic device 4 is merely an example and does not limit the electronic device 4 , and may include more or less components than those shown in the figure, or different components.

[0063] The processor 401 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0064] The memory 402 may be an internal storage unit of the electronic device 4, for example, a hard disk or memory of the electronic device 4. The memory 402 may also be an external storage device of the electronic device 4, for example, a plug-in hard disk, a smart memory card (Smart Med ia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. equipped on the electronic device 4. The memory 402 may also include both an internal storage unit and an external storage device of the electronic device 4. The memory 402 is used to store computer programs and other programs and data required by the electronic device.

[0065] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0066] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, and the computer program code may be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of regional requirements and patent practice. For example, in some areas, according to regional requirements and patent practice, the computer-readable medium does not include electric carrier signals and telecommunication signals.

[0067] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for identifying anomalies, characterized in that: The method comprises: Monitoring a target memory area, wherein the target memory area is a memory running area of ​​a programmable logic controller program; If the information update in the target memory area is monitored, the memory update information is obtained; Determine whether the programmable logic controller program has an abnormality based on the memory update information.

2. The method according to claim 1, characterized in that The memory update information includes: at least one variable identifier and a change amount corresponding to each variable identifier; determining whether the programmable logic controller program is abnormal based on the memory update information includes: Determine a target selection rule set from the selection rule set according to the variable identifier; Determine a verification result of the variable identifier according to the change amount corresponding to the variable identifier and the target selection rule set, wherein the verification result is used to determine whether the variable identifier has an abnormality; Determine whether the programmable logic controller program corresponding to the variable identifier has an abnormality according to the verification result.

3. The method according to claim 1, characterized in that The selection rule set includes rules corresponding to the identification value and the marking value; Determining a target selection rule set from a selection rule set according to the variable identifier includes: Match each of the variable identifiers with the identifier values ​​included in the selection rule set one by one to obtain a target identifier value; The target selection rule set is generated according to the rules corresponding to the target identification value and the target marking value.

4. The method according to claim 1, characterized in that Determining a verification result of the variable identifier according to the change amount corresponding to the variable identifier and the target selection rule set includes: Determine a rule corresponding to the change amount corresponding to the variable identifier from the target selection rule set; Determine whether the change amount corresponding to the variable identification matches the determined rule. If the change amount corresponding to the variable identification fails to match the determined rule, determine that the verification result of the variable identification is abnormal.

5. The method according to claim 1, characterized in that After determining whether the programmable logic controller program is abnormal based on the memory update information, the method further includes: When an exception occurs in the programmable logic controller program, an exception message is generated and notified to the real-time system, so that the real-time system performs exception processing on the programmable logic controller program.

6. The method according to claim 1, characterized in that Monitor the target memory area, including: Receive control logic representation information transmitted by the host computer; The target memory area is determined according to the control logic characterization information, and the target memory area is monitored.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images