Method for constructing protocol chain based on industrial control scene, protocol deep analysis clustering method and protocol deep analysis clustering device

Abstract

The invention provides a method for constructing a protocol chain based on an industrial control scene, and a protocol deep analysis clustering method and device, and relates to the technical field of data analysis. According to the invention, the protocol chain is constructed in the preset industrial control scene, the traffic analysis and traffic learning are combined, the industrial control data traffic is analyzed and clustered, the service scene and the service behavior are analyzed, the behavior of the industrial control scene is expressed in a natural language form and whether the behavior accords with a normal state or not, and an efficient industrial control protocol chain network is constructed. The deep analysis capability and efficiency are improved, and the accuracy and hit rate are improved.

Description

Technical Field

[0001] The present invention relates to the field of data analysis technology, and in particular to a method for building a protocol chain based on an industrial control scenario, a protocol deep analysis and clustering method, and a protocol deep analysis and clustering device. Background Art

[0002] In industrial control systems, industrial control services need to be parsed. Before the existing network data parsing devices are put into operation, operation and maintenance personnel often need to manually configure and maintain the parsing strategy. Take the configuration of the industrial control data cleaning system as an example:

[0003] First, it is necessary to investigate the inherent data communication conditions in the industrial control network and configure corresponding transport layer parsing strategies to facilitate cleaning.

[0004] The second is to investigate the application layer policies. The operation and maintenance personnel need to investigate the operations performed by the industrial control software on the controller and configure corresponding policies.

[0005] The third is the configuration of anti-attack strategies. Due to the lack of reference for threshold configuration, only the default threshold configuration can be used.

[0006] For industrial control business analysis, the existing network security analysis device will automatically generate some analysis behaviors through data packet analysis before the equipment is put into operation to assist manual configuration. Take the industrial control security system configuration as an example:

[0007] The first is to analyze the transport layer information of the data packet and configure the corresponding transport layer parsing strategy.

[0008] The second is to analyze the application layer information of the data packet and configure the corresponding strategy.

[0009] The third is to analyze the flow of data packets and configure corresponding anti-attack strategies.

[0010] It can be seen that the current industrial control business analysis requires manual assistance and cannot be automatically analyzed. The methods of different systems are also different and there is no universality, let alone automatic early warning. Summary of the invention

[0011] The purpose of the present invention is to propose a protocol deep analysis and clustering method for building a protocol chain based on an industrial control scenario, aiming to solve the problem that the existing technology requires manual assistance for industrial control business analysis and cannot be automatically analyzed. The methods of different systems are also different, and there is no universality, and automatic early warning cannot be performed. A universal method is provided for various urban industrial control systems, such as water, transportation, and gas industrial control systems, which can achieve efficient analysis and more accurate analysis.

[0012] The present invention provides a method for constructing a protocol chain based on an industrial control scenario, comprising the following steps:

[0013] Implement preset industrial control behaviors in preset industrial control scenarios;

[0014] The protocol features are learned under the preset industrial control behavior to obtain the industrial control features that express the industrial control behavior;

[0015] Construct an industrial control protocol chain consisting of horizontal chains and vertical chains. The nodes of the vertical chain are industrial control behaviors, and the nodes of the horizontal chain are based on protocol features and represent industrial control features.

[0016] Preferably, the cross link includes one node or multiple nodes.

[0017] Preferably, the architecture of the vertical chain includes industrial control behavior, the number of horizontal chain nodes, the frequency of occurrence of industrial control behavior, and the hash value of industrial control behavior, the number of horizontal chain nodes, and the frequency of occurrence of industrial control behavior.

[0018] Preferably, the horizontal chain includes features for identifying an industrial control behavior, including industrial control source features, industrial control target features, industrial control operation value features, industrial control operation time features, and industrial control operation frequency features.

[0019] Preferably, the method specifically comprises the following steps:

[0020] Step S101: Investigate the industrial control behaviors in the preset industrial control scenarios, confirm and bind the operation instructions of the industrial control behaviors with the corresponding function codes, and convert the investigation results into industrial control behavior features, wherein the specific industrial control operations of the industrial control behaviors are mapped to the operation instructions received by the industrial control devices, and the digital expression value of the operation instructions is the industrial control operation function code;

[0021] Step S102: Investigate the operators and recipients of the industrial control operations in the preset industrial control scenario, where the operator is the end sending the instruction and the recipient is the end receiving the instruction, record the operator IP address and the recipient IP address of the instruction, obtain the industrial control source IP address and the industrial control target IP address, convert the investigation results into industrial control source features and industrial control target features, and bind them with the industrial control operation;

[0022] Step S103: investigating the sending time of the industrial control operation instructions in the preset industrial control scenario, recording the time, and converting the investigation result into the industrial control operation time feature, and binding it with the industrial control operation;

[0023] Step S104: investigating the numerical values ​​of the industrial control operations in the preset industrial control scenarios, recording the numerical values, converting the investigation results into numerical features of the industrial control operations, and binding them with the industrial control operations;

[0024] Step S105: investigating the frequency of industrial control behaviors in a preset industrial control scenario, converting the investigation results into industrial control operation frequency features, and binding them with the industrial control operations;

[0025] Step S106: The vertical chain of the protocol chain is composed of industrial control behavior characteristics. Each node on the vertical chain corresponds to an industrial control operation, and the industrial control behavior can be expressed and classified in natural language. A complete vertical protocol chain can express a complete industrial control behavior. The architecture type of each node in the vertical chain is [ACT / NUM / SUL1 / HASH], wherein ACT is the function code of the industrial control operation, NUM is the number of horizontal chain nodes, SUL1 is the industrial control behavior frequency, and HASH is the hash calculation value of ACT, NUM, and SUL. The horizontal chain of the protocol chain is then formed by combining the industrial control source characteristics, the industrial control target characteristics, the industrial control operation numerical characteristics, and the industrial control operation time characteristics to form an industrial control protocol chain.

