Industrial network threat state monitoring method and system

Abstract

The invention discloses an industrial network threat state monitoring method and system, belongs to the technical field of industrial system security, solves the limitation of single flow detection through collaborative analysis of fused flow characteristics, equipment logs, threat intelligence and vulnerability scanning data, establishes a real-time association mechanism of log events and flow anomalies, and improves the safety of the system. Threat confirmation and response time is shortened from a traditional hour level to a minute level, and active strategy adjustment is realized based on linkage of a configuration baseline deviation degree and a vulnerability scanning result.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial system security, and particularly relates to an industrial network threat status monitoring method and system. Background Art

[0002] Industrial control systems are widely used in critical national infrastructure sectors such as power, manufacturing, and energy. Their cybersecurity is directly related to the stable operation and physical safety of production systems. With the development of the Industrial Internet, cyberattacks targeting industrial control systems are becoming more frequent and covert. Targeted attacks, particularly advanced persistent threats, pose a severe challenge to traditional monitoring technologies.

[0003] According to industry data (see the 2023 Industrial Cybersecurity White Paper), single-source traffic analysis solutions have a detection rate of less than 55% for industrial control ransomware, and 60% of deployed systems have incomplete configuration baseline coverage. While existing technologies attempt to combine data from multiple sources, they still suffer from coarse data correlation granularity and rigid response strategies. This is particularly effective when addressing advanced threats such as command and control communications within encrypted traffic and tampering with industrial control protocol layer logic.

[0004] Current industrial network threat monitoring mainly relies on network traffic analysis technology, which has the following limitations:

[0005] Single detection dimension: Existing solutions focus too much on traffic characteristics, making it difficult to identify low-frequency and covert attack behaviors, such as those during the lateral penetration phase of APT attacks, resulting in a high false negative rate.

[0006] Significant response lag: Static rule-based detection mechanisms cannot effectively correlate device operation logs with real-time vulnerability status, resulting in a long threat confirmation cycle and delayed emergency response.

[0007] Fragmented intelligence applications: External threat intelligence lacks dynamic integration with local asset configuration and vulnerability data, making it impossible to build accurate risk assessment models.

[0008] Passive defense flaws: There is a lack of a coordinated mechanism between baseline verification and active scanning. For example, when the device configuration deviates from the baseline, deep detection cannot be automatically triggered, making it difficult to achieve active immune defense. Summary of the Invention

[0009] In response to the above-mentioned deficiencies in the prior art, the present application provides a method and system for monitoring the threat status of industrial network equipment.

[0010] In a first aspect, the present application proposes a method for monitoring the threat status of industrial network equipment, comprising the following steps:

[0011] Collect industrial network traffic through network probes, parse industrial control protocol fields and classify traffic types, and detect traffic anomalies based on dynamic thresholds;

[0012] Build a core operation type database and core configuration library for device logs, perform semantic analysis and contextual association on log operation behaviors, and mark high-risk events;

[0013] Access multi-source threat intelligence data to build a knowledge graph, conduct real-time correlation analysis between malicious IP / Hash values in the intelligence and local traffic and logs, and dynamically adjust monitoring priorities;

[0014] Perform non-invasive vulnerability scanning to generate an asset vulnerability list, and detect risky software by combining real-time port behavior fingerprinting with control instruction integrity verification;

[0015] Establish a device configuration baseline and calculate the baseline deviation, integrate vulnerability severity to generate a device risk score, and trigger in-depth monitoring strategies for high-risk devices.

[0016] In some embodiments, collecting industrial network traffic through a network probe, parsing industrial control protocol fields and classifying traffic types, and detecting traffic anomaly characteristics based on dynamic thresholds include:

[0017] Deep packet inspection technology is used to parse the industrial control protocol field. When the industrial control protocol field is the Modbus protocol, the function code, register address, and data length are extracted. When the industrial control protocol field is the Profinet protocol, the IO device identifier, data cycle, and service type are extracted, and the detection threshold is dynamically adjusted based on the exponentially weighted moving average model.

