A flow collection method, device and equipment of an automated industrial control system

Abstract

The application discloses a flow collection method, device and equipment of an automatic industrial control system, and relates to the technical field of industrial control. The method comprises the following steps: obtaining an operation script of an operation track for collecting flow of a target interactive process in an automatic industrial control system; generating a plurality of groups of variation parameters for operation parameters in the target interactive process, embedding each group of variation parameters into the operation script, and obtaining a plurality of groups of post-variation operation scripts; each post-variation operation parameter in each group of variation parameters meets a corresponding preset parameter range; batch executing the plurality of groups of post-variation operation scripts, obtaining interactive flow of the target interactive process corresponding to each group of post-variation operation scripts, and periodically checking whether an operation interface in the target interactive process is normal during batch execution of the plurality of groups of post-variation operation scripts. The application can improve flow collection efficiency and accuracy.

Description

Technical Field

[0001] This application relates to the field of industrial control system technology, and in particular to a method, apparatus and equipment for collecting flow in an automated industrial control system. Background Technology

[0002] With the widespread application of industrial control systems, cybersecurity issues related to industrial control systems are becoming increasingly prominent. As a core component of modern industrial production, industrial control systems are widely used in many key fields such as energy, transportation, chemical industry, and manufacturing. Their stability and security are directly related to the normal operation of infrastructure.

[0003] Communication protocols in industrial control systems are mostly proprietary, with complex and undisclosed structures, increasing the difficulty of reverse engineering and intrusion detection. Traditional methods for analyzing industrial control system protocols rely primarily on manual analysis and limited publicly available documentation, which is inefficient and prone to errors. Furthermore, the diverse range of devices within industrial control systems, with different manufacturers potentially using different protocols, further complicates protocol analysis. Due to the proprietary and complex nature of these protocols, traditional methods of manually collecting traffic data from industrial control systems are not only time-consuming and labor-intensive but also ill-suited to the demands of collecting traffic data from massive, heterogeneous industrial control systems.

[0004] In real-world industrial control system environments, the acquisition and analysis of industrial control system traffic is crucial for security research. Industrial control system traffic includes communication data between devices, which can reflect the operating status of the devices, configuration information, and potential security vulnerabilities. However, existing manual acquisition methods have several shortcomings.

[0005] Inefficient: Manual data collection requires manual operation, is slow, and is difficult to handle large-scale industrial control system networks.

[0006] Insufficient accuracy: Manual data collection is prone to errors, especially in complex industrial control system environments, where critical information may be missed.

[0007] Difficult to adapt to heterogeneous environments: Industrial control system equipment from different manufacturers uses different protocols, and manual data acquisition is difficult to adapt to such heterogeneous environments.

[0008] Poor real-time performance: Manual collection cannot obtain traffic data in real time, making it difficult to meet the needs of real-time monitoring and analysis. Summary of the Invention

[0009] The purpose of this application is to provide a method, apparatus, and device for collecting flow in an automated industrial control system, which can improve the efficiency and accuracy of flow collection.

[0010] To achieve the above objectives, this application provides the following solution:

[0011] In a first aspect, this application provides a method for collecting flow in an automated industrial control system, comprising:

[0012] An operation script for obtaining the operation trajectory of the target interaction process in an automated industrial control system;

[0013] Multiple sets of variant parameters are generated for the operation parameters during the target interaction process. Each set of variant parameters is embedded into the operation script to obtain multiple sets of mutated operation scripts. Each mutated operation parameter in each set of variant parameters satisfies the corresponding preset parameter range.

[0014] Multiple sets of mutated operation scripts are executed in batches to obtain the interaction traffic of the target interaction process corresponding to each set of mutated operation scripts. During the batch execution of multiple sets of mutated operation scripts, the operation interface of the target interaction process is periodically checked to see if it is normal.

[0015] Optionally, an operation script for obtaining the operation trajectory of the target interaction process in the automated industrial control system to collect traffic data is provided, specifically including:

[0016] Event capture technology is used to record the operation sequence records formed by the operator's operation of mouse and keyboard during the target interaction process, and the operation sequence records are used as the operation trajectory;

[0017] The operation sequence record is converted into the operation script, which includes a delay parameter that represents the time interval between two operations performed by the operator.

[0018] Optionally, multiple sets of variant parameters are generated for the operation parameters during the target interaction process, specifically including:

[0019] Multiple sets of mutated parameters are generated for the operation parameters during the target interaction process using either a random generation mode or a sequential generation mode.

[0020] Optionally, the operation parameters include a password, a filename, and a register address.

[0021] Optionally, multiple sets of mutated operation scripts are executed in batches to obtain the interaction traffic of the target interaction process corresponding to each set of mutated operation scripts, specifically including:

[0022] During the batch execution of multiple sets of mutated operation scripts, the number of times traffic collection is executed is recorded in real time. When the specified number of executions is reached, traffic collection stops. The traffic files obtained from each traffic collection are stored in a set format, and each traffic file is matched with a unique number.

