Defense monitoring system and method

Abstract

The invention relates to the technical field of network security defense, and discloses a defense monitoring system and method.In the system, a data acquisition module acquires equipment state information in an integrated engine and establishes a first log report according to the equipment state information to obtain a first attack database; the data acquisition module also acquires network flow data in the integrated engine and establishes a second log report according to the network flow data to obtain a second attack database, and the intrusion monitoring module extracts attack features of the first attack database and flow features of the second attack database and sends the attack features and the flow features to the integrated engine; and the central management module receives the attack feature and the to-be-attacked feature, determines an attack similar report according to the attack feature and the to-be-attacked feature, analyzes the abnormal behavior of the OT / IT protocol according to the traffic feature, generates a running log according to the attack similar report and the abnormal behavior, and gives an alarm according to the running state of the running log. The method has the characteristics of good monitoring effect and graded alarm for multi-dimensional data.

Description

Technical Field

[0001] The present application relates to the field of network security defense technology, and more specifically, to a defense monitoring system and method. Background Art

[0002] With the rapid development of information technology, the threats to oil and gas pipeline network security are becoming increasingly complex. The integrated operational technology (OT) and information technology (IT) engines within oil and gas pipeline networks are also posing more cybersecurity challenges. To address potential security threats, monitoring of the integrated OT / IT engine is necessary.

[0003] Existing monitoring technologies typically only process single data points and issue alerts when threats are detected. While existing technologies can monitor integrated engines, they are unable to process the multi-dimensional data contained within these engines, presenting limitations and failing to meet the precise, real-time security requirements of oil and gas pipeline networks. Summary of the Invention

[0004] In view of this, the present application proposes a defense monitoring system and method, which aims to solve the problem that current technology is difficult to meet the precise and real-time security requirements in oil and gas pipeline networks.

[0005] In the first aspect, the present application proposes a defense monitoring system, comprising: a defense monitoring system, optionally comprising: a data acquisition module, an intrusion monitoring module and a central management module; the data acquisition module is configured to collect device status information in the integrated engine, and establish a first log report based on the device status information to obtain a first attack database; the data acquisition module is also configured to collect network traffic data in the integrated engine, and establish a second log report based on the network traffic data to obtain a second attack database; the intrusion monitoring module is configured to extract attack features of the first attack database, and determine an attack similarity report based on the attack features and features to be attacked; the intrusion monitoring module is also configured to extract traffic features of the second attack database based on a time series model, and analyze abnormal behavior of the OT / IT protocol based on the traffic features; the central management module is configured to generate an operation log based on the attack similarity report and abnormal behavior, and issue an alarm based on the operation status of the operation log.

[0006] Optionally, the device status information includes: text information, image information and file information of the device status; when collecting the device status information in the integrated engine and establishing a first log report based on the device status information, it includes: the data acquisition module aligns the text information and image information based on the graphic and text multimodal model to obtain matching information, pre-processes the matching information and file information, and constructs information partitions, and the data acquisition module establishes the first log report based on the information partitions.

[0007] Optionally, when collecting network traffic data in the integrated engine and establishing a second log report based on the network traffic data, it includes: collecting network traffic data based on a network sniffing tool, and cleaning and standardizing the network traffic data; cleaning and standardization include: obtaining byte segments of the network traffic data, and dividing the byte segments into byte points; setting a starting point from the byte points, searching for all byte points in the neighborhood of the starting point, and if there are at least a preset number of byte points in the neighborhood, the starting point is defined as the cluster center of the byte points; expanding the cluster from the cluster center, and if the number of byte points in the neighborhood of the cluster center is less than a preset number, the byte points less than the preset number are determined as boundary points; repeatedly setting the starting point until all byte points are set as starting points, eliminating all the obtained boundary points, and establishing a second log report based on all the obtained cluster centers.

[0008] Optionally, extracting the attack features of the first attack database and determining the attack similarity report based on the attack features and the features to be attacked includes: determining the same first log report from the first attack database, constructing a first log report set, and counting the number of elements of the same first log report in the first log report set; calculating the attack feature value based on the number of elements and the duration of launching the attack, and calculating the feature value to be attacked based on the features to be attacked; determining the attack matching similarity based on the attack feature value and the feature value to be attacked, and establishing the attack similarity report based on the attack matching similarity.