[0026] The present invention provides a protocol deep parsing clustering method for constructing a protocol chain based on an industrial control scenario, comprising the following steps:

[0027] Stores traffic data in all preset industrial control scenarios;

[0028] Cut the stored traffic data;

[0029] Analyze the flow data, extract the flow information and learn the flow information, and then extract the industrial control source characteristics, industrial control target characteristics, industrial control numerical characteristics, and industrial control time characteristics;

[0030] Based on the extracted industrial control source features, industrial control target features, industrial control operation numerical features, industrial control operation time features and industrial control operation frequency features, a protocol chain is constructed using the above-mentioned method for constructing a protocol chain based on an industrial control scenario;

[0031] Perform traffic learning and traffic screening on the cut traffic data, and cluster the traffic.

[0032] Preferably, for all the flow data flowing through the preset industrial control behavior, the industrial control scene is matched by cutting the flow data of the preset industrial control behavior and learning the flow data to obtain the industrial control characteristics of the preset industrial control behavior.

[0033] Preferably, industrial control scene matching specifically includes the following steps:

[0034] S200: learning a preset industrial control behavior in a preset industrial control scenario, enabling the preset industrial control behavior in the preset industrial control scenario, and starting learning;

[0035] S201: Collect all data packets generated after the preset industrial control behavior is enabled, parse the transport layer information and application layer information of the data packets, extract relevant information, including the industrial control source IP address, industrial control target IP address, industrial control operation function code, industrial control operation value, industrial control operation time of the data packets, and record them into the database;

[0036] S202: The collected data is not blocked but directly stored in the database, and then the next data packet is collected and analyzed;

[0037] S203: Mark the collected preset industrial control behaviors, record the industrial control features, start learning the next preset industrial control behavior, repeat steps S200-S201 until all preset industrial control behaviors are learned, and all preset industrial control behaviors are started according to the execution order in the preset industrial control scenario;

[0038] S204: cutting the data in the database into industrial control source characteristic values, industrial control target characteristic values, industrial control function characteristic values, and industrial control time characteristic values, and performing statistics and classified storage, and then generating industrial control frequency characteristic values ​​according to the statistical industrial control function characteristics and industrial control time characteristics;

[0039] S205: According to the industrial control source characteristic value, industrial control target characteristic value, industrial control function characteristic value, industrial control time characteristic value, and industrial control frequency characteristic value obtained in step S204, a protocol chain and a protocol library are constructed using the above-mentioned method for constructing a protocol chain based on an industrial control scenario, and clustering is performed.

[0040] Preferably, step S205 specifically includes the following steps:

[0041] S2051: extract the industrial control operation feature data, record the function code ACT value of the industrial control operation, and count the number of ACTs within a preset time to generate the industrial control behavior frequency SUL1 value, and calculate the number of horizontal chain nodes NUM value cumulatively through the corresponding industrial control features bound to ACT, and form the first node of the vertical chain [ACT / NUM / SUL / HASH] through the hash calculation value HASH of ACT, NUM, and SUL1 values;

[0042] S2052: extract the industrial control source features corresponding to the industrial control operation, and form an industrial control source node of the horizontal chain of [VAL / SUL2 / FLAG] type features, where VAL represents the industrial control source IP address corresponding to the industrial control source feature, SUL2 represents the number of times the industrial control source IP address appears in the industrial control behavior within a preset time, and FLAG represents that the node is recorded and connected. When the node of the horizontal chain is connected to the node of the vertical chain, FLAG represents 1. If the node of the horizontal chain is not connected to the node of the vertical chain, FLAG represents 0. At this point, the first node of the first vertical chain is generated, and then the industrial control target features, industrial control numerical features, and industrial control time features are extracted in sequence to form the first node of the horizontal chain connected to the first node of the vertical chain;

[0043] S2053: In the same manner as step S2052, extract the industrial control target features, form an industrial control target node of the horizontal chain of [VAL / SUL2 / FLAG] type features, connect it after the industrial control source node, and form the second node of the horizontal chain connected to the first node of the vertical chain;

[0044] S2054: Extract the industrial control operation time feature, divide 24 hours into multiple time periods, if the industrial control time belongs to a certain time period, then the number of times in the corresponding time period is counted + 1, the quantity value is HX[n], and the industrial control time feature node [H1 / H2 / ...HN / FLAG] is established, the value of H1 is H1[n], the value of H2 is H2[n], and so on, N is the total number of time periods, and the function node is connected to the corresponding industrial control target node to form the third node of the horizontal chain connected to the first node of the vertical chain;

[0045] S2055: extracting the numerical feature of the industrial control operation, which should match the industrial control operation. If there are multiple industrial control operations, there will be multiple industrial control values. Then take the minimum and maximum values ​​of the industrial control values ​​to form an industrial control value node of type [MIN / MAX / FLAG]. MIN indicates the minimum industrial control value that occurs, MAX indicates the maximum industrial control value that occurs, and FLAG indicates that the node is recorded and connected. The industrial control value node is grafted onto the corresponding industrial control time node to form the fourth node of the horizontal chain connected to the first node of the vertical chain.

[0046] S2055: If the industrial control behavior requires more than one industrial control controller to assist, but requires multiple industrial control operations, repeat steps S2052 to S2054 to construct the next node of the protocol longitudinal chain until all controller nodes of the industrial control behavior are recorded and imported to form a complete industrial control behavior protocol chain;

[0047] S2056: Classify based on industrial control behavior, express unknown data into describable industrial control behavior in natural language, and an industrial control protocol chain is a complete industrial control behavior category, so as to perform clustering;

[0048] S2057: The protocol chain is constructed. By investigating the industrial control traffic in the industrial environment, the data of the protocol chain is matched to determine whether it is the industrial control behavior, and whether the industrial control operation time, industrial control operation frequency, and industrial control operation value meet the standards defined by the protocol chain.

[0049] The present invention provides a protocol deep analysis and clustering device for building a protocol chain based on an industrial control scenario, comprising:

[0050] A flow storage unit is used to store the passing flow to form a flow reservoir;

[0051] A cutting unit cuts the stored flow data;

[0052] The flow learning unit extracts flow information by analyzing the cut flow data, and extracts industrial control source features, industrial control target features, industrial control numerical features, and industrial control time features;

[0053] The protocol chain unit uses the above method to build the protocol horizontal and vertical chains;

[0054] The clustering unit clusters and distinguishes the industrial control feature data in the protocol chain.