[0023] Optionally, during the batch execution of multiple sets of post-mutation operation scripts, the operation interface during the target interaction process is periodically checked for normal operation, specifically including:

[0024] During the batch execution of multiple sets of post-mutation operation scripts, the real-time operation interface is periodically collected. For the operation interface collected in the current period, the similarity of the operation interface collected in the current period is compared with the corresponding preset operation interface. If the similarity exceeds the similarity threshold, the operation interface collected in the current period is determined to be normal; otherwise, an abnormal alarm is issued.

[0025] Optionally, the operation interface for the current period of data collection is compared with the corresponding preset operation interface, specifically including:

[0026] The current period's data collection interface and the corresponding preset interface are input into the image similarity comparison model to obtain the similarity comparison results; the image similarity comparison model is an image similarity comparison model based on a convolutional neural network.

[0027] Optionally, the target interaction process is the interaction process between the host computer software and the programmable logic controller.

[0028] Secondly, this application provides a flow collection device for an automated industrial control system, characterized in that the flow collection device for the automated industrial control system applies the flow collection method for the automated industrial control system described in any of the above claims, and the flow collection device for the automated industrial control system includes:

[0029] The operation script acquisition module is used to obtain the operation script of the operation trajectory for traffic acquisition of target interaction processes in automated industrial control systems.

[0030] The operation script mutation module is used to generate multiple sets of mutation parameters for the operation parameters during the target interaction process, and embed each set of mutation parameters into the operation script to obtain multiple sets of mutated operation scripts; each mutated operation parameter in each set of mutation parameters satisfies the corresponding preset parameter range.

[0031] The operation script execution module is used to execute multiple sets of mutated operation scripts in batches, obtain the interaction traffic of the target interaction process corresponding to each set of mutated operation scripts, and periodically check whether the operation interface is normal in the target interaction process during the batch execution of multiple sets of mutated operation scripts.

[0032] Thirdly, this application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the flow collection method of the automated industrial control system described in any one of the above.

[0033] According to the specific embodiments provided in this application, the following technical effects are disclosed: In the method of this application, an operation script is obtained to collect traffic data from a target interaction process in an automated industrial control system. Multiple sets of variant parameters are generated for the operation parameters in the target interaction process. Each set of variant parameters is embedded into the operation script to obtain multiple sets of variant operation scripts, thus obtaining operation scripts for various traffic collection scenarios. These variant operation scripts are then executed in batches to obtain the interaction traffic data of the target interaction process corresponding to each set of variant operation scripts. This simulates various possible operation scenarios and automates the traffic collection process under multiple operation scenarios. This not only reduces manual intervention and operational complexity but also improves the efficiency and accuracy of data collection, enabling the rapid generation of large amounts of diverse traffic data. Furthermore, during the batch execution of multiple sets of variant operation scripts, this application periodically checks whether the operation interface is normal during the target interaction process, thereby detecting security vulnerabilities and improving the security of the automated industrial control system. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart illustrating a flow collection method for an automated industrial control system according to an embodiment of this application.

[0036] Figure 2 This is a functional module diagram of a flow collection device for an automated industrial control system provided in an embodiment of this application.

[0037] Figure 3 This is a functional module diagram of a flow collection device for an automated industrial control system, provided as another embodiment of this application.

[0038] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0039] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0040] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0041] In one exemplary embodiment, this application provides a flow collection method for an automated industrial control system, such as... Figure 1 As shown, the flow collection method of the automated industrial control system includes steps 101 to 103.

[0042] Step 101: Obtain the operation script for collecting the flow trajectory of the target interaction process in the automated industrial control system.

[0043] Step 102: Generate multiple sets of variant parameters for the operation parameters during the target interaction process, and embed each set of variant parameters into the operation script to obtain multiple sets of variant operation scripts; each variant operation parameter in each set of variant parameters satisfies the corresponding preset parameter range.

[0044] Step 103: Execute multiple sets of mutated operation scripts in batches to obtain the interaction traffic of the target interaction process corresponding to each set of mutated operation scripts, and periodically check whether the operation interface in the target interaction process is normal during the batch execution of multiple sets of mutated operation scripts.

[0045] The target interaction process is the interaction process between the host computer software and the programmable logic controller (PLC).

[0046] This application includes an initialization configuration step before step 101: setting the target PLC's IP address, protocol type, mutation strategy, and alarm threshold. The mutation strategy refers to the mutation strategy of the operating parameters.

[0047] In an exemplary embodiment, step 101 specifically includes steps 11 to 12.

[0048] Step 11: Use high-precision event capture technology to record the operation sequence formed by the operator's mouse and keyboard operations during the target interaction process, and use the operation sequence record as the operation trajectory. The operation sequence record is a repeatable operation timing record.

[0049] This application uses the Windows Hook API to monitor mouse click coordinates and keyboard input events, and records the operation trajectory.

