A method and system for monitoring the status of industrial network threats.

Abstract

This invention discloses an industrial network threat status monitoring method and system, belonging to the field of industrial system security technology. By integrating traffic characteristics, device logs, threat intelligence and vulnerability scanning data for collaborative analysis, this invention solves the limitations of single traffic detection, establishes a real-time correlation mechanism between log events and traffic anomalies, shortens the threat confirmation and response time from the traditional hour level to the minute level, and realizes proactive policy adjustment based on the linkage between configuration baseline deviation and vulnerability scanning results.

Description

Technical Field

[0001] This invention belongs to the field of industrial system security technology, specifically relating to an industrial network threat status monitoring method and system. Background Technology

[0002] Industrial control systems are widely used in critical national infrastructure sectors such as power, manufacturing, and energy. Their cybersecurity is directly related to the stable operation and physical security of production systems. With the development of the Industrial Internet, cyberattacks against industrial control systems are becoming more frequent and covert. In particular, targeted attacks such as advanced persistent threats pose a serious challenge to traditional monitoring technologies.

[0003] According to industry test data (see the "2023 Industrial Cybersecurity White Paper"), a single traffic analysis solution has a detection rate of less than 55% for industrial control system ransomware, and 60% of deployed systems have incomplete configuration baseline coverage. Although existing technologies have attempted to combine multi-source data, they still suffer from drawbacks such as coarse data correlation granularity and rigid response strategies, and their effectiveness is limited, especially when dealing with advanced threats such as command and control communication in encrypted traffic and tampering with the logic of industrial control protocols.

[0004] Current industrial network threat monitoring mainly relies on network traffic analysis technology, which has the following limitations:

[0005] Single detection dimension: Existing solutions overemphasize traffic characteristics, making it difficult to identify low-frequency covert attack behaviors such as the lateral penetration stage in APT attacks, resulting in a high false negative rate;

[0006] Significant response lag: The detection mechanism based on static rules cannot effectively link device operation logs with real-time vulnerability status, resulting in a long threat confirmation cycle and delays in emergency response.

[0007] Fragmented intelligence application: External threat intelligence lacks dynamic integration with local asset allocation and vulnerability data, making it impossible to build accurate risk assessment models;

[0008] Passive defense deficiency: lack of a coordinated mechanism between baseline verification and active scanning. For example, when the device configuration deviates from the baseline, it cannot automatically trigger deep detection, making it difficult to achieve active immune defense. Summary of the Invention

[0009] To address the shortcomings of the existing technologies, this application provides a method and system for monitoring the threat status of industrial network equipment.

[0010] The first aspect of this application proposes a method for monitoring the threat status of industrial network devices, including the following steps:

[0011] Industrial network traffic is collected using network probes, industrial control protocol fields are parsed and traffic types are classified, and abnormal traffic characteristics are detected based on dynamic thresholds.

[0012] Build a core operation type database and core configuration library for device logs, perform semantic analysis and context association on log operation behaviors, and mark high-risk events;

[0013] By integrating multi-source threat intelligence data to build a knowledge graph, malicious IPs / Hash values ​​in the intelligence are correlated and analyzed in real time with local traffic and logs, and monitoring priorities are dynamically adjusted.

[0014] Perform non-intrusive vulnerability scanning to generate an asset vulnerability list, and combine real-time port behavior fingerprinting and control command integrity verification to detect risky software;

[0015] Establish a device configuration baseline and calculate the baseline deviation. Combine vulnerability severity to generate a device risk score and trigger a deep monitoring strategy for high-risk devices.

[0016] In some embodiments, the step of collecting industrial network traffic through network probes, parsing industrial control protocol fields and classifying traffic types, and detecting abnormal traffic characteristics based on dynamic thresholds includes:

[0017] The industrial control protocol field is parsed using deep packet inspection technology. When the industrial control protocol field is Modbus protocol, the function code, register address, and data length are extracted. When the industrial control protocol field is Profinet protocol, the IO device identifier, data period, and service type are extracted. The detection threshold is dynamically adjusted based on the exponential weighted moving average model.