[0055] Preferably, the workflow of the protocol deep analysis clustering device for building a protocol chain based on an industrial control scenario includes the following steps:

[0056] Step S220: Enter the simulation environment of the preset industrial control scenario to learn the industrial control features of the preset industrial control behavior. After the industrial control feature learning is completed and the protocol chain is built, choose to enable or disable protection.

[0057] Step S221: collecting data packets that have passed through the protocol deep analysis clustering device, performing traffic analysis, and obtaining industrial control behavior data;

[0058] Step S223: Screen the protocol chain of the traffic data packet passing through. If it matches, it is a hit and is determined to be the industrial control behavior. If it does not match, it is a miss and the traffic data packet enters the waiting area and is discarded or retained according to whether protection is turned on.

[0059] Step S224: The traffic data packet enters the clustering unit, the data traffic is classified and clustered, different types of data are generated, and matched with the FLAG in the protocol chain. If protection is not enabled, the data is stored and displayed according to the classification. If protection is enabled, the data is screened according to the classification.

[0060] Step S225: Continue matching with the protocol vertical chain, and if the traffic has abnormal behavior that does not comply with the protocol, a warning will be issued;

[0061] Step S226: Repeat steps S221-S225.

[0062] Compared with the prior art, the present invention has the following beneficial effects:

[0063] The present invention provides a method for constructing a protocol chain based on an industrial control scenario, and also provides a novel method and device for deep protocol analysis and clustering. The method constructs a protocol chain in a preset industrial control scenario, combines traffic analysis and traffic learning, parses and clusters the industrial control data traffic, analyzes business scenarios and business behaviors, and expresses in natural language what kind of behavior the industrial control scenario has performed and whether it conforms to the normal state. An efficient industrial control protocol chain network is constructed, the deep analysis capability and efficiency are improved, and the accuracy and hit rate are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0065] Figure 1 The present invention is a flowchart of a method for building a protocol chain based on an industrial control scenario according to an embodiment of the present invention.

[0066] Figure 2 This is a flowchart of a method for building a protocol chain based on an industrial control scenario according to yet another embodiment of the present invention.

[0067] Figure 3 This is a flow chart of a protocol deep analysis and clustering method for building a protocol chain based on an industrial control scenario according to an embodiment of the present invention. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0069] The present invention provides a method for constructing a protocol chain based on an industrial control scenario, comprising the following steps:

[0070] Implement preset industrial control behaviors in preset industrial control scenarios;

[0071] The protocol features are learned under the preset industrial control behavior to obtain the industrial control features that express the industrial control behavior;

[0072] Construct an industrial control protocol chain consisting of horizontal chains and vertical chains. The nodes of the vertical chain are industrial control behaviors, and the nodes of the horizontal chain are based on protocol features and represent industrial control features.

[0073] According to a specific embodiment of the present invention, the cross link includes one node or multiple nodes.

[0074] According to a specific embodiment of the present invention, the architecture of the vertical chain includes industrial control behavior, the number of horizontal chain nodes, the frequency of occurrence of industrial control behavior, and the hash value of industrial control behavior, the number of horizontal chain nodes, and the frequency of occurrence of industrial control behavior.

[0075] According to a specific embodiment of the present invention, the horizontal chain includes features for identifying an industrial control behavior, including industrial control source features, industrial control target features, industrial control operation value features, industrial control operation time features, and industrial control operation frequency features.

[0076] According to a specific embodiment of the present invention, the steps are as follows:

[0077] Step S101: Investigate the industrial control behaviors in the preset industrial control scenarios, confirm and bind the operation instructions of the industrial control behaviors with the corresponding function codes, and convert the investigation results into industrial control behavior features, wherein the specific industrial control operations of the industrial control behaviors are mapped to the operation instructions received by the industrial control devices, and the digital expression value of the operation instructions is the industrial control operation function code;

[0078] Step S102: Investigate the operators and recipients of the industrial control operations in the preset industrial control scenario, where the operator is the end sending the instruction and the recipient is the end receiving the instruction, record the operator IP address and the recipient IP address of the instruction, obtain the industrial control source IP address and the industrial control target IP address, convert the investigation results into industrial control source features and industrial control target features, and bind them with the industrial control operation;

[0079] Step S103: investigating the sending time of the industrial control operation instructions in the preset industrial control scenario, recording the time, and converting the investigation result into the industrial control operation time feature, and binding it with the industrial control operation;

[0080] Step S104: investigating the numerical values ​​of the industrial control operations in the preset industrial control scenarios, recording the numerical values, converting the investigation results into numerical features of the industrial control operations, and binding them with the industrial control operations;

[0081] Step S105: investigating the frequency of industrial control behaviors in a preset industrial control scenario, converting the investigation results into industrial control operation frequency features, and binding them with the industrial control operations;

[0082] Step S106: The vertical chain of the protocol chain is composed of industrial control behavior characteristics. Each node on the vertical chain corresponds to an industrial control operation, and the industrial control behavior can be expressed and classified in natural language. A complete vertical protocol chain can express a complete industrial control behavior. The architecture type of each node in the vertical chain is [ACT / NUM / SUL1 / HASH], wherein ACT is the function code of the industrial control operation, NUM is the number of horizontal chain nodes, SUL1 is the industrial control behavior frequency, and HASH is the hash calculation value of ACT, NUM, and SUL. The horizontal chain of the protocol chain is then formed by combining the industrial control source characteristics, the industrial control target characteristics, the industrial control operation numerical characteristics, and the industrial control operation time characteristics to form an industrial control protocol chain.

[0083] The present invention provides a protocol deep parsing clustering method for constructing a protocol chain based on an industrial control scenario, comprising the following steps:

[0084] Stores traffic data in all preset industrial control scenarios;

[0085] Cut the stored traffic data;

[0086] Analyze the flow data, extract the flow information and learn the flow information, and then extract the industrial control source characteristics, industrial control target characteristics, industrial control numerical characteristics, and industrial control time characteristics;

[0087] Based on the extracted industrial control source features, industrial control target features, industrial control operation numerical features, industrial control operation time features and industrial control operation frequency features, a protocol chain is constructed using the above-mentioned method for constructing a protocol chain based on an industrial control scenario;

[0088] Perform traffic learning and traffic screening on the cut traffic data, and cluster the traffic.