[0050] For example, when an operator manually executes a complete flow acquisition operation, generating a baseline script, the operation recording module captures mouse movement and keyboard input via a Windows global hook (SetWindowsHookEx) to achieve precise event capture. Simultaneously, it records event timestamps and stores them together as a dictionary dataset in timestamp-event format. At the same time, it captures the baseline flow. During flow capture, the capture strategy is dynamically adjusted based on the characteristics of the industrial control system protocol (such as Modbus function codes and S7 protocol TPKT headers). For example, an example of a TShark filtering rule for the S7 protocol is as follows:

[0051] filter_rule = "tcp port 102 and (s7comm.func == 0x04 || s7comm.func == 0x05)"

[0052] subprocess.run(["tshark", "-i", "eth0", "-f", filter_rule, "-w", "s7_traffic.pcap"]).

[0053] Here, `filter_rule` represents the filtering rule, `TShark` is the command-line version of Wireshark used to capture and analyze network packets, `S7` is the Siemens S7 protocol in industrial control systems, and `s7comm.func` represents the function code in the S7 protocol, with 0x04 indicating reading data and 0x05 indicating writing data.

[0054] -i eth0: Specifies the network interface to listen on, which is eth0 in this case, an Ethernet interface.

[0055] -f filter_rule: Specifies the filtering rule for capturing packets. filter_rule is a string that defines which packets should be captured. This filtering rule can be based on conditions such as IP address, port number, and protocol.

[0056] -w s7_traffic.pcap: Specifies that captured packets will be written to the file s7_traffic.pcap in pcap (Packet Capture) format, which can be used for subsequent analysis using tools such as Wireshark. Specific filtering rules can be customized as needed, for example:

[0057] tcp port 80: Capture all traffic (HTTP traffic) on TCP port 80.

[0058] host 192.168.1.1: Capture all traffic between the host with IP address 192.168.1.1.

[0059] tcp and (port 80 or port 443): Capture all TCP traffic on port 80 (HTTP) or port 443 (HTTPS).

[0060] The execution process acquisition task of this application is used to capture the interaction traffic between the host computer software of the industrial control system and the programmable logic controller (PLC) in real time. The interaction traffic supports multi-protocol parsing and filtering.

[0061] Step 12: Convert the operation sequence record into the operation script, the operation script including a delay parameter, the delay parameter being used to represent the time interval between two operations performed by the operator.

[0062] This application supports version management of operation scripts, allowing users to roll back to historical operation records via operation scripts.

[0063] In an exemplary embodiment, step 102 specifically includes: generating multiple sets of mutation parameters for the operation parameters during the target interaction process using a random generation mode or a sequential generation mode, and generating a mutation log by dynamically modifying the operation parameters.

[0064] The operation parameters include password, file name, and register address.

[0065] Random generation mode: The Mersenne Twister algorithm is used to generate random strings that conform to specific rules (such as a length of 8-16 characters, including uppercase and lowercase letters and numbers).

[0066] Sequential generation mode: Generate variant content based on predefined sequences (such as File001, File002...) or dictionary files (such as a database of 100,000 commonly used cryptographic entries).

[0067] This application introduces mutation content, namely mutation parameters, which greatly enhances the diversity and coverage of traffic data. Through both random and sequential generation modes, operational parameters, such as passwords, filenames, and register addresses, can be dynamically modified to generate multiple sets of mutation parameters and embed them into the operation script. This mutation strategy can not only simulate various possible operational scenarios but also trigger potential security vulnerabilities, providing strong support for security testing and protocol reverse engineering of industrial control systems.

[0068] This application generates multiple sets of mutation parameters (such as modifying register addresses from 0x0000 to 0xFFFF) according to a strategy and embeds them into an operation script. The mutation strategy includes structured mutation template-based mutation and feedback-driven mutation. Structured mutation template-based mutation ensures that the generated mutation parameters can cover all possible states of the protocol by defining mutation rules for the parameters, while ensuring that the mutation parameters are within a reasonable range, thereby improving the diversity of traffic collection and the accuracy of protocol reverse analysis. The following is an example of a structured mutation template for the Modbus protocol, as shown in Table 1.

[0069] Table 1. Examples of structured variant templates for the Modbus protocol

[0070]

[0071] In the above example of structured mutation template, the mutated sequence is the parameter for operation after mutation.

[0072] Feedback-driven mutation optimizes the mutation strategy by analyzing the PLC's response. This method dynamically adjusts mutation parameters based on the PLC's actual response, thereby promptly detecting anomalies during the data acquisition process and preventing continuous mutation errors. For example, during mutation, the PLC returns the following error code: Illegal address error: 0x90 (indicating that the register address is out of range).

[0073] Based on these error codes, the feedback-driven mutation strategy can dynamically adjust the mutation parameters.

[0074] Register address: If a 0x90 error is triggered at address 0xFFFF, the address range of subsequent mutations will be adjusted to [0x0000, 0xFFFE].