[0018] Traffic features are extracted based on the detection threshold and matched with a preset threat intelligence database.

[0019] In some embodiments, the construction of the core operation type database and core configuration library for device logs, performing semantic analysis and contextual association on log operation behaviors, and marking high-risk events includes:

[0020] In the device log analysis step, an LSTM network is used to learn normal operation sequences, detect deviation patterns, associate log events with asset attributes, and perform semantic analysis on the operation behaviors in the log events. If the operation involves core configuration library content and there is no valid authorization certificate, it is marked as a high-risk event.

[0021] In some embodiments, the access to multi-source threat intelligence data to construct a knowledge graph, and the real-time correlation analysis of malicious IP / Hash values ​​in the intelligence with local traffic and logs to dynamically adjust monitoring priorities, includes:

[0022] Access external intelligence sources via STIX or TAXII protocols, construct a local threat intelligence knowledge graph, and label vulnerability exploitation chains;

[0023] Based on the vulnerability exploitation chain, the malicious IP / Hash value in the external intelligence source is correlated and analyzed with local traffic / logs in real time. The credibility score of the intelligence source is scored, the threat index is calculated by weighting, and multi-dimensional alarms are triggered based on the threat index.

[0024] In some embodiments, the process of performing non-intrusive vulnerability scanning to generate an asset vulnerability list, combined with real-time port behavior fingerprinting and control command integrity verification to detect risks, includes:

[0025] Regularly perform non-intrusive vulnerability scans to generate an asset vulnerability list;

[0026] Real-time monitoring of abnormal traffic on key ports in the asset vulnerability list identifies unauthorized IoT device access. Key control commands output by the memory behavior detection risk software are used to calculate hash fingerprints and compare them in real time to see if they have been tampered with.

[0027] In some embodiments, the establishment of a device configuration baseline and calculation of baseline deviation, the fusion of vulnerability severity to generate a device risk score, and the triggering of a deep monitoring strategy for high-risk devices;

[0028] Device configurations are periodically captured via SNMP / CLI, and their differences are analyzed and calculated against a baseline template to obtain a device risk score. When a device risk score is detected to exceed a threshold, a deep monitoring strategy for high-risk devices is triggered, and mitigation measures are automatically executed.

[0029] In some embodiments, the formula for the device risk score is:

[0030]

[0031] in, CVSS score for vulnerabilities Baseline deviation, This is the deviation coefficient weight.

[0032] Secondly, this application proposes an industrial network device threat status monitoring system, including an anomaly feature detection module, a device log analysis module, a threat intelligence integration module, a vulnerability risk scanning module, and a device risk analysis module;

[0033] The abnormal feature detection module is used to collect industrial network traffic through network probes, parse industrial control protocol fields and classify traffic types, and detect abnormal traffic features based on dynamic thresholds.

[0034] The device log analysis module is used to build a core operation type database and a core configuration library for device logs, perform semantic analysis and context association on log operation behaviors, and mark high-risk events.

[0035] The threat intelligence integration module is used to access multi-source threat intelligence data to build a knowledge graph, perform real-time correlation analysis between malicious IPs / Hash values ​​in the intelligence and local traffic and logs, and dynamically adjust the monitoring priority.

[0036] The vulnerability risk scanning module is used to perform non-intrusive vulnerability scanning to generate an asset vulnerability list, and to detect risky software by combining real-time port behavior fingerprinting and control command integrity verification.

[0037] The device risk analysis module is used to establish a device configuration baseline and calculate the baseline deviation, integrate vulnerability severity to generate a device risk score, and trigger a deep monitoring strategy for high-risk devices.

[0038] Thirdly, this application proposes an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described above.

[0039] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described above.

[0040] The beneficial effects of this invention are:

[0041] This invention overcomes the limitations of single traffic detection by integrating traffic characteristics, device logs, threat intelligence, and vulnerability scanning data through collaborative analysis. It establishes a real-time correlation mechanism between log events and traffic anomalies, reducing threat confirmation and response time from hours to minutes. Based on the linkage between configuration baseline deviation and vulnerability scanning results (risk score = vulnerability severity × baseline deviation coefficient), it enables proactive policy adjustment. Attached Figure Description

[0042] Figure 1 This is the overall flowchart of the present invention.