[0089] According to a specific implementation scheme of the present invention, for all the flow data passing through the preset industrial control behavior, the industrial control scene is matched by cutting the flow data of the preset industrial control behavior and learning the flow data to obtain the industrial control characteristics of the preset industrial control behavior.

[0090] According to a specific implementation scheme of the present invention, industrial control scene matching specifically includes the following steps:

[0091] S200: learning a preset industrial control behavior in a preset industrial control scenario, enabling the preset industrial control behavior in the preset industrial control scenario, and starting learning;

[0092] S201: Collect all data packets generated after the preset industrial control behavior is enabled, parse the transport layer information and application layer information of the data packets, extract relevant information, including the industrial control source IP address, industrial control target IP address, industrial control operation function code, industrial control operation value, industrial control operation time of the data packets, and record them into the database;

[0093] S202: The collected data is not blocked but directly stored in the database, and then the next data packet is collected and analyzed;

[0094] S203: Mark the collected preset industrial control behaviors, record the industrial control features, start learning the next preset industrial control behavior, repeat steps S200-S201 until all preset industrial control behaviors are learned, and all preset industrial control behaviors are started according to the execution order in the preset industrial control scenario;

[0095] S204: cutting the data in the database into industrial control source characteristic values, industrial control target characteristic values, industrial control function characteristic values, and industrial control time characteristic values, and performing statistics and classified storage, and then generating industrial control frequency characteristic values ​​according to the statistical industrial control function characteristics and industrial control time characteristics;

[0096] S205: According to the industrial control source characteristic value, industrial control target characteristic value, industrial control function characteristic value, industrial control time characteristic value, and industrial control frequency characteristic value obtained in step S204, a protocol chain and a protocol library are constructed using the above-mentioned method for constructing a protocol chain based on an industrial control scenario, and clustering is performed.

[0097] According to a specific embodiment of the present invention, step S205 specifically includes the following steps:

[0098] S2051: extract the industrial control operation feature data, record the function code ACT value of the industrial control operation, and count the number of ACTs within a preset time to generate the industrial control behavior frequency SUL1 value, and calculate the number of horizontal chain nodes NUM value cumulatively through the corresponding industrial control features bound to ACT, and form the first node of the vertical chain [ACT / NUM / SUL / HASH] through the hash calculation value HASH of ACT, NUM, and SUL1 values;

[0099] S2052: extract the industrial control source features corresponding to the industrial control operation, and form an industrial control source node of the horizontal chain of [VAL / SUL2 / FLAG] type features, where VAL represents the industrial control source IP address corresponding to the industrial control source feature, SUL2 represents the number of times the industrial control source IP address appears in the industrial control behavior within a preset time, and FLAG represents that the node is recorded and connected. When the node of the horizontal chain is connected to the node of the vertical chain, FLAG represents 1. If the node of the horizontal chain is not connected to the node of the vertical chain, FLAG represents 0. At this point, the first node of the first vertical chain is generated, and then the industrial control target features, industrial control numerical features, and industrial control time features are extracted in sequence to form the first node of the horizontal chain connected to the first node of the vertical chain;

[0100] S2053: In the same manner as step S2052, extract the industrial control target features, form an industrial control target node of the horizontal chain of [VAL / SUL2 / FLAG] type features, connect it after the industrial control source node, and form the second node of the horizontal chain connected to the first node of the vertical chain;

[0101] S2054: Extract the industrial control operation time feature, divide 24 hours into multiple time periods, if the industrial control time belongs to a certain time period, then the number of times in the corresponding time period is counted + 1, the quantity value is HX[n], and the industrial control time feature node [H1 / H2 / ...HN / FLAG] is established, the value of H1 is H1[n], the value of H2 is H2[n], and so on, N is the total number of time periods, and the function node is connected to the corresponding industrial control target node to form the third node of the horizontal chain connected to the first node of the vertical chain;

[0102] S2055: extracting the numerical feature of the industrial control operation, which should match the industrial control operation. If there are multiple industrial control operations, there will be multiple industrial control values. Then take the minimum and maximum values ​​of the industrial control values ​​to form an industrial control value node of type [MIN / MAX / FLAG]. MIN indicates the minimum industrial control value that occurs, MAX indicates the maximum industrial control value that occurs, and FLAG indicates that the node is recorded and connected. The industrial control value node is grafted onto the corresponding industrial control time node to form the fourth node of the horizontal chain connected to the first node of the vertical chain.

[0103] S2055: If the industrial control behavior requires more than one industrial control controller to assist, but requires multiple industrial control operations, repeat steps S2052 to S2054 to construct the next node of the protocol longitudinal chain until all controller nodes of the industrial control behavior are recorded and imported to form a complete industrial control behavior protocol chain;

[0104] S2056: Classify based on industrial control behavior, express unknown data into describable industrial control behavior in natural language, and an industrial control protocol chain is a complete industrial control behavior category, so as to perform clustering;

[0105] S2057: The protocol chain is constructed. By investigating the industrial control traffic in the industrial environment, the data of the protocol chain is matched to determine whether it is the industrial control behavior, and whether the industrial control operation time, industrial control operation frequency, and industrial control operation value meet the standards defined by the protocol chain.

[0106] The present invention provides a protocol deep analysis and clustering device for building a protocol chain based on an industrial control scenario, comprising:

[0107] A flow storage unit is used to store the passing flow to form a flow reservoir;

[0108] A cutting unit cuts the stored flow data;

[0109] The flow learning unit extracts flow information by analyzing the cut flow data, and extracts industrial control source features, industrial control target features, industrial control numerical features, and industrial control time features;

[0110] The protocol chain unit uses the above method to build the protocol horizontal and vertical chains;

[0111] The clustering unit clusters and distinguishes the industrial control feature data in the protocol chain.