[0009] Optionally, when calculating the attack characteristic value based on the number of elements and the duration of the attack, the attack characteristic value satisfies the following formula:

[0010]

[0011] Among them, A represents the attack feature value, E i represents the number of elements in the ith order, T represents the duration, and T max Indicates the maximum value of the duration.

[0012] Optionally, calculating the characteristic value to be attacked based on the characteristic to be attacked includes: obtaining the number of requests to be attacked, the number of times the abnormal script is used, and the continuous time of access; calculating the characteristic value to be attacked based on the number of requests, the number of times the abnormal script is used, and the continuous time; the characteristic value to be attacked satisfies the following formula:

[0013] B=w1×J+w2×K+L;

[0014] Where B represents the attack feature value, J represents the number of requests, K represents the number of times the abnormal script is used, L represents the continuous time, w1 represents the weight of the number of requests, w2 represents the weight of the number of times the abnormal script is used, and the sum of w1 and w2 is 1.5.

[0015] Optionally, determining the attack matching similarity based on the attack feature value and the feature value to be attacked, and creating an attack similarity report based on the attack matching similarity includes: the attack matching similarity satisfies the following formula:

[0016]

[0017] Among them, A represents the attack feature value, B represents the feature value to be attacked, and C represents the attack matching similarity; when the attack matching similarity is greater than or equal to 70%, it is set as the first attack; when the attack matching similarity is less than 70% and greater than 40%, it is set as the second attack; when the attack matching similarity is less than or equal to 40%, it is set as the third attack; an attack similarity report is established based on the first attack, the second attack, and the third attack.

[0018] Optionally, when extracting the traffic characteristics of the second attack database based on the time series model and analyzing the abnormal behavior of the OT / IT protocol based on the traffic characteristics, it includes: using the Autoregressive Integrated Moving Average (ARIMA) model to arrange all the second log reports in the second attack database in chronological order; establishing a second log report time series, counting the sequence items of the second log reports at non-current moments, and determining the regression coefficient based on the mean of the sequence items; calculating the difference between the regression coefficient and the sequence item at the current moment, and determining whether there is abnormal behavior based on the difference; if the difference is not equal to 0, there is abnormal behavior; if the difference is equal to 0, there is no abnormal behavior.

[0019] Optionally, when generating an operation log based on the attack similarity report and abnormal behavior, and issuing an alarm based on the operation status of the operation log, it includes: establishing a first operation log based on the first attack, the second attack, and the third attack, and establishing a second operation log based on the abnormal behavior; when the first operation log and the second operation log are established at the same time, issuing a first level alarm; when the first operation log and the second operation log are not established at the same time, issuing a second level alarm.

[0020] In a second aspect, a defense monitoring method is provided, which applies the defense monitoring system described in the first aspect, and the method includes: collecting device status information in the integrated engine, and establishing a first log report based on the device status information to obtain a first attack database; collecting network traffic data in the integrated engine, and establishing a second log report based on the network traffic data to obtain a second attack database; extracting attack features of the first attack database, and determining an attack similarity report based on the attack features and features to be attacked; extracting traffic features of the second attack database based on a time series model, and analyzing abnormal behavior of the OT / IT protocol based on the traffic features; generating an operation log based on the attack similarity report and the abnormal behavior, and issuing an alarm based on the operation status of the operation log.

[0021] Optionally, the device status information includes: text information, image information and file information of the device status; collecting the device status information in the integrated engine, and establishing a first log report based on the device status information, including: the data acquisition module aligns the text information and image information based on the graphic and text multimodal model to obtain matching information, pre-processes the matching information and file information, and constructs information partitions, and the data acquisition module establishes the first log report based on the information partitions.

[0022] Optionally, network traffic data in the integrated engine is collected, and a second log report is established based on the network traffic data, including: collecting network traffic data based on a network sniffing tool, and cleaning and standardizing the network traffic data; cleaning and standardization include: obtaining byte segments of the network traffic data, and dividing the byte segments into byte points; setting a starting point from the byte points, searching for all byte points in the neighborhood of the starting point, and if there are at least a preset number of byte points in the neighborhood, the starting point is defined as the cluster center of the byte points; expanding the cluster from the cluster center, and if the number of byte points in the neighborhood of the cluster center is less than a preset number, the byte points less than the preset number are determined as boundary points; repeatedly setting the starting point until all byte points are set as starting points, eliminating all the obtained boundary points, and establishing a second log report based on all the obtained cluster centers.