[0075] In an exemplary embodiment, step 103 specifically includes: during the batch execution of multiple sets of mutated operation scripts, recording the number of times traffic collection is performed in real time; stopping traffic collection after reaching the specified number of executions; storing the traffic files obtained from each traffic collection in a set format; and matching each traffic file with a unique number.

[0076] Traffic acquisition is achieved through the following steps: Use Wireshark's TShark command-line tool for headless traffic capture to reduce resource consumption. Specifically, use Berkeley Packet Filter (BPF) (e.g., host 192.168.1.100 and port 502) to capture traffic from industrial control system protocols such as Modbus / TCP.

[0077] During the batch execution of multiple sets of post-mutation operation scripts, the real-time operation interface is periodically collected. For the operation interface collected in the current period, the similarity of the operation interface collected in the current period is compared with the corresponding preset operation interface. If the similarity exceeds the similarity threshold, the operation interface collected in the current period is determined to be normal; otherwise, an abnormal alarm is issued.

[0078] This application significantly improves the reliability and security of the system through real-time monitoring and anomaly alarm functions. It periodically records the monitoring interface to build a normal interface knowledge base and uses a convolutional neural network image similarity comparison model to detect changes in the user interface in real time. Once an anomaly is detected, the system immediately triggers an alarm and pauses the current thread, ensuring that the operator can take timely action. This real-time feedback mechanism not only enables rapid response to potential security threats but also reduces the risk of misoperation, ensuring the stable operation of the industrial control system.

[0079] This application achieves precise replay of the operation sequence and multi-threaded concurrent execution by batch executing multiple sets of mutated operation scripts. The captured traffic is counted, saved, and numbered, and a unique filename is generated based on the number and timestamp; this filename is the name of the traffic file.

[0080] When repeatedly performing traffic collection operations, the operation interface of the current period collection is compared with the corresponding preset operation interface. Specifically, this includes: inputting the operation interface of the current period collection and the corresponding preset operation interface into an image similarity comparison model to obtain a similarity comparison result; the image similarity comparison model is an image similarity comparison model based on a convolutional neural network.

[0081] When an operator performs a traffic collection operation, this application periodically records the monitoring interface screen, i.e., the preset operation interface. The screens of each monitoring interface form a normal interface knowledge base, which is used to compare the similarity with the periodically collected operation interface.

[0082] This application uses rule-based logic to automatically check whether the interface is functioning correctly, pushes alarm information to emails, SMS messages or API interfaces in real time, and notifies users after data collection is complete.

[0083] When the number of traffic files collected reaches the specified target, that is, after the traffic collection has been executed a certain number of times, the message notification module sends a message to the operator to inform the operator that the collection task is complete.

[0084] The storage mechanism for traffic output in this application includes the following.

[0085] 1) Record the number of traffic items collected so far, and ensure that the number of packets in each group of traffic items is within the specified range.

[0086] 2) Record the number of times each traffic collection task is executed, and stop collecting traffic after completing the specified number of collection tasks.

[0087] 3) Use a standard format (such as .pcap or .log), that is, set the format and store the traffic data for subsequent analysis.

[0088] 4) Combine content mutation operations to assign a unique number to each traffic file to avoid file conflicts.

[0089] 5) The file naming rule is [protocol type]_[mutation ID]_[timestamp].pcap (e.g., modbus_0423_20231005143000.pcap).

[0090] 6) Use a database or index file to store metadata, such as collection time, mutation strategy, association operation, etc., to support fast retrieval.

[0091] This application's efficient storage mechanism ensures data integrity and traceability. By recording the number of traffic entries and execution times, and storing traffic data in a defined format (such as .pcap or .log), not only is data integrity ensured, but subsequent analysis and retrieval are also facilitated. File naming rules and metadata storage mechanisms further improve data management efficiency, enabling users to quickly locate and retrieve the required traffic files.

[0092] In an exemplary embodiment, the operating environment of this application method is an Intel-Windows architecture personal computer (PC), whose hardware is an eight-core CPU with a main frequency of 2.5GHz or higher, ≥8GB of memory, 2TB of hard disk, and running the Windows 10 operating system. It can be applied to scenarios such as industrial protocol reverse engineering analysis, industrial control system protocol vulnerability detection, and industrial control system equipment security testing. The industrial control system equipment covers mainstream manufacturers' industrial Internet field devices, wireless access devices, edge terminal devices, industrial communication devices, and security protection devices, etc.

[0093] The automation capabilities of this application significantly improve the efficiency of traffic acquisition in industrial control systems, reduce manual intervention, and enhance data accuracy and integrity. Automated traffic acquisition enables real-time monitoring and analysis of industrial control system networks, allowing for the timely detection of potential security threats. Furthermore, the automation tool is adaptable to industrial control system equipment and protocols from different manufacturers, improving its versatility and scalability.