[0018] Traffic features are extracted based on the detection threshold and matched with a preset threat intelligence library.

[0019] In some embodiments, the process of constructing a core operation type database and a core configuration library for device logs, performing semantic analysis and context association on log operation behaviors, and marking high-risk events includes:

[0020] In the device log analysis step, an LSTM network is used to learn normal operation sequences, detect deviation patterns, associate log events with asset attributes, and perform semantic analysis on the operation behaviors in the log events. If the operation involves the core configuration library content and there is no legal authorization certificate, it is marked as a high-risk event.

[0021] In some embodiments, the access to multi-source threat intelligence data to build a knowledge graph, perform real-time correlation analysis between malicious IP addresses / hash values in the intelligence and local traffic and logs, and dynamically adjust monitoring priorities, including:

[0022] Connect to external intelligence sources through the STIX or TAXII protocol, build a local threat intelligence knowledge graph, and annotate vulnerability exploit chains;

[0023] Based on the vulnerability exploitation chain, the malicious IP / Hash value in the external intelligence source is correlated with the local traffic / log in real time, the intelligence source is scored for credibility, the threat index is weighted and calculated, and multi-dimensional alarms are triggered based on the threat index.

[0024] In some embodiments, performing non-invasive vulnerability scanning to generate an asset vulnerability list, combining real-time port behavior fingerprinting with control instruction integrity verification to detect risk software, includes:

[0025] Regularly perform non-intrusive vulnerability scans to generate a list of asset vulnerabilities;

[0026] Monitor abnormal traffic on key ports in the asset vulnerability list in real time, identify unauthorized IoT device access, detect key control instructions output by risk software through memory behavior, calculate hash fingerprints for the key control instructions, and compare in real time to see if they have been tampered with.

[0027] In some embodiments, the device configuration baseline is established and the baseline deviation is calculated, and the vulnerability severity is integrated to generate a device risk score, triggering an in-depth monitoring strategy for high-risk devices;

[0028] Device configurations are regularly captured through SNMP / CLI, and difference analysis and calculation are performed against the baseline template to obtain the device risk score. When the device risk score is detected to exceed the threshold, the deep monitoring strategy for high-risk devices is triggered and mitigation measures are automatically executed.

[0029] In some embodiments, the formula for the device risk score is:

[0030]

[0031] in, Assign a CVSS score to the vulnerability. is the baseline deviation, is the deviation coefficient weight.

[0032] In a second aspect, the present application proposes an industrial network equipment threat status monitoring system, which includes an abnormal feature detection module, an equipment log analysis module, a threat intelligence integration module, a vulnerability risk scanning module, and an equipment risk analysis module;

[0033] The abnormal feature detection module is used to collect industrial network traffic through network probes, parse industrial control protocol fields and classify traffic types, and detect abnormal traffic features based on dynamic thresholds;

[0034] The device log analysis module is used to build a core operation type database and a core configuration library for device logs, perform semantic analysis and context association on log operation behaviors, and mark high-risk events;

[0035] The threat intelligence integration module is used to access multi-source threat intelligence data to build a knowledge graph, perform real-time correlation analysis between malicious IP / Hash values in the intelligence and local traffic and logs, and dynamically adjust monitoring priorities;

[0036] The vulnerability risk scanning module is used to perform non-invasive vulnerability scanning to generate an asset vulnerability list, and detect risk software by combining real-time port behavior fingerprints and control instruction integrity verification;

[0037] The device risk analysis module is used to establish a device configuration baseline and calculate the baseline deviation, integrate the vulnerability severity to generate a device risk score, and trigger an in-depth monitoring strategy for high-risk devices.

[0038] In a third aspect, the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0039] In a fourth aspect, the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0040] Beneficial effects of the present invention:

[0041] This invention overcomes the limitations of single traffic detection by integrating traffic characteristics, device logs, threat intelligence and collaborative analysis of vulnerability scanning data, establishing a real-time correlation mechanism between log events and traffic anomalies, shortening threat confirmation and response time from the traditional hours to minutes, and implementing proactive policy adjustments based on the linkage between configuration baseline deviation and vulnerability scanning results (risk score = vulnerability severity × baseline deviation coefficient). BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is the overall flow chart of the present invention.