[0023] Optionally, attack features of the first attack database are extracted, and attack similarity reports are determined based on the attack features and features to be attacked, including: determining identical first log reports from the first attack database, constructing a first log report set, and counting the number of elements of identical first log reports in the first log report set; calculating attack feature values ​​based on the number of elements and the duration of the attack, and calculating feature values ​​to be attacked based on features to be attacked; determining attack matching similarity based on the attack feature values ​​and feature values ​​to be attacked, and establishing an attack similarity report based on the attack matching similarity.

[0024] Optionally, an attack characteristic value is calculated based on the number of elements and the duration of the attack, including: the attack characteristic value satisfies the following formula:

[0025]

[0026] Among them, A represents the attack feature value, E i represents the number of elements in the ith order, T represents the duration, and T max Indicates the maximum value of the duration.

[0027] Optionally, calculating a feature value to be attacked based on the feature to be attacked includes: obtaining the number of requests to be attacked, the number of times the abnormal script is used, and the continuous time of access; calculating the feature value to be attacked based on the number of requests, the number of times the abnormal script is used, and the continuous time; the feature value to be attacked satisfies the following formula:

[0028] B=w1×J+w2×K+L;

[0029] Where B represents the attack feature value, J represents the number of requests, K represents the number of times the abnormal script is used, L represents the continuous time, w1 represents the weight of the number of requests, w2 represents the weight of the number of times the abnormal script is used, and the sum of w1 and w2 is 1.5.

[0030] Optionally, the attack matching similarity is determined based on the attack feature value and the feature value to be attacked, and an attack similarity report is created based on the attack matching similarity, including: the attack matching similarity satisfies the following formula:

[0031]

[0032] Among them, A represents the attack feature value, B represents the feature value to be attacked, and C represents the attack matching similarity; when the attack matching similarity is greater than or equal to 70%, it is set as the first attack; when the attack matching similarity is less than 70% and greater than 40%, it is set as the second attack; when the attack matching similarity is less than or equal to 40%, it is set as the third attack; an attack similarity report is established based on the first attack, the second attack, and the third attack.

[0033] Optionally, the traffic characteristics of the second attack database are extracted based on the time series model, and the abnormal behavior of the OT / IT protocol is analyzed based on the traffic characteristics, including: using the ARIMA model to arrange all the second log reports in the second attack database in chronological order; establishing a second log report time series, counting the sequence items of the second log reports not at the current moment, and determining the regression coefficient based on the mean of the sequence items; calculating the difference between the regression coefficient and the sequence item at the current moment, and determining whether there is abnormal behavior based on the difference; if the difference is not equal to 0, there is abnormal behavior; if the difference is equal to 0, there is no abnormal behavior.

[0034] Optionally, an operation log is generated based on the attack similarity report and abnormal behavior, and an alarm is issued based on the operation status of the operation log, including: establishing a first operation log based on the first attack, the second attack, and the third attack, and establishing a second operation log based on the abnormal behavior; when the first operation log and the second operation log are established at the same time, a first level alarm is issued; when the first operation log and the second operation log are not established at the same time, a second level alarm is issued.

[0035] In a third aspect, a defense monitoring device is provided, comprising a memory and a processor; the memory is used to store computer execution instructions, and the processor is connected to the memory through a bus; when the defense monitoring device is running, the processor executes the computer execution instructions stored in the memory, so that the defense monitoring device executes the defense monitoring method described in the second aspect.

[0036] The defense monitoring device may be a network device or a component within the network device, such as a system-on-chip within the network device. The system-on-chip is configured to support the network device in implementing the functions described in the first aspect and any possible implementation thereof, such as acquiring, determining, and transmitting data and / or information used in the defense monitoring method. The system-on-chip includes a chip and may also include other discrete components or circuit structures.

[0037] In a fourth aspect, a computer-readable storage medium is provided, the computer-readable storage medium including computer-executable instructions. When the computer-executable instructions are executed on a computer, the computer is caused to execute the defense monitoring method described in the second aspect.