[0043] Figure 2 This is a system principle block diagram of the present invention. Detailed Implementation

[0044] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein; rather, these embodiments are provided so that a more thorough understanding of the invention can be achieved and that the full scope of the invention can be conveyed to those skilled in the art.

[0045] Firstly, this application proposes a method for monitoring the threat status of industrial network devices, such as... Figure 1 As shown, it includes the following steps:

[0046] S100: Collects industrial network traffic through network probes, parses industrial control protocol fields and classifies traffic types, and detects abnormal traffic characteristics based on dynamic thresholds;

[0047] In some embodiments, the step of collecting industrial network traffic through network probes, parsing industrial control protocol fields and classifying traffic types, and detecting abnormal traffic characteristics based on dynamic thresholds includes:

[0048] The industrial control protocol field is parsed using deep packet inspection technology. When the industrial control protocol field is Modbus protocol, the function code, register address, and data length are extracted. When the industrial control protocol field is Profinet protocol, the IO device identifier, data period, and service type are extracted. The detection threshold is dynamically adjusted based on the exponential weighted moving average model.

[0049] Traffic features are extracted based on the detection threshold and matched with a preset threat intelligence database.

[0050] By monitoring network traffic in industrial networks, abnormal activities can be detected in a timely manner, such as large-scale host scanning, abnormal data transmission, and unauthorized access.

[0051] Technical means and execution process:

[0052] 1. Collect raw system data through network probes, including collecting full traffic data through network probes, parsing protocol fields (such as Modbus and Profinet), and classifying traffic types.

[0053] 2. Analyze the protocol fields of the raw data, identify the traffic type, and set threshold rules based on the characteristics of the industrial control protocol (such as triggering an alarm when the number of PLC write operations exceeds the threshold within a unit of time).

[0054] 3. Perform quantitative analysis on different traffic types, extract traffic characteristics (such as abnormal protocol field combinations, unauthorized access patterns), and match them with the threat intelligence database.

[0055] Among them, dynamically adjusting the detection threshold based on the exponentially weighted moving average model includes:

[0056]

[0057] in, The current threshold, This represents the current traffic characteristic value. This is a smoothing factor.

[0058] S200: Constructs a core operation type database and core configuration library for device logs, performs semantic analysis and contextual association on log operation behaviors, and marks high-risk events;

[0059] In some embodiments, the construction of the core operation type database and core configuration library for device logs, performing semantic analysis and contextual association on log operation behaviors, and marking high-risk events includes:

[0060] In the device log analysis step, an LSTM network is used to learn normal operation sequences, detect deviation patterns, associate log events with asset attributes, and perform semantic analysis on the operation behaviors in the log events. If the operation involves core configuration library content and there is no valid authorization certificate, it is marked as a high-risk event.

[0061] In this process, an LSTM network is used to model normal operating sequences, and abnormal patterns are detected probabilistically.

[0062]

[0063] For the current operation, This is the threshold for the probability of anomalies.

[0064] Various devices in industrial networks (such as PLCs, SCADA controllers, and industrial routers) typically generate logs to record system operating status and events. Analyzing these logs can reveal abnormal behavior and potential threats. For example, establishing core operation type databases (such as PLC configuration modifications and SCADA screen switching) and core configuration databases (such as device IP whitelists) can identify abnormal behavior when log operations involve content in these core databases (such as modifying PLC control logic without valid authorization credentials), potentially posing risks. Other examples include login failures, access attempts, abnormal operations, and configuration changes.