[0043] Figure 2 This is a system principle block diagram of the present invention. DETAILED DESCRIPTION

[0044] The following will describe exemplary embodiments of the present invention in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein; rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0045] In the first aspect, the present application proposes a method for monitoring the threat status of industrial network equipment, such as Figure 1 As shown, the following steps are included:

[0046] S100: It collects industrial network traffic through network probes, parses industrial control protocol fields and classifies traffic types, and detects traffic anomalies based on dynamic thresholds.

[0047] In some embodiments, collecting industrial network traffic through a network probe, parsing industrial control protocol fields and classifying traffic types, and detecting traffic anomaly characteristics based on dynamic thresholds include:

[0048] Deep packet inspection technology is used to parse the industrial control protocol field. When the industrial control protocol field is the Modbus protocol, the function code, register address, and data length are extracted. When the industrial control protocol field is the Profinet protocol, the IO device identifier, data cycle, and service type are extracted, and the detection threshold is dynamically adjusted based on the exponentially weighted moving average model.

[0049] Traffic features are extracted based on the detection threshold and matched with a preset threat intelligence library.

[0050] By monitoring network traffic in industrial networks, abnormal activities can be discovered in a timely manner, such as large-scale host scans, abnormal data transmission, and unauthorized access.

[0051] Technical means and implementation process:

[0052] 1. Collect raw system data through network probes, including collecting full flow data through network probes, parsing protocol fields (such as Modbus, Profinet) and classifying traffic types.

[0053] 2. Analyze the protocol fields of the original data, identify the traffic type, and set threshold rules based on the characteristics of the industrial control protocol (for example, triggering an alarm when the number of PLC write operations per unit time exceeds the threshold).

[0054] 3. Perform quantitative analysis on unreachable traffic types, extract traffic features (such as abnormal protocol field combinations and unauthorized access patterns), and match them with the threat intelligence library.

[0055] The dynamic adjustment of the detection threshold based on the exponentially weighted moving average model includes:

[0056]

[0057] in, is the current threshold, is the current traffic characteristic value, is the smoothing factor.

[0058] S200: Build a core operation type database and core configuration library for device logs, perform semantic analysis and context association on log operation behaviors, and mark high-risk events;

[0059] In some embodiments, the process of constructing a core operation type database and a core configuration library for device logs, performing semantic analysis and context association on log operation behaviors, and marking high-risk events includes:

[0060] In the device log analysis step, an LSTM network is used to learn normal operation sequences, detect deviation patterns, associate log events with asset attributes, and perform semantic analysis on the operation behaviors in the log events. If the operation involves the core configuration library content and there is no legal authorization certificate, it is marked as a high-risk event.

[0061] Among them, the LSTM network is used to model the normal operation sequence, and the abnormal pattern is detected by probability:

[0062]

[0063] For the current operation, is the abnormal probability threshold;

[0064] Various devices in industrial networks, such as PLCs, SCADA controllers, and industrial routers, typically generate logs recording system operating status and events. By analyzing these device logs, we can identify unusual behavior and potential threats. For example, we establish a database of core operation types (such as PLC configuration modifications and SCADA screen transitions) and a core configuration library (such as device IP whitelists). When the system identifies a log operation involving content from these core libraries, it identifies it as unusual behavior (such as modifying PLC control logic without valid authorization) and potentially posing a risk. Other logs include failed logins, access attempts, unusual operations, and configuration changes.

[0065] S300: Accesses multi-source threat intelligence data to build a knowledge graph, performs real-time correlation analysis between malicious IP addresses / hash values in the intelligence and local traffic and logs, and dynamically adjusts monitoring priorities.