[0094] Research on traffic collection methods for automated industrial control systems not only provides data support for reverse engineering of industrial control system protocols, but also offers powerful technical means for intrusion detection and security protection of industrial control systems. Through automated traffic collection and analysis, we can better understand the operating mechanisms of industrial control systems, discover potential security vulnerabilities, and thus provide theoretical basis and technical support for the security protection of industrial control systems.

[0095] This application aims to address the problems of low efficiency and insufficient automation in the flow acquisition of industrial control systems in the prior art. This application realizes full-process automation from flow capture to data analysis, which can not only improve the efficiency of flow acquisition in industrial control systems, but also provide a solid data foundation for the security research and protection of industrial control systems.

[0096] Based on the same inventive concept, this application also provides a flow collection device for an automated industrial control system to implement the flow collection method of the automated industrial control system described above. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more embodiments of the flow collection device for an automated industrial control system provided below can be found in the limitations of the flow collection method for the automated industrial control system described above, and will not be repeated here.

[0097] In one exemplary embodiment, such as Figure 2 As shown, a flow collection device for an automated industrial control system is provided. The flow collection device for the automated industrial control system applies the flow collection method of the automated industrial control system and includes the following modules.

[0098] The operation script acquisition module is used to obtain the operation scripts for collecting traffic data from target interaction processes in automated industrial control systems.

[0099] The operation script mutation module is used to generate multiple sets of mutation parameters for the operation parameters during the target interaction process, and embed each set of mutation parameters into the operation script to obtain multiple sets of mutated operation scripts; each mutated operation parameter in each set of mutation parameters satisfies the corresponding preset parameter range.

[0100] The operation script execution module is used to execute multiple sets of mutated operation scripts in batches, obtain the interaction traffic of the target interaction process corresponding to each set of mutated operation scripts, and periodically check whether the operation interface is normal in the target interaction process during the batch execution of multiple sets of mutated operation scripts.

[0101] In one exemplary embodiment, such as Figure 3As shown, a flow collection device for an automated industrial control system is provided, comprising the following modules.

[0102] The traffic acquisition module captures the interaction traffic between industrial control system equipment and host computer software in real time, and supports multi-protocol parsing and filtering.

[0103] The operation log module records the operator's mouse and keyboard operations with high precision, generating a scripted operation sequence record that can be executed repeatedly.

[0104] The operation execution module accurately replays the operation sequence and supports multi-threaded concurrent execution; the content mutation module adopts a dual mode of random generation and sequential generation, dynamically modifies operation parameters and generates mutation logs.

[0105] The traffic output module counts, saves, and numbers the captured traffic, and generates a unique filename based on the mutation number and timestamp.

[0106] The message notification module monitors changes to the operation interface in real time, judges whether the execution is normal based on rule logic, triggers an alarm and pauses the thread when an abnormality occurs, and sends a notification message after the task is completed.

[0107] In an exemplary embodiment, the workflow for a flow collection device of an automated industrial control system is as follows: steps one through five.

[0108] Step 1 (Initialization Configuration): The user sets the IP address, protocol type, mutation strategy, and alarm threshold of the target PLC; the alarm threshold includes the similarity threshold.

[0109] Step 2 (Benchmark Operation Record): The operator manually executes a complete operation process once. The operation record module generates a benchmark script, and the traffic acquisition module captures the benchmark traffic.

[0110] Step 3 (Mutation Parameter Injection): The content mutation module generates multiple sets of mutation parameters according to the strategy (such as modifying the register address from 0x0000 to 0xFFFF) and embeds them into the operation script.

[0111] Step 4 (Automated Execution): The operation execution module initiates batch execution of operations based on the mutated script, while the traffic acquisition module captures and stores traffic in real time.

[0112] Step 5 (Anomaly Detection and Feedback): The message notification module monitors interface changes during operations, comparing the current interface with elements in the interface library to determine if an operational anomaly has occurred. Upon detecting an anomaly, an alarm is triggered and the current thread is paused; simultaneously, after the data collection task is successfully completed, the message notification module sends a completion message.

[0113] This application applies the batch execution of multiple sets of mutated operation scripts to the actual operation of automated industrial control system equipment. By batch executing multiple sets of mutated operation scripts, various possible operation scenarios are simulated, generating rich traffic data to provide data support for subsequent analysis and vulnerability discovery. Specifically, this includes steps such as script loading, multi-threaded concurrent execution, and execution monitoring.

[0114] 1) Operation Script Loading: The operation execution module first loads all generated mutated operation scripts, referred to as mutation scripts. These mutation scripts were generated in the previous mutation parameter injection step and contain various mutation operation parameters. Each script corresponds to a specific set of mutation parameters, used to simulate different operation scenarios.