[0065] S300: Connects to multi-source threat intelligence data to build a knowledge graph, performs real-time correlation analysis between malicious IPs / Hash values ​​in the intelligence and local traffic and logs, and dynamically adjusts monitoring priorities;

[0066] In some embodiments, the access to multi-source threat intelligence data to construct a knowledge graph, and the real-time correlation analysis of malicious IP / Hash values ​​in the intelligence with local traffic and logs to dynamically adjust monitoring priorities, includes:

[0067] Access external intelligence sources via STIX or TAXII protocols, construct a local threat intelligence knowledge graph, and label vulnerability exploitation chains;

[0068] Based on the vulnerability exploitation chain, the malicious IP / Hash value in the external intelligence source is correlated and analyzed with local traffic / logs in real time. The credibility score of the intelligence source is scored, the threat index is calculated by weighting, and multi-dimensional alarms are triggered based on the threat index.

[0069] The weighted calculation of threat metrics includes calculating the credibility weight of intelligence:

[0070]

[0071] CVSS score for vulnerabilities Historical false alarm rate of intelligence sources This is an empirical coefficient.

[0072] Establishing an effective threat intelligence collection and analysis system can help industrial network administrators understand current security threats and attack trends. By subscribing to threat intelligence services from security organizations, participating in security forums and exchange activities, and sharing security incidents and information with other organizations, information on the latest threats can be obtained, enabling timely and appropriate defensive measures. Intelligence sources include CNVD, CICSVD, NVD, CVE, and commercial threat intelligence platforms. Threat intelligence from these sources is stored in a database, categorized by risk level, and weighted to calculate threat indicators. The integration logic involves correlating external intelligence with local logs (e.g., matching IP blacklists, malicious hash values) and triggering multi-dimensional alerts.

[0073] S400: Performs non-intrusive vulnerability scanning to generate an asset vulnerability list, and combines real-time port behavior fingerprinting and control command integrity verification to detect risky software.

[0074] In some embodiments, the process of performing non-intrusive vulnerability scanning to generate an asset vulnerability list, combined with real-time port behavior fingerprinting and control command integrity verification to detect risks, includes:

[0075] Regularly perform non-intrusive vulnerability scans to generate an asset vulnerability list;

[0076] Real-time monitoring of abnormal traffic on key ports in the asset vulnerability list identifies unauthorized IoT device access. Key control commands output by the memory behavior detection risk software are used to calculate hash fingerprints and compare them in real time to see if they have been tampered with.

[0077] Control instruction integrity verification includes calculating the SHA-256 hash fingerprint of the PLC start / stop commands:

[0078]

[0079] If the real-time hash value does not match the baseline value, an alarm will be triggered.

[0080] Regularly scanning industrial networks for weaknesses and vulnerabilities is a crucial method for discovering and patching potential security vulnerabilities. Vulnerability scanning tools can automatically identify common weaknesses and vulnerabilities in a system and provide relevant suggestions and remediation measures. Real-time scanning can intercept ransomware tampering with device control commands, preventing production line paralysis or abnormal equipment operation. Scanning can discover redundant ports that are open by default, preventing attackers from using these ports to launch brute-force attacks or inject malicious commands. It can identify unauthorized IoT devices, preventing them from becoming springboards for internal network penetration. It can also detect abnormal ports and promptly block the C2 communication channels of botnets.

[0081] S500: Establishes a device configuration baseline and calculates the baseline deviation, integrates vulnerability severity to generate a device risk score, and triggers in-depth monitoring strategies for high-risk devices.

[0082] In some embodiments, the establishment of a device configuration baseline and calculation of baseline deviation, the fusion of vulnerability severity to generate a device risk score, and the triggering of a deep monitoring strategy for high-risk devices;

[0083] Device configurations are periodically captured via SNMP / CLI, and their differences are analyzed and calculated against a baseline template to obtain a device risk score. When a device risk score is detected to exceed a threshold, a deep monitoring strategy for high-risk devices is triggered, and mitigation measures are automatically executed.

[0084] In some embodiments, the formula for the device risk score is:

[0085]

[0086] in, CVSS score for vulnerabilities Baseline deviation This is the deviation coefficient weight.

[0087] Baseline verification is a core practice in industrial cybersecurity, shifting from "passive defense" to "proactive immunity." It not only addresses the hidden risks caused by fragmented configurations but also provides quantifiable and traceable security benchmarks for the stable operation of smart factories.