[0066] In some embodiments, the access to multi-source threat intelligence data to build a knowledge graph, perform real-time correlation analysis between malicious IP addresses / hash values in the intelligence and local traffic and logs, and dynamically adjust monitoring priorities, including:

[0067] Connect to external intelligence sources through the STIX or TAXII protocol, build a local threat intelligence knowledge graph, and annotate vulnerability exploit chains;

[0068] Based on the vulnerability exploitation chain, the malicious IP / Hash value in the external intelligence source is correlated with the local traffic / log in real time, the intelligence source is scored for credibility, the threat index is weighted and calculated, and multi-dimensional alarms are triggered based on the threat index.

[0069] Weighted calculation of threat indicators includes calculating intelligence credibility weights:

[0070]

[0071] Assign a CVSS score to the vulnerability. is the historical false alarm rate of the intelligence source, is the empirical coefficient.

[0072] Establishing an effective threat intelligence collection and analysis system can help industrial network managers understand current security threats and attack trends. By subscribing to threat intelligence services from security organizations, participating in security forums and exchange events, and sharing security incidents and information with other organizations, they can obtain information on the latest threats and take timely defensive measures. Intelligence sources include CNVD, CNNVD, CICSVD, NVD, CVE, and commercial threat intelligence platforms. Threat intelligence from these sources is stored in a database, labeled with a risk level, and weighted to calculate threat indicators. Integration logic is used to correlate external intelligence with local logs (for example, matching IP blacklists and malicious hash values) and trigger multi-dimensional alerts.

[0073] S400: Performs non-invasive vulnerability scanning to generate an asset vulnerability list, combining real-time port behavior fingerprinting with control instruction integrity verification to detect risky software;

[0074] In some embodiments, performing non-invasive vulnerability scanning to generate an asset vulnerability list, combining real-time port behavior fingerprinting with control instruction integrity verification to detect risk software, includes:

[0075] Regularly perform non-intrusive vulnerability scans to generate a list of asset vulnerabilities;

[0076] Monitor abnormal traffic on key ports in the asset vulnerability list in real time, identify unauthorized IoT device access, detect key control instructions output by risk software through memory behavior, calculate hash fingerprints for the key control instructions, and compare in real time to see if they have been tampered with.

[0077] The control instruction integrity check includes calculating the SHA-256 hash fingerprint of the PLC start and stop commands:

[0078]

[0079] If the real-time hash value does not match the baseline value, an alarm is triggered.

[0080] Regularly scanning industrial networks for weaknesses and vulnerabilities is a crucial tool for discovering and remediating potential security vulnerabilities. Vulnerability scanning tools can automatically identify common weaknesses and vulnerabilities in the system and provide recommendations and remediation measures. Real-time scanning can prevent ransomware from tampering with device control commands, preventing production line disruptions or abnormal equipment operation. Scans can also identify redundant, default-open ports, preventing attackers from exploiting them to launch brute force attacks or inject malicious commands. They can also identify unauthorized IoT devices, preventing them from becoming a springboard for intranet infiltration. They can also identify abnormal ports and promptly block botnet C2 communication channels.

[0081] S500: Establish a device configuration baseline and calculate the baseline deviation, integrate vulnerability severity to generate a device risk score, and trigger an in-depth monitoring strategy for high-risk devices.

[0082] In some embodiments, the device configuration baseline is established and the baseline deviation is calculated, and the vulnerability severity is integrated to generate a device risk score, triggering an in-depth monitoring strategy for high-risk devices;

[0083] Device configurations are regularly captured through SNMP / CLI, and difference analysis and calculation are performed against the baseline template to obtain the device risk score. When the device risk score is detected to exceed the threshold, the deep monitoring strategy for high-risk devices is triggered and mitigation measures are automatically executed.

[0084] In some embodiments, the formula for the device risk score is:

[0085]

[0086] in, Assign a CVSS score to the vulnerability. is the baseline deviation, is the deviation coefficient weight.

[0087] Baseline verification is a core practice in shifting industrial cybersecurity from passive defense to active immunity. It not only addresses hidden risks caused by configuration fragmentation but also provides a quantifiable and traceable security benchmark for the stable operation of smart factories.