[0115] 2) Multi-threaded Concurrent Execution: To improve execution efficiency, the operation execution module supports multi-threaded concurrent execution. Depending on system resources and configuration, multiple threads can be started simultaneously, each executing a mutation script independently. This concurrent execution method significantly improves the speed of traffic generation, enabling the generation of large amounts of diverse traffic data in a short time. The operation execution module parses each mutation script, extracting the operation instructions and mutation parameters. Based on the parsing results, the module accurately simulates operator operations, including mouse clicks, keyboard input, and delays (delay parameters). During execution, the operation execution module dynamically adjusts the execution strategy based on the PLC's response. For example, if the PLC's response time is too long, the module automatically adjusts the delay parameters to prevent excessively fast operations from causing PLC response timeouts.

[0116] 3) Execution Monitoring: During execution, the operation execution module monitors the execution status of each thread in real time. If a thread encounters an anomaly (such as execution timeout, PLC return error, etc.), the system will record the anomaly information and pause the execution of that thread. Simultaneously, the system will attempt to restart the thread or skip the current script and continue executing the next script, ensuring the stability and continuity of the entire execution process.

[0117] Meanwhile, the traffic acquisition module monitors the interaction traffic between the industrial control system's host computer software and the PLC in real time. Using Wireshark's TShark command-line tool, the module can efficiently capture traffic data in a headless mode, reducing resource consumption. To improve capture efficiency, the traffic acquisition module uses a BPF filter to filter the traffic, capturing only traffic relevant to the target protocol and avoiding interference from irrelevant traffic.

[0118] After collecting a sufficient number of traffic packets in a single session, the traffic acquisition module stores the traffic, following these steps.

[0119] 1) Counting and Numbering: The traffic acquisition module counts the captured traffic and generates a unique filename based on the mutation number and timestamp. For example, the file naming rule is [protocol type]_[mutation ID]_[timestamp].pcap, such as modbus_0423_20231005143000.pcap. This naming method ensures that each traffic file can be uniquely identified, facilitating subsequent analysis and retrieval.

[0120] 2) Storage Format: Captured traffic data is saved in the standard PCAP format, which is widely used in network traffic analysis tools for easy processing and analysis. The module also supports storing traffic data on local disks or distributed file systems (such as the Hadoop Distributed File System (HDFS)) to ensure data security and scalability.

[0121] 3) Metadata Recording: To facilitate subsequent retrieval and analysis, the traffic acquisition module records metadata for each traffic file, including acquisition time, mutation strategy, and associated operations. This metadata can be stored in a database or index file, supporting fast querying and retrieval.

[0122] To ensure the coordinated operation of the operation execution module and the traffic acquisition module, a tight synchronization mechanism needs to be established between them. The specific implementation method is as follows.

[0123] 1) Timestamp Synchronization: The operation execution module and the traffic acquisition module synchronize using timestamps. Each operation command and traffic packet carries a precise timestamp, ensuring the correspondence between the two. This timestamp synchronization mechanism enables subsequent analysis to accurately correlate operation commands and traffic data.

[0124] 2) Event-driven mechanism: When the operation execution module executes each operation command, it triggers an event notification to the traffic acquisition module. Based on the event notification, the traffic acquisition module captures traffic data related to that operation command in real time. This event-driven mechanism ensures the real-time nature and accuracy of traffic acquisition, avoiding the omission of any important traffic information.

[0125] Taking the password modification operation of a PLC as an example, the specific implementation steps are as follows.

[0126] 1. Script loading and execution.

[0127] The operation execution module loads all generated mutation scripts, and each script corresponds to a set of mutated password parameters.

[0128] Multiple threads are started to execute these scripts concurrently, simulating the operator manually changing the password.

[0129] 2. Traffic capture and storage.

[0130] The traffic acquisition module captures the interaction traffic between the host computer software and the PLC in real time, and uses the BPF filter to filter out the traffic related to the Modbus / TCP protocol.

[0131] The captured traffic data is saved in PCAP format, with the file named modbus_0423_20231005143000.pcap, and the metadata is recorded in the database.

[0132] 3. Synchronization mechanism.

[0133] When the operation execution module performs each password modification operation, it triggers an event to notify the traffic collection module.

[0134] The traffic acquisition module captures traffic data related to the operation in real time based on the event notification and records the timestamp to ensure the correspondence between the operation command and the traffic data.

[0135] Step five specifically includes the following steps.

[0136] Step 51: Construction of the normal interface knowledge base.

[0137] Screenshot capture: While the operator is performing normal operations, the system periodically takes screenshots of the monitoring interface. These screenshots are stored in the normal interface knowledge base. Each screenshot includes a timestamp and an operation description for later analysis.

[0138] Interface Feature Extraction: To improve comparison efficiency, the system extracts features from each screenshot, i.e., the user interface, identifying key interface elements such as button positions, text content, and icons. These features are stored as feature vectors for subsequent similarity comparisons.

[0139] Step 52: Real-time interface monitoring and comparison.

[0140] Periodic screenshots: During automated execution, the message notification module will periodically take screenshots of the current operation interface. The frequency can be adjusted according to actual needs, such as taking screenshots every second. Figure 1 Second-rate.