[0088] The following describes the threat status monitoring process of this solution using a smart factory as an application scenario:

[0089] A smart factory has deployed an industrial control system, including 100 PLC controllers, 20 SCADA servers, and a 5G industrial gateway. The network topology is divided into three layers: device layer (Modbus / TCP protocol), control layer (Profinet protocol), and enterprise layer (HTTP / FTP protocol). Attackers may launch attacks through unauthorized IoT device access (risky port scanning), ransomware tampering with PLC instructions (risky software scanning), and lateral movement exploiting the CVE-2023-1234 vulnerability (threat intelligence linkage), among other methods.

[0090] Step 1: Network traffic monitoring and protocol parsing;

[0091] Protocol parsing:

[0092] The network probe captures the entire traffic and uses Deep Packet Inspection (DPI) technology to parse protocol fields. For the Modbus protocol, it extracts the function code, register address, and data length. For the Profinet protocol, it extracts the IO device identifier, data cycle, and service type.

[0093] Dynamic threshold calculation:

[0094] Thresholds are dynamically adjusted based on an exponentially weighted moving average model.

[0095]

[0096] in, : Threshold at the current time : Current flow characteristics (e.g., number of PLC write operations) Smoothing factor: controls the weighting of historical data.

[0097] Anomaly detection:

[0098] If the number of Modbus function code 0x06 (write to a single register) exceeds the threshold This triggers a Level 1 alarm;

[0099] If the Profinet service type is "Write" and the data period is abnormally shortened (e.g., <10ms), a level 2 alarm will be triggered.

[0100] Step 2: Device log analysis and context awareness;

[0101] Core operations library construction:

[0102] Define the core operation types:

[0103] : PLC configuration modification (e.g., modifying register 40001). SCADA screen switching Gateway routing table update.

[0104] Define the core configuration library:

[0105] PLC IP whitelist (e.g., 192.168.1.10-192.168.1.20). List of minimum privileges for SCADA accounts.

[0106] Log semantic analysis:

[0107] If the log records match And the source IP is not there In the middle, it is marked as a high-risk event, if the log record matches Furthermore, the operation occurred outside of working hours, triggering a Level 3 alarm.

[0108] Timing pattern detection:

[0109] An LSTM network is used to model normal operating sequences and detect deviation patterns.

[0110]

[0111] in, This is the threshold for the probability of anomalies.

[0112] Step 3: Threat intelligence integration and multi-dimensional alerts;

[0113] Intelligence knowledge graph construction:

[0114] Access the STIX / TAXII protocol CVE vulnerability database and mark the vulnerability exploitation chain as follows: 1. CVE-2023-1234 → Lateral movement → Ransomware encrypts PLC instructions; 2. CVE-2022-4567 → Unauthorized access → Modification of SCADA configuration.

[0115] Intelligence - Log Correlation Analysis: If CVE-2023-1234 vulnerability exploitation traffic is detected (such as SMB protocol abnormal NTLM authentication) and the corresponding host logs contain... If the operation is performed, a level four alarm will be triggered.

[0116] Intelligence popularity is dynamically adjusted:

[0117] Calculate the credibility weight of intelligence :

[0118]

[0119] Vulnerability CVSS score (e.g., CVE-2023-1234 score 9.8). Historical false alarm rate of intelligence sources (e.g., CNVD false alarm rate of 0.05). : Empirical coefficient.

[0120] Step 4: Real-time monitoring of risk points and software;

[0121] Port behavior fingerprinting:

[0122] Establish normal communication mode on OPC UA port 4840: packet interval Standard deviation If an interval is detected and Mark it as an exception.

[0123] Control command integrity verification:

[0124] Calculate the SHA-256 hash fingerprint for PLC start / stop commands:

[0125]

[0126] If the real-time hash does not match the baseline value, a level 5 alarm will be triggered.