[0088] The following describes the threat status monitoring process of this solution using a smart factory as an application scenario:

[0089] A smart factory deploys an industrial control system consisting of 100 PLC controllers, 20 SCADA servers, and a 5G industrial gateway. The network topology is divided into three layers: the device layer (Modbus / TCP protocol), the control layer (Profinet protocol), and the enterprise layer (HTTP / FTP protocol). Attackers may launch attacks through unauthorized IoT device access (risky port scanning), ransomware tampering with PLC instructions (risky software scanning), and lateral movement exploiting the CVE-2023-1234 vulnerability (threat intelligence linkage).

[0090] Step 1: Network traffic monitoring and protocol analysis;

[0091] Protocol analysis:

[0092] The network probe captures the entire traffic flow and uses deep packet inspection (DPI) technology to parse the protocol fields. For the Modbus protocol, it extracts the function code, register address, and data length. For the Profinet protocol, it extracts the IO device identifier, data cycle, and service type.

[0093] Dynamic threshold calculation:

[0094] Dynamically adjust thresholds based on an exponentially weighted moving average model:

[0095]

[0096] in, : current time threshold, : Current traffic characteristic value (such as the number of PLC write operations), : Smoothing factor, controlling the weight of historical data.

[0097] Anomaly Detection:

[0098] If the number of Modbus function code 0x06 (write single register) exceeds the threshold , triggering a level 1 alarm;

[0099] If the Profinet service type is "Write" and the data cycle is abnormally short (for example, <10ms), a level 2 alarm is triggered.

[0100] Step 2: Device log analysis and context awareness;

[0101] Core operation library construction:

[0102] Define the core operation type:

[0103] : PLC configuration modification (such as modifying register 40001), : SCADA screen switching, : Gateway routing table updated.

[0104] Define the core configuration library:

[0105] : PLC IP whitelist (such as 192.168.1.10-192.168.1.20), : List of minimum permissions for SCADA accounts.

[0106] Log semantic analysis:

[0107] If the log record matches And the source IP is not In, it is marked as a high-risk event. If the log record matches If the operation is performed during non-working hours, a level 3 alarm will be triggered.

[0108] Timing mode detection:

[0109] Use LSTM networks to model normal operation sequences and detect deviation patterns:

[0110]

[0111] in, is the abnormal probability threshold.

[0112] Step 3: Threat intelligence integration and multi-dimensional alerting;

[0113] Intelligence knowledge graph construction:

[0114] Access the CVE vulnerability library of the STIX / TAXII protocol and mark the vulnerability exploitation chain: 1. CVE-2023-1234 → lateral movement → ransomware encryption PLC instructions; 2. CVE-2022-4567 → unauthorized access → modification of SCADA configuration.

[0115] Intelligence-Log Correlation Analysis: If CVE-2023-1234 vulnerability exploitation traffic (such as abnormal NTLM authentication of SMB protocol) is detected and the corresponding host log contains If the operation is performed, a level 4 alarm will be triggered.

[0116] Dynamic adjustment of intelligence heat:

[0117] Calculating intelligence credibility weights :

[0118]

[0119] : Vulnerability CVSS score (e.g. CVE-2023-1234 scores 9.8), : The historical false alarm rate of the intelligence source (such as the CNVD false alarm rate of 0.05), : Empirical coefficient.

[0120] Step 4: Real-time monitoring of risk ports and software;

[0121] Port behavior fingerprint modeling:

[0122] Establish normal communication mode for OPC UA port 4840: Packet interval , standard deviation If a gap is detected and , marked as abnormal.

[0123] Control instruction integrity check:

[0124] Calculate the SHA-256 hash fingerprint of the PLC start and stop commands:

[0125]

[0126] If the real-time hash does not match the baseline value, a level 5 alarm is triggered.

[0127] Step 5: Baseline verification and risk scoring linkage;

[0128] Configure drift detection:

[0129] The PLC configuration is captured through SNMP and compared with the baseline template. The allowed protocol list includes: Modbus / TCP, Profinet. If the newly added HTTP protocol is detected, it is marked as configuration drift.