[0141] Similarity Comparison: Using a convolutional neural network (CNN)-based image similarity comparison model, the current interface screenshot is compared with screenshots in a normal interface knowledge base. The model calculates a similarity score between the two; if the similarity is lower than a preset similarity threshold (e.g., 90%), the current interface is considered abnormal.

[0142] Anomaly Detection: Once an anomaly is detected, the system will record detailed information such as the time of the anomaly, the operation steps, and screenshots, and trigger an alarm mechanism.

[0143] Step 53: Alarm triggered.

[0144] Alarm Information Generation: When an anomaly is detected, the system generates detailed alarm information, including the anomaly type, occurrence time, relevant operational steps, screenshots, etc. The alarm information will be sent to the operator through multiple channels to ensure timely notification.

[0145] Alarm channels: Supports multiple alarm channels, including email, SMS, and API interface. Operators can choose one or more alarm methods according to their actual needs. For example, sending detailed alarm reports via email, sending brief alarm notifications via SMS, or pushing alarm information to the monitoring system via API interface.

[0146] Step 54: Pause the current thread.

[0147] Thread Management: Upon detecting an anomaly, the message notification module instructs the operation execution module to suspend the execution of the current thread. This suspension mechanism prevents potential security issues from escalating further and provides operators with sufficient time to investigate and handle the anomaly.

[0148] Log recording: The system will record the operation status and related log information when paused, for subsequent analysis and recovery.

[0149] Step 55: Task completion check.

[0150] Completion conditions: After the data collection task is successfully completed, the notification module will detect the task completion signal. Completion conditions may include reaching a preset target for the number of traffic collected, or all mutation scripts having been executed.

[0151] Completion message generation: The system will generate a detailed completion message, including information such as task completion time, number of traffic files collected, number of successful and failed operations, etc.

[0152] Step 56: Notification mechanism.

[0153] Notification Channels: Completion messages can also be sent to operators through various channels, including email, SMS, and API interfaces. Operators can choose one or more notification methods based on their actual needs. For example, they can send a detailed completion report via email, a brief completion notification via SMS, or push completion information to the monitoring system via API.

[0154] Taking the password modification operation of a PLC as an example, the specific implementation steps are as follows.

[0155] 1. Construction of a knowledge base for a normal user interface.

[0156] When the operator manually performs the password change operation, the system periodically takes screenshots of the monitoring interface, extracts interface features, and builds a normal interface knowledge base.

[0157] 2. Real-time monitoring and anomaly detection.

[0158] During automated execution, the message notification module periodically takes screenshots of the current operation interface and uses a CNN model to compare the similarity with screenshots in the normal interface knowledge base.

[0159] If the similarity between the current interface and the normal interface is less than 90%, the system will record the abnormal information and trigger an alarm.

[0160] 3. Alarm triggering and thread pause.

[0161] The device generates detailed alarm information, notifies the operator via email, and suspends the execution of the current thread.

[0162] The device records the operational status and related log information during pauses for subsequent analysis and recovery.

[0163] 4. Task completion notification.

[0164] Once the data collection task is successfully completed, the system generates a detailed completion message and notifies the operator via email and SMS that the task has been successfully completed.

[0165] The workflow of the flow collection device for an automated industrial control system disclosed in this application includes steps such as initialization configuration, baseline operation recording, variable parameter injection, automated execution, and anomaly detection and feedback, which significantly improves flow collection efficiency and provides strong support for network security analysis of industrial control systems.

[0166] The method and apparatus of this application possess excellent versatility and scalability. By supporting multiple industrial control system protocols (such as Modbus / TCP, S7Comm, etc.) and providing SDK extension interfaces, this tool can adapt to industrial control system equipment and protocols from different manufacturers, meeting diverse industrial scenario needs. This versatility and scalability enable the tool to be applied in a wide range of industrial fields, providing comprehensive technical support for the security protection of industrial control systems.

[0167] In summary, this application achieves comprehensive automation and intelligence in industrial control system traffic acquisition by deeply integrating automated operation playback, intelligent content mutation, and multi-dimensional traffic analysis technologies. Compared with existing technologies, this application not only improves the efficiency and accuracy of traffic acquisition but also enhances data diversity and coverage, thereby improving system reliability and security. It has broad application prospects in cybersecurity assessments of industrial control systems in industries such as power, petrochemicals, and manufacturing, providing strong technical support for the security protection of industrial control systems.

[0168] An embodiment of the flow collection method for an automated industrial control system disclosed in this application can be applied to any device with data processing capabilities, such as a computer. The device embodiment can be implemented through software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution.

[0169] In one exemplary embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as follows. Figure 4 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores flow collection data for automated industrial control systems. The I / O interfaces are used for information exchange between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a flow collection method for an automated industrial control system.

[0170] Those skilled in the art will understand that Figure 4 The structures shown are merely block diagrams of some structures related to the present application and do not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements. In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0171] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0172] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0173] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic units, data processing logic units, etc., and are not limited to these.