[0112] According to a specific embodiment of the present invention, the workflow of the protocol deep analysis clustering device for building a protocol chain based on an industrial control scenario includes the following steps:

[0113] Step S220: Enter the simulation environment of the preset industrial control scenario to learn the industrial control features of the preset industrial control behavior. After the industrial control feature learning is completed and the protocol chain is built, choose to enable or disable protection.

[0114] Step S221: collecting data packets that have passed through the protocol deep analysis clustering device, performing traffic analysis, and obtaining industrial control behavior data;

[0115] Step S223: Screen the protocol chain of the traffic data packet passing through. If it matches, it is a hit and is determined to be the industrial control behavior. If it does not match, it is a miss and the traffic data packet enters the waiting area and is discarded or retained according to whether protection is turned on.

[0116] Step S224: The traffic data packet enters the clustering unit, the data traffic is classified and clustered, different types of data are generated, and matched with the FLAG in the protocol chain. If protection is not enabled, the data is stored and displayed according to the classification. If protection is enabled, the data is screened according to the classification.

[0117] Step S225: Continue matching with the protocol vertical chain, and if the traffic has abnormal behavior that does not comply with the protocol, a warning will be issued;

[0118] Step S226: Repeat steps S221-S225.

[0119] Example 1

[0120] The present invention provides a method for constructing a protocol chain based on an industrial control scenario, comprising the following steps:

[0121] Implement preset industrial control behaviors in preset industrial control scenarios;

[0122] The protocol features are learned under the preset industrial control behavior to obtain the industrial control features that express the industrial control behavior;

[0123] Construct an industrial control protocol chain consisting of horizontal chains and vertical chains. The nodes of the vertical chain are industrial control behaviors, and the nodes of the horizontal chain are based on protocol features and represent industrial control features.

[0124] Example 2

[0125] The present invention provides a method for constructing a protocol chain based on an industrial control scenario, comprising the following steps:

[0126] Implement preset industrial control behaviors in preset industrial control scenarios;

[0127] The protocol features are learned under the preset industrial control behavior to obtain the industrial control features that express the industrial control behavior;

[0128] Construct an industrial control protocol chain consisting of horizontal chains and vertical chains. The nodes of the vertical chain are industrial control behaviors, and the nodes of the horizontal chain are based on protocol features and represent industrial control features.

[0129] Among them, the horizontal chain includes one node or multiple nodes.

[0130] Furthermore, the architecture of the vertical chain includes industrial control behavior, the number of horizontal chain nodes, the frequency of occurrence of industrial control behavior, and the hash value of industrial control behavior, the number of horizontal chain nodes, and the frequency of occurrence of industrial control behavior.

[0131] Furthermore, the horizontal chain includes features for identifying an industrial control behavior, including industrial control source features, industrial control target features, industrial control operation value features, industrial control operation time features, and industrial control operation frequency features.

[0132] Furthermore, the method specifically includes the following steps:

[0133] Step S101: Investigate the industrial control behaviors in the preset industrial control scenarios, such as the water purification behaviors of a certain plant station, including the combination of filtration, disinfection, detection, drainage and other behaviors. This series of behaviors is called industrial control behavior, and each specific action of the industrial control behavior can be mapped to the instruction operation received by the industrial control equipment, including reading, writing, control, etc. The digital expression value of these instruction behaviors is called the industrial control operation function code, and the combination of all these instruction collections will form a complete industrial control behavior. Since these instructions are all preset, the instructions are confirmed and bound to the corresponding function codes. The function code is the industrial control operation, and the combination of industrial control operations is the industrial control behavior (the industrial control behavior may be a single industrial control operation, or it may include multiple industrial control operations, which is determined according to the actual situation), and the survey results are converted into industrial control behavior characteristics;

[0134] Step S102: Investigate the operators and recipients of the industrial control operations in the preset industrial control scenario. The operator sends instructions (industrial control operations) and the recipient receives instructions. The operator IP address and the recipient IP address of the corresponding instructions are recorded to obtain the industrial control source IP and the industrial control destination IP. The investigation results are converted into industrial control source features and industrial control destination features, and bound to the industrial control operations.

[0135] Step S103: Investigate the industrial control time characteristics in the preset industrial control scenario, that is, when the instruction was sent (accurate to seconds), record the time, and convert the investigation results into industrial control time characteristics, and bind them to the industrial control operation.

[0136] Step S104: Investigate the numerical characteristics of the industrial control operations in the preset industrial control scenarios, that is, what is the numerical value issued by the instruction. For example, a certain pressurizing equipment needs to be pressurized, and the pressure to which it is pressurized is the industrial control operation value. Record the value, convert the investigation results into the numerical characteristics of the industrial control operation, and bind them to the industrial control operation.

[0137] Step S105: Investigate the industrial control frequency characteristics in the preset industrial control scenario. The number of times the industrial control behavior occurs in a certain period of time is the industrial control operation frequency. Convert the survey results into industrial control operation frequency characteristics and bind them to the industrial control operation.

[0138] Step S106: The vertical chain of the protocol chain is composed of industrial control behavior characteristics. Each node on the vertical chain is an industrial control operation, and the industrial control behavior can be expressed and classified in natural language. A complete vertical chain of the protocol can be expressed as a complete industrial control behavior (vertical chain means industrial control behavior). The architecture type of each node in the vertical chain is [ACT / NUM / SUL / HASH], where ACT is the industrial control operation, NUM is the number of horizontal chain nodes, SUL is the industrial control behavior frequency, and HASH is the hash value (the hash calculation value of ACT, NUM, and SUL). The industrial control source characteristics, industrial control target characteristics, industrial control operation numerical characteristics, and industrial control operation time characteristics are combined to form a horizontal chain of the protocol chain to form an industrial control protocol chain.

[0139] Example 3

[0140] The present invention provides a protocol deep parsing clustering method for constructing a protocol chain based on an industrial control scenario, comprising the following steps:

[0141] Stores traffic data in all preset industrial control scenarios;

[0142] Cut the stored traffic data;

[0143] Analyze the flow data, extract the flow information and learn the flow information, and then extract the industrial control source characteristics, industrial control target characteristics, industrial control numerical characteristics, and industrial control time characteristics;

[0144] Based on the extracted industrial control source features, industrial control target features, industrial control operation numerical features, industrial control operation time features and industrial control operation frequency features, a protocol chain is constructed using the above-mentioned method for constructing a protocol chain based on an industrial control scenario;

[0145] Perform traffic learning and traffic screening on the cut traffic data, and cluster the traffic.