[0130] Risk score calculation:

[0131] Overall vulnerability severity Deviation coefficient from baseline :

[0132]

[0133] : Vulnerability CVSS score (e.g. CVE-2023-1234 scores 9.8), : Baseline deviation (such as adding HTTP protocol =0.5), : Deviation coefficient weight, if , triggering an automatic response.

[0134] In the second aspect, this application proposes an industrial network equipment threat status monitoring system, such as Figure 2 As shown, it includes anomaly feature detection module, device log analysis module, threat intelligence integration module, vulnerability risk scanning module and device risk analysis module;

[0135] The abnormal feature detection module is used to collect industrial network traffic through network probes, parse industrial control protocol fields and classify traffic types, and detect abnormal traffic features based on dynamic thresholds;

[0136] The device log analysis module is used to build a core operation type database and a core configuration library for device logs, perform semantic analysis and context association on log operation behaviors, and mark high-risk events;

[0137] The threat intelligence integration module is used to access multi-source threat intelligence data to build a knowledge graph, perform real-time correlation analysis between malicious IP / Hash values in the intelligence and local traffic and logs, and dynamically adjust monitoring priorities;

[0138] The vulnerability risk scanning module is used to perform non-invasive vulnerability scanning to generate an asset vulnerability list, and detect risk software by combining real-time port behavior fingerprints and control instruction integrity verification;

[0139] The device risk analysis module is used to establish a device configuration baseline and calculate the baseline deviation, integrate the vulnerability severity to generate a device risk score, and trigger an in-depth monitoring strategy for high-risk devices.

[0140] In a third aspect, the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0141] In a fourth aspect, the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0142] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0143] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0144] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0145] In the embodiments provided in the present disclosure, it should be understood that the disclosed apparatus / computer equipment and methods can be implemented in other ways. For example, the apparatus / computer equipment embodiments described above are merely schematic. For example, the division of modules or units is merely a logical function division. In actual implementation, there may be other division methods. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of the apparatus or unit, which may be electrical, mechanical or other forms.

[0146] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0147] In addition, the functional units in the various embodiments of the present disclosure may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0148] If the integrated module / unit is implemented as a software functional unit and sold or used as a standalone product, it can be stored in a computer-readable storage medium. Based on this understanding, the present disclosure can implement all or part of the process steps in the above-mentioned method embodiments by using a computer program to instruct the relevant hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, the computer program can implement the steps of each of the above-mentioned method embodiments. The computer program can include computer program code, which can be in source code form, object code form, executable file, or some intermediate form. Computer-readable media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, removable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunications signals, and software distribution media. It should be noted that the content included in computer-readable media can be appropriately increased or decreased based on the requirements of legislation and patent practice in a jurisdiction. For example, in some jurisdictions, based on legislation and patent practice, computer-readable media does not include electrical carrier signals and telecommunications signals.

[0149] The above are only preferred embodiments of the present invention. It should be pointed out that various modifications and improvements made by those skilled in the art without departing from the present technical solution should also be deemed to fall within the scope of protection required by this solution.

Claims

1. A method for monitoring the threat status of industrial network equipment, characterized by: The following steps are involved: Collect industrial network traffic through network probes, parse industrial control protocol fields and classify traffic types, and detect traffic anomalies based on dynamic thresholds; Build a core operation type database and core configuration library for device logs, perform semantic analysis and contextual association on log operation behaviors, and mark high-risk events; Access multi-source threat intelligence data to build a knowledge graph, conduct real-time correlation analysis between malicious IP / Hash values in the intelligence and local traffic and logs, and dynamically adjust monitoring priorities; Perform non-invasive vulnerability scanning to generate an asset vulnerability list, and detect risky software by combining real-time port behavior fingerprinting with control instruction integrity verification; Establish a device configuration baseline and calculate the baseline deviation, integrate vulnerability severity to generate a device risk score, and trigger in-depth monitoring strategies for high-risk devices.