[0127] Step 5: Linking baseline verification with risk scoring;

[0128] Configure drift detection:

[0129] The PLC configuration is captured via SNMP and compared with the baseline template. The allowed protocol list includes Modbus / TCP and Profinet. If a new HTTP protocol is detected, it is marked as a configuration drift.

[0130] Risk score calculation:

[0131] Overall vulnerability severity Deviation coefficient from baseline :

[0132]

[0133] Vulnerability CVSS score (e.g., CVE-2023-1234 score 9.8). Baseline deviation (e.g., adding HTTP protocol) =0.5), : Deviation coefficient weight, if This triggers an automatic response.

[0134] Secondly, this application proposes an industrial network device threat status monitoring system, such as... Figure 2 As shown, it includes an anomaly detection module, a device log analysis module, a threat intelligence integration module, a vulnerability risk scanning module, and a device risk analysis module;

[0135] The abnormal feature detection module is used to collect industrial network traffic through network probes, parse industrial control protocol fields and classify traffic types, and detect abnormal traffic features based on dynamic thresholds.

[0136] The device log analysis module is used to build a core operation type database and a core configuration library for device logs, perform semantic analysis and context association on log operation behaviors, and mark high-risk events.

[0137] The threat intelligence integration module is used to access multi-source threat intelligence data to build a knowledge graph, perform real-time correlation analysis between malicious IPs / Hash values ​​in the intelligence and local traffic and logs, and dynamically adjust the monitoring priority.

[0138] The vulnerability risk scanning module is used to perform non-intrusive vulnerability scanning to generate an asset vulnerability list, and to detect risky software by combining real-time port behavior fingerprinting and control command integrity verification.

[0139] The device risk analysis module is used to establish a device configuration baseline and calculate the baseline deviation, integrate vulnerability severity to generate a device risk score, and trigger a deep monitoring strategy for high-risk devices.

[0140] Thirdly, this application proposes an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described above.

[0141] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described above.

[0142] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0143] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0144] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0145] In the embodiments provided in this disclosure, it should be understood that the disclosed apparatus / computer devices and methods can be implemented in other ways. For example, the apparatus / computer device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0146] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0147] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0148] If an integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program may include computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. A computer-readable medium may include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in a computer-readable medium may be appropriately added to or subtracted according to the requirements of legislation and patent practice in a jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0149] The above are merely preferred embodiments of the present invention. It should be noted that any modifications and improvements made by those skilled in the art without departing from the present technical solution should also be considered to fall within the scope of protection claimed by the present solution.

Claims

1. A method for monitoring the threat status of industrial network devices, characterized in that: Includes the following steps: Industrial network traffic is collected using network probes, industrial control protocol fields are parsed and traffic types are classified, and abnormal traffic characteristics are detected based on dynamic thresholds. Build a core operation type database and core configuration library for device logs, perform semantic analysis and context association on log operation behaviors, and mark high-risk events; By accessing multi-source threat intelligence data to build a knowledge graph, the malicious IPs / Hash values ​​in the intelligence are correlated with local traffic and logs in real time for analysis, and the monitoring priority is dynamically adjusted. In particular, external intelligence sources are accessed through STIX or TAXII protocols to build a local threat intelligence knowledge graph and mark vulnerability exploitation chains. Based on the vulnerability exploitation chain, the malicious IP / Hash value in the external intelligence source is correlated and analyzed with local traffic / logs in real time. The intelligence source is scored for credibility, and the threat index is calculated in a weighted manner. Multi-dimensional alarms are triggered based on the threat index. The weighted calculation of threat metrics includes calculating the credibility weight of intelligence: CVSS score for vulnerabilities Historical false alarm rate of intelligence sources This is an empirical coefficient; Perform non-intrusive vulnerability scanning to generate an asset vulnerability list, and combine real-time port behavior fingerprinting and control command integrity verification to detect risky software; Establish a device configuration baseline and calculate the baseline deviation. Combine vulnerability severity to generate a device risk score and trigger a deep monitoring strategy for high-risk devices. Specifically, device configuration is periodically captured via SNMP / CLI and its difference is analyzed and calculated with the baseline template to obtain the device risk score. When the device risk score is detected to exceed the threshold, the deep monitoring strategy for high-risk devices is triggered and mitigation measures are automatically executed. The formula for the equipment risk score is: in, CVSS score for vulnerabilities Baseline deviation, This is the deviation coefficient weight.