[0146] According to a specific implementation scheme of the present invention, for all the flow data passing through the preset industrial control behavior, the industrial control scene is matched by cutting the flow data of the preset industrial control behavior and learning the flow data to obtain the industrial control characteristics of the preset industrial control behavior.

[0147] Furthermore, industrial control scene matching specifically includes the following steps:

[0148] S200: learning a preset industrial control behavior in a preset industrial control scenario, enabling the preset industrial control behavior in the preset industrial control scenario, and starting learning;

[0149] S201: Collect all data packets generated after the preset industrial control behavior is enabled, parse the transport layer information and application layer information of the data packets, extract relevant information, including the industrial control source IP address, industrial control target IP address, industrial control operation function code, industrial control operation value, industrial control operation time of the data packets, and record them into the database;

[0150] S202: The collected data is not blocked but directly stored in the database, and then the next data packet is collected and analyzed;

[0151] S203: Mark the collected preset industrial control behaviors, record the industrial control features, start learning the next preset industrial control behavior, repeat steps S200-S201 until all preset industrial control behaviors are learned, and all preset industrial control behaviors are started according to the execution order in the preset industrial control scenario;

[0152] S204: cutting the data in the database into industrial control source characteristic values, industrial control target characteristic values, industrial control function characteristic values, and industrial control time characteristic values, and performing statistics and classified storage, and then generating industrial control frequency characteristic values ​​according to the statistical industrial control function characteristics and industrial control time characteristics;

[0153] S205: According to the industrial control source characteristic value, industrial control target characteristic value, industrial control function characteristic value, industrial control time characteristic value, and industrial control frequency characteristic value obtained in step S204, a protocol chain and a protocol library are constructed using the above-mentioned method for constructing a protocol chain based on an industrial control scenario, and clustering is performed.

[0154] Further, step S205 specifically includes the following steps:

[0155] S2051: extract the industrial control operation feature data, record the function code ACT value of the industrial control operation, and count the number of ACTs within a preset time to generate the industrial control behavior frequency SUL1 value, and calculate the number of horizontal chain nodes NUM value cumulatively through the corresponding industrial control features bound to ACT, and form the first node of the vertical chain [ACT / NUM / SUL / HASH] through the hash calculation value HASH of ACT, NUM, and SUL1 values;

[0156] S2052: extract the industrial control source features corresponding to the industrial control operation, and form an industrial control source node of the horizontal chain of [VAL / SUL2 / FLAG] type features, where VAL represents the industrial control source IP address corresponding to the industrial control source feature, SUL2 represents the number of times the industrial control source IP address appears in the industrial control behavior within a preset time, and FLAG represents that the node is recorded and connected. When the node of the horizontal chain is connected to the node of the vertical chain, FLAG represents 1. If the node of the horizontal chain is not connected to the node of the vertical chain, FLAG represents 0. At this point, the first node of the first vertical chain is generated, and then the industrial control target features, industrial control numerical features, and industrial control time features are extracted in sequence to form the first node of the horizontal chain connected to the first node of the vertical chain;

[0157] S2053: In the same manner as step S2052, extract the industrial control target features, form an industrial control target node of the horizontal chain of [VAL / SUL2 / FLAG] type features, connect it after the industrial control source node, and form the second node of the horizontal chain connected to the first node of the vertical chain;

[0158] S2054: Extract the industrial control operation time feature, divide 24 hours into 4 time periods: 0-6, 6-12, 12-18, 18-24, marked as H1, H2, H3, H4. If the industrial control time belongs to a certain time period, the number of times in the corresponding time period is counted + 1, and the quantity value is HX[n]. Build the industrial control time feature node [H1 / H2 / H3 / H4 / FLAG], the value of H1 is H1[n], the value of H2 is H2[n], and so on. Connect the function node to the corresponding industrial control target node to form the third node of the horizontal chain connected to the first node of the vertical chain.

[0159] S2055: extracting the numerical feature of the industrial control operation, which should match the industrial control operation. If there are multiple industrial control operations, there will be multiple industrial control values. Then take the minimum and maximum values ​​of the industrial control values ​​to form an industrial control value node of type [MIN / MAX / FLAG]. MIN indicates the minimum industrial control value that occurs, MAX indicates the maximum industrial control value that occurs, and FLAG indicates that the node is recorded and connected. The industrial control value node is grafted onto the corresponding industrial control time node to form the fourth node of the horizontal chain connected to the first node of the vertical chain.

[0160] S2055: If the industrial control behavior requires more than one industrial control controller to assist, but requires multiple industrial control operations, repeat steps S2052 to S2054 to construct the next node of the protocol longitudinal chain until all controller nodes of the industrial control behavior are recorded and imported to form a complete industrial control behavior protocol chain;

[0161] S2056: Classify based on industrial control behavior, express unknown data into describable industrial control behavior in natural language, and an industrial control protocol chain is a complete industrial control behavior category, so as to perform clustering;

[0162] S2057: The protocol chain is constructed. By investigating the industrial control traffic in the industrial environment, the data of the protocol chain is matched to determine whether it is the industrial control behavior, and whether the industrial control operation time, industrial control operation frequency, and industrial control operation value meet the standards defined by the protocol chain.

[0163] Example 4

[0164] The present invention provides a protocol deep analysis and clustering device for building a protocol chain based on an industrial control scenario, comprising:

[0165] A flow storage unit is used to store the passing flow to form a flow reservoir;

[0166] A cutting unit cuts the stored flow data;

[0167] The flow learning unit extracts flow information by analyzing the cut flow data, and extracts industrial control source features, industrial control target features, industrial control numerical features, and industrial control time features;

[0168] The protocol chain unit uses the above method to build the protocol horizontal and vertical chains;

[0169] The clustering unit clusters and distinguishes the industrial control feature data in the protocol chain.