2. The method according to claim 1, wherein: The method of collecting industrial network traffic through network probes, parsing industrial control protocol fields and classifying traffic types, and detecting traffic anomaly characteristics based on dynamic thresholds includes: Deep packet inspection technology is used to parse the industrial control protocol field. When the industrial control protocol field is the Modbus protocol, the function code, register address, and data length are extracted. When the industrial control protocol field is the Profinet protocol, the IO device identifier, data cycle, and service type are extracted, and the detection threshold is dynamically adjusted based on the exponentially weighted moving average model. Traffic features are extracted based on the detection threshold and matched with a preset threat intelligence library.

3. The method according to claim 2, wherein: The core operation type database and core configuration library of the device log are constructed, semantic analysis and context association of log operation behaviors are performed, and high-risk events are marked, including: In the device log analysis step, an LSTM network is used to learn normal operation sequences, detect deviation patterns, associate log events with asset attributes, and perform semantic analysis on the operation behaviors in the log events. If the operation involves the core configuration library content and there is no legal authorization certificate, it is marked as a high-risk event.

4. The method according to claim 3, wherein: The method involves accessing multi-source threat intelligence data to build a knowledge graph, performing real-time correlation analysis between malicious IP addresses / hash values in the intelligence and local traffic and logs, and dynamically adjusting monitoring priorities, including: Connect to external intelligence sources through the STIX or TAXII protocol, build a local threat intelligence knowledge graph, and annotate vulnerability exploit chains; Based on the vulnerability exploitation chain, the malicious IP / Hash value in the external intelligence source is correlated with the local traffic / log in real time, the intelligence source is scored for credibility, the threat index is weighted and calculated, and multi-dimensional alarms are triggered based on the threat index.

5. The method according to claim 4, characterized in that: The non-intrusive vulnerability scan generates an asset vulnerability list, combines real-time port behavior fingerprints with control instruction integrity verification to detect risk software, including: Regularly perform non-intrusive vulnerability scans to generate a list of asset vulnerabilities; Monitor abnormal traffic on key ports in the asset vulnerability list in real time, identify unauthorized IoT device access, detect key control instructions output by risk software through memory behavior, calculate hash fingerprints for the key control instructions, and compare in real time to see if they have been tampered with.

6. The method according to claim 5, characterized in that: Establishing a device configuration baseline and calculating the baseline deviation, integrating vulnerability severity to generate a device risk score, and triggering an in-depth monitoring strategy for high-risk devices; Device configurations are regularly captured through SNMP / CLI, and difference analysis and calculation are performed against the baseline template to obtain the device risk score. When the device risk score is detected to exceed the threshold, the deep monitoring strategy for high-risk devices is triggered and mitigation measures are automatically executed.

7. The method according to claim 6, characterized in that: The formula for the device risk score is: in, Assign a CVSS score to the vulnerability. is the baseline deviation, is the deviation coefficient weight.

8. An industrial network equipment threat status monitoring system, characterized by: It includes abnormal feature detection module, device log analysis module, threat intelligence integration module, vulnerability risk scanning module and device risk analysis module; The abnormal feature detection module is used to collect industrial network traffic through network probes, parse industrial control protocol fields and classify traffic types, and detect abnormal traffic features based on dynamic thresholds; The device log analysis module is used to build a core operation type database and a core configuration library for device logs, perform semantic analysis and context association on log operation behaviors, and mark high-risk events; The threat intelligence integration module is used to access multi-source threat intelligence data to build a knowledge graph, perform real-time correlation analysis between malicious IP / Hash values in the intelligence and local traffic and logs, and dynamically adjust monitoring priorities; The vulnerability risk scanning module is used to perform non-invasive vulnerability scanning to generate an asset vulnerability list, and detect risk software by combining real-time port behavior fingerprints and control instruction integrity verification; The device risk analysis module is used to establish a device configuration baseline and calculate the baseline deviation, integrate the vulnerability severity to generate a device risk score, and trigger an in-depth monitoring strategy for high-risk devices.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images