2. The method according to claim 1, characterized in that: The process of collecting industrial network traffic through network probes, parsing industrial control protocol fields and classifying traffic types, and detecting abnormal traffic characteristics based on dynamic thresholds includes: The industrial control protocol field is parsed using deep packet inspection technology. When the industrial control protocol field is Modbus protocol, the function code, register address, and data length are extracted. When the industrial control protocol field is Profinet protocol, the IO device identifier, data period, and service type are extracted. The detection threshold is dynamically adjusted based on the exponential weighted moving average model. Traffic features are extracted based on the detection threshold and matched with a preset threat intelligence database.

3. The method according to claim 2, characterized in that: The core operation type database and core configuration library for constructing device logs perform semantic analysis and contextual association on log operation behaviors, and mark high-risk events, including: In the device log analysis step, an LSTM network is used to learn normal operation sequences, detect deviation patterns, associate log events with asset attributes, and perform semantic analysis on the operation behaviors in the log events. If the operation involves core configuration library content and there is no valid authorization certificate, it is marked as a high-risk event.

4. The method according to claim 3, characterized in that: The software that performs non-intrusive vulnerability scanning to generate an asset vulnerability list, and combines real-time port behavior fingerprinting and control command integrity verification to detect risks, includes: Regularly perform non-intrusive vulnerability scans to generate an asset vulnerability list; Real-time monitoring of abnormal traffic on key ports in the asset vulnerability list identifies unauthorized IoT device access. Key control commands output by the memory behavior detection risk software are used to calculate hash fingerprints and compare them in real time to see if they have been tampered with.

5. An industrial network device threat status monitoring system, characterized in that: It includes an anomaly detection module, a device log analysis module, a threat intelligence integration module, a vulnerability risk scanning module, and a device risk analysis module; The abnormal feature detection module is used to collect industrial network traffic through network probes, parse industrial control protocol fields and classify traffic types, and detect abnormal traffic features based on dynamic thresholds. The device log analysis module is used to build a core operation type database and a core configuration library for device logs, perform semantic analysis and context association on log operation behaviors, and mark high-risk events. The threat intelligence integration module is used to access multi-source threat intelligence data to build a knowledge graph, perform real-time correlation analysis between malicious IPs / Hash values ​​in the intelligence and local traffic and logs, and dynamically adjust monitoring priorities. It accesses external intelligence sources through STIX or TAXII protocols to build a local threat intelligence knowledge graph and annotate vulnerability exploitation chains. Based on the vulnerability exploitation chain, the malicious IP / Hash value in the external intelligence source is correlated and analyzed with local traffic / logs in real time. The intelligence source is scored for credibility, and the threat index is calculated in a weighted manner. Multi-dimensional alarms are triggered based on the threat index. The weighted calculation of threat metrics includes calculating the credibility weight of intelligence: CVSS score for vulnerabilities Historical false alarm rate of intelligence sources This is an empirical coefficient; The vulnerability risk scanning module is used to perform non-intrusive vulnerability scanning to generate an asset vulnerability list, and to detect risky software by combining real-time port behavior fingerprinting and control command integrity verification. The device risk analysis module is used to establish a device configuration baseline and calculate the baseline deviation, integrate vulnerability severity to generate a device risk score, and trigger a deep monitoring strategy for high-risk devices. Specifically, the device configuration is periodically captured via SNMP / CLI, and its difference is analyzed and calculated with the baseline template to obtain the device risk score. When the device risk score is detected to exceed the threshold, the deep monitoring strategy for high-risk devices is triggered, and mitigation measures are automatically executed. The formula for the equipment risk score is: in, CVSS score for vulnerabilities Baseline deviation, This is the deviation coefficient weight.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1-4.

Images