[0170] Furthermore, the workflow of the protocol deep analysis clustering device for constructing a protocol chain based on an industrial control scenario includes the following steps:

[0171] Step S220: Enter the simulation environment of the preset industrial control scenario to learn the industrial control features of the preset industrial control behavior. After the industrial control feature learning is completed and the protocol chain is built, choose to enable or disable protection.

[0172] Step S221: collecting data packets that have passed through the protocol deep analysis clustering device, performing traffic analysis, and obtaining industrial control behavior data;

[0173] Step S223: Screen the protocol chain of the traffic data packet passing through. If it matches, it is a hit and is determined to be the industrial control behavior. If it does not match, it is a miss and the traffic data packet enters the waiting area and is discarded or retained according to whether protection is turned on.

[0174] Step S224: The traffic data packet enters the clustering unit, the data traffic is classified and clustered, different types of data are generated, and matched with the FLAG in the protocol chain. If protection is not enabled, the data is stored and displayed according to the classification. If protection is enabled, the data is screened according to the classification.

[0175] Step S225: Continue matching with the protocol vertical chain, and if the traffic has abnormal behavior that does not comply with the protocol, a warning will be issued;

[0176] Step S226: Repeat steps S221-S225.

[0177] The above descriptions are only optional embodiments of the present invention, and are not intended to limit the patent scope of the present invention. All equivalent structural changes made using the contents of the present invention's specification and drawings, or directly / indirectly applied in other related technical fields, are included in the patent protection scope of the present invention.

Claims

1. A method for building a protocol chain based on an industrial control scenario, characterized in that: The steps include: Implement preset industrial control behaviors in preset industrial control scenarios; The protocol features are learned under the preset industrial control behavior to obtain the industrial control features that express the industrial control behavior; Construct an industrial control protocol chain consisting of horizontal chains and vertical chains. The nodes of the vertical chain are industrial control behaviors, and the nodes of the horizontal chain are based on protocol features and represent industrial control features.

2. The method for constructing a protocol chain based on an industrial control scenario according to claim 1, characterized in that: A cross chain includes one node or multiple nodes.

3. The method for constructing a protocol chain based on an industrial control scenario according to claim 2, characterized in that: The architecture of the vertical chain includes industrial control behavior, the number of horizontal chain nodes, the frequency of industrial control behavior, the hash value of industrial control behavior, the number of horizontal chain nodes, and the frequency of industrial control behavior.

4. The method for constructing a protocol chain based on an industrial control scenario according to claim 3 is characterized in that: The horizontal chain includes features for identifying an industrial control behavior, including industrial control source features, industrial control target features, industrial control operation value features, industrial control operation time features, and industrial control operation frequency features.

5. The method for constructing a protocol chain based on an industrial control scenario according to claim 4 is characterized in that: The specific steps include: Step S101: Investigate the industrial control behaviors in the preset industrial control scenarios, confirm and bind the operation instructions of the industrial control behaviors with the corresponding function codes, and convert the investigation results into industrial control behavior features, wherein the specific industrial control operations of the industrial control behaviors are mapped to the operation instructions received by the industrial control devices, and the digital expression value of the operation instructions is the industrial control operation function code; Step S102: Investigate the operators and recipients of the industrial control operations in the preset industrial control scenario, where the operator is the end sending the instruction and the recipient is the end receiving the instruction, record the operator IP address and the recipient IP address of the instruction, obtain the industrial control source IP address and the industrial control target IP address, convert the investigation results into industrial control source features and industrial control target features, and bind them with the industrial control operation; Step S103: investigating the sending time of the industrial control operation instructions in the preset industrial control scenario, recording the time, and converting the investigation result into the industrial control operation time feature, and binding it with the industrial control operation; Step S104: investigating the numerical values ​​of the industrial control operations in the preset industrial control scenarios, recording the numerical values, converting the investigation results into numerical features of the industrial control operations, and binding them with the industrial control operations; Step S105: investigating the frequency of industrial control behaviors in a preset industrial control scenario, converting the investigation results into industrial control operation frequency features, and binding them with the industrial control operations; Step S106: The vertical chain of the protocol chain is composed of industrial control behavior characteristics. Each node on the vertical chain corresponds to an industrial control operation, and the industrial control behavior can be expressed and classified in natural language. A complete vertical protocol chain can express a complete industrial control behavior. The architecture type of each node in the vertical chain is [ACT / NUM / SUL1 / HASH], wherein ACT is the function code of the industrial control operation, NUM is the number of horizontal chain nodes, SUL1 is the industrial control behavior frequency, and HASH is the hash calculation value of ACT, NUM, and SUL. The horizontal chain of the protocol chain is then formed by combining the industrial control source characteristics, the industrial control target characteristics, the industrial control operation numerical characteristics, and the industrial control operation time characteristics to form an industrial control protocol chain.

6. A protocol deep analysis and clustering method for constructing a protocol chain based on an industrial control scenario, characterized in that: The steps include: Stores traffic data in all preset industrial control scenarios; Cut the stored traffic data; Analyze the flow data, extract the flow information and learn the flow information, and then extract the industrial control source characteristics, industrial control target characteristics, industrial control numerical characteristics, and industrial control time characteristics; Based on the extracted industrial control source features, industrial control target features, industrial control operation numerical features, industrial control operation time features, and industrial control operation frequency features, a protocol chain is constructed using the method for constructing a protocol chain based on an industrial control scenario according to any one of claims 1 to 5; Perform traffic learning and traffic screening on the cut traffic data, and cluster the traffic.

7. The protocol deep analysis and clustering method for constructing a protocol chain based on an industrial control scenario according to claim 6 is characterized in that: For all the traffic data flowing through the preset industrial control behavior, the industrial control scene is matched by cutting the traffic data of the preset industrial control behavior and learning the traffic data to obtain the industrial control characteristics of the preset industrial control behavior.