[0174] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0175] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method of flow collection for an automated industrial control system, the method comprising: The flow collection method of the automation industrial control system comprises: obtaining an operation script of an operation track for collecting flow of a target interactive process in an automation industrial control system; generating a plurality of sets of variation parameters for operation parameters in the target interactive process, embedding each set of variation parameters into the operation script to obtain a plurality of sets of variation operation scripts; each variation operation parameter in each set of variation parameters meets a corresponding preset parameter range; generating a plurality of sets of variation parameters for operation parameters in the target interactive process, specifically comprising: generating a plurality of sets of variation parameters for operation parameters in the target interactive process by using a random generation mode or a sequential generation mode; generating a plurality of sets of variation parameters for operation parameters in the target interactive process, specifically further comprising: generating a plurality of sets of variation parameters according to a variation strategy, the variation strategy comprising structured variation template variation and feedback-driven variation; the structured variation template variation defines variation rules of parameters to ensure that the generated variation parameters can cover various possible states of the protocol, and at the same time ensure that the variation parameters are within a reasonable range, thereby improving the diversity of flow collection and the accuracy of protocol reverse analysis; the feedback-driven variation optimizes the variation strategy by analyzing the response of the PLC, dynamically adjusts the variation parameters according to the actual response of the PLC, and timely discovers abnormalities in the collection process and avoids continuous variation errors; when capturing flow, dynamically adjusting the capture strategy based on the characteristics of the industrial control system protocol; batch executing a plurality of sets of variation operation scripts to obtain interactive flow of the target interactive process corresponding to each set of variation operation scripts, and periodically checking whether the operation interface in the target interactive process is normal during batch execution of the plurality of sets of variation operation scripts; the target interactive process is an interactive process between host software and a programmable logic controller; the interactive flow between the host software and the programmable logic controller of the automation industrial control system is captured in real time; the interactive flow supports multi-protocol analysis and filtering; during batch execution of the plurality of sets of variation operation scripts, periodically checking whether the operation interface in the target interactive process is normal, specifically comprising: during batch execution of the plurality of sets of variation operation scripts, periodically collecting real-time operation interfaces, comparing the operation interface collected in the current period with a corresponding preset operation interface for similarity, if the similarity exceeds a similarity threshold, determining that the operation interface collected in the current period is normal, otherwise, performing abnormal alarm; extracting features of each operation interface, extracting key interface elements including button position, text content and icon, these features will be stored as a feature vector for similarity comparison of the operation interface collected in the current period and the corresponding preset operation interface.

2. The flow collection method of an automated industrial control system according to claim 1, wherein, obtaining an operation script of an operation track for collecting flow of a target interactive process in an automation industrial control system, specifically comprising: using event capture technology to record an operation sequence record formed by an operator operating a mouse and a keyboard in the target interactive process, and taking the operation sequence record as the operation track; The operation sequence record is converted into the operation script, and the operation script includes a time delay parameter used to represent a time interval between two operations performed by the operator.

3. The flow collection method of an automated industrial control system according to claim 1, wherein, The operation parameters include a password, a file name, and a register address.

4. The flow collection method of an automation industrial control system according to claim 1, wherein, The method further includes: performing a plurality of sets of the operation scripts after variation in batches to obtain interaction traffic of the target interactive process corresponding to each set of the operation scripts after variation, specifically including: During the process of performing the plurality of sets of the operation scripts after variation in batches, the number of execution times of traffic collection is recorded in real time, and the traffic collection is stopped when a specified number of execution times is reached. Each traffic file obtained through traffic collection is stored in a set format, and a unique number is matched for each traffic file.

5. The flow collection method of an automated industrial control system according to claim 1, wherein, The operation interface collected in the current period is compared with the corresponding preset operation interface in terms of similarity, specifically including: The operation interface collected in the current period is input into a picture similarity comparison model to obtain a similarity comparison result. The picture similarity comparison model is a picture similarity comparison model based on a convolutional neural network.

6. A flow collection device for an automated industrial control system, characterized by, The traffic collection device of the automatic industrial control system applies the traffic collection method of the automatic industrial control system according to any one of claims 1-5. The traffic collection device of the automatic industrial control system includes: An operation script acquisition module is configured to obtain an operation script of an operation track for collecting traffic of a target interactive process in an automatic industrial control system. An operation script variation module is configured to generate a plurality of sets of variation parameters for operation parameters in the target interactive process, embed each set of variation parameters into the operation script, and obtain a plurality of sets of operation scripts after variation. Each variation parameter in each set of variation parameters satisfies a corresponding preset parameter range. An operation script execution module is configured to perform the plurality of sets of operation scripts after variation in batches to obtain interaction traffic of the target interactive process corresponding to each set of operation scripts after variation, and periodically check whether an operation interface in the target interactive process is normal during the process of performing the plurality of sets of operation scripts after variation in batches.

7. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the traffic collection method of the automatic industrial control system according to any one of claims 1-5.

Images