8. The protocol deep analysis and clustering method for constructing a protocol chain based on an industrial control scenario according to claim 7 is characterized in that: Industrial control scene matching specifically includes the following steps: S200: learning a preset industrial control behavior in a preset industrial control scenario, enabling the preset industrial control behavior in the preset industrial control scenario, and starting to learn; S201: Collect all data packets generated after the preset industrial control behavior is enabled, parse the transport layer information and application layer information of the data packets, extract relevant information, including the industrial control source IP address, industrial control target IP address, industrial control operation function code, industrial control operation value, industrial control operation time of the data packets, and record them into the database; S202: The collected data is not blocked but directly stored in the database, and then the next data packet is collected and analyzed; S203: Mark the collected preset industrial control behaviors, record the industrial control features, start learning the next preset industrial control behavior, repeat steps S200-S201 until all preset industrial control behaviors are learned, and all preset industrial control behaviors are started according to the execution order in the preset industrial control scenario; S204: cutting the data in the database into industrial control source characteristic values, industrial control target characteristic values, industrial control function characteristic values, and industrial control time characteristic values, and performing statistics and classified storage, and then generating industrial control frequency characteristic values ​​according to the statistical industrial control function characteristics and industrial control time characteristics; S205: According to the industrial control source characteristic value, industrial control target characteristic value, industrial control function characteristic value, industrial control time characteristic value, and industrial control frequency characteristic value obtained in step S204, a protocol chain and a protocol library are constructed using the method for constructing a protocol chain based on an industrial control scenario as described in any one of claims 1 to 5, and clustering is performed.

9. The protocol deep analysis and clustering method for constructing a protocol chain based on an industrial control scenario according to claim 8 is characterized in that: Step S205 specifically includes the following steps: S2051: extract the industrial control operation feature data, record the function code ACT value of the industrial control operation, and count the number of ACTs within a preset time to generate the industrial control behavior frequency SUL1 value, and calculate the number of horizontal chain nodes NUM value cumulatively through the corresponding industrial control features bound to ACT, and form the first node of the vertical chain [ACT / NUM / SUL / HASH] through the hash calculation value HASH of ACT, NUM, and SUL1 values; S2052: extract the industrial control source features corresponding to the industrial control operation, and form an industrial control source node of the horizontal chain of [VAL / SUL2 / FLAG] type features, where VAL represents the industrial control source IP address corresponding to the industrial control source feature, SUL2 represents the number of times the industrial control source IP address appears in the industrial control behavior within a preset time, and FLAG represents that the node is recorded and connected. When the node of the horizontal chain is connected to the node of the vertical chain, FLAG represents 1. If the node of the horizontal chain is not connected to the node of the vertical chain, FLAG represents 0. At this point, the first node of the first vertical chain is generated, and then the industrial control target features, industrial control numerical features, and industrial control time features are extracted in sequence to form the first node of the horizontal chain connected to the first node of the vertical chain; S2053: In the same manner as step S2052, extract the industrial control target features, form an industrial control target node of the horizontal chain of [VAL / SUL2 / FLAG] type features, connect it after the industrial control source node, and form the second node of the horizontal chain connected to the first node of the vertical chain; S2054: Extract the industrial control operation time feature, divide 24 hours into multiple time periods, if the industrial control time belongs to a certain time period, then the number of times in the corresponding time period is counted + 1, the quantity value is HX[n], and the industrial control time feature node [H1 / H2 / ...HN / FLAG] is established, the value of H1 is H1[n], the value of H2 is H2[n], and so on, N is the total number of time periods, and the function node is connected to the corresponding industrial control target node to form the third node of the horizontal chain connected to the first node of the vertical chain; S2055: extracting the numerical feature of the industrial control operation, which should match the industrial control operation. If there are multiple industrial control operations, there will be multiple industrial control values. Then take the minimum and maximum values ​​of the industrial control values ​​to form an industrial control value node of type [MIN / MAX / FLAG]. MIN indicates the minimum industrial control value that occurs, MAX indicates the maximum industrial control value that occurs, and FLAG indicates that the node is recorded and connected. The industrial control value node is grafted onto the corresponding industrial control time node to form the fourth node of the horizontal chain connected to the first node of the vertical chain. S2055: If the industrial control behavior requires more than one industrial control controller to assist, but requires multiple industrial control operations, repeat steps S2052 to S2054 to construct the next node of the protocol longitudinal chain until all controller nodes of the industrial control behavior are recorded and imported to form a complete industrial control behavior protocol chain; S2056: Classify based on industrial control behavior, express unknown data into describable industrial control behavior in natural language, and an industrial control protocol chain is a complete industrial control behavior category, so as to perform clustering; S2057: The protocol chain is constructed. By investigating the industrial control traffic in the industrial environment, the data of the protocol chain is matched to determine whether it is the industrial control behavior, and whether the industrial control operation time, industrial control operation frequency, and industrial control operation value meet the standards defined by the protocol chain.

10. A protocol deep analysis and clustering device for building a protocol chain based on an industrial control scenario, characterized in that: include: A flow storage unit is used to store the passing flow to form a flow reservoir; A cutting unit cuts the stored flow data; The flow learning unit extracts flow information by analyzing the cut flow data, and extracts industrial control source features, industrial control target features, industrial control numerical features, and industrial control time features; A protocol chain unit, which constructs a protocol horizontal and vertical chain by using the method described in any one of claims 1 to 5; A clustering unit, which clusters and distinguishes the industrial control feature data in the protocol chain; The workflow of the protocol deep analysis clustering device for building a protocol chain based on an industrial control scenario includes the following steps: Step S220: Enter the simulation environment of the preset industrial control scenario to learn the industrial control features of the preset industrial control behavior. After the industrial control feature learning is completed and the protocol chain is built, choose to enable or disable protection. Step S221: collecting data packets that have passed through the protocol deep analysis clustering device, performing traffic analysis, and obtaining industrial control behavior data; Step S223: Screen the protocol chain of the traffic data packet passing through. If it matches, it is a hit and is determined to be the industrial control behavior. If it does not match, it is a miss and the traffic data packet enters the waiting area and is discarded or retained according to whether protection is turned on. Step S224: The traffic data packet enters the clustering unit, the data traffic is classified and clustered, different types of data are generated, and matched with the FLAG in the protocol chain. If protection is not enabled, the data is stored and displayed according to the classification. If protection is enabled, the data is screened according to the classification. Step S225: Continue matching with the protocol vertical chain, and if the traffic has abnormal behavior that does not comply with the protocol, a warning will be issued; Step S226: Repeat steps S221-S225.

Images