[0038] In a fifth aspect, a computer program product is further provided. The computer program product includes computer instructions. When the computer instructions are executed on a defense monitoring device, the defense monitoring device executes the defense monitoring method as described in the second aspect above.

[0039] It should be noted that the above-mentioned computer instructions may be stored in whole or in part on a computer-readable storage medium. The computer-readable storage medium may be packaged together with the processor of the defense monitoring device or separately from the processor of the defense monitoring device, and this embodiment of the application is not limited thereto.

[0040] The description of the second, third, fourth and fifth aspects of this application can refer to the detailed description of the first aspect.

[0041] In the embodiments of this application, the names of the aforementioned defense monitoring devices do not limit the devices or functional modules themselves. In actual implementation, these devices or functional modules may be referred to by other names. For example, the receiving unit may also be referred to as a receiving module, a receiver, etc. As long as the functions of the various devices or functional modules are similar to those of this application, they are within the scope of the claims of this application and their equivalents.

[0042] As can be seen above, the defense monitoring system uses the data acquisition module to simultaneously collect device status information and network traffic data, generating primary and secondary log reports, respectively. Furthermore, it constructs primary and secondary attack databases, enabling comprehensive monitoring of multi-dimensional data within the OT / IT integrated engine, improving monitoring accuracy and coverage. The intrusion monitoring module extracts attack signatures from the primary attack database and compares them with the signatures of the target attack to generate attack similarity reports, enabling accurate identification of potential attacks. Simultaneously, it utilizes a time series model to extract traffic signatures from the secondary attack database and analyze OT / IT protocol anomalies, effectively detecting protocol-level anomalous operations or unknown threats, and enhancing its ability to analyze complex attacks. The central management module generates an operation log by combining attack similarity reports with anomaly behavior, comprehensively recording the system's operational status and triggering alerts based on the log's status. Using a tiered alert mechanism, the defense monitoring system can issue alerts at different levels based on threat severity, ensuring that critical threats are prioritized. This automated monitoring integrates, analyzes, and triggers multi-dimensional data. This improves the efficiency and speed of potential threat detection and response, providing a strong security guarantee for the stable operation of the OT / IT integrated engine.

[0043] The beneficial effects of the first, second, third, fourth and fifth aspects of this application can all be referred to the analysis of the above beneficial effects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0045] Figure 1 A schematic diagram of the structure of a defense monitoring system provided in an embodiment of the present application;

[0046] Figure 2 A flowchart of a defense monitoring method provided in an embodiment of the present application;

[0047] Figure 3 A schematic diagram of the structure of a defense monitoring device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0049] It should be noted that in the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0050] In order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order.

[0051] As described in the background technology, with the rapid development of information technology, the threats to oil and gas pipeline network security are becoming increasingly complex. The OT / IT integrated engine for oil and gas pipeline networks has also brought more network security challenges. In order to cope with potential security threats, it is necessary to monitor the OT / IT integrated engine.

[0052] Current monitoring technologies are typically only able to process single data points and issue alerts when threats exist.

[0053] Although current monitoring technology can monitor integrated engines, it cannot process the multi-dimensional data in integrated engines and has limitations. In addition, the following problems may occur when generating alarms:

[0054] On the one hand, minor abnormal behaviors can trigger unnecessary high-level alerts, resulting in a waste of resources. On the other hand, comprehensive threats can be confused with abnormal behaviors or other attacks, failing to trigger high-level alerts in a timely manner, thus delaying the security response of defense monitoring. Therefore, current monitoring technologies cannot meet the precise and real-time security requirements of oil and gas pipeline networks.

[0055] From the above, we can see that current technology has limitations in multi-dimensional data monitoring and is difficult to meet the precise and real-time security requirements in oil and gas pipeline networks.

[0056] In some embodiments of the present application, Figure 1As shown, an embodiment of the present application provides a defense monitoring system, which includes: a data acquisition module, an intrusion monitoring module and a central management module.

[0057] The data collection module collects device status information (including text information, image information and file information) in the integrated engine, and creates a first log report according to the device status information to obtain a first attack database.

[0058] Specifically, the data collection module obtains a plurality of first log reports and establishes a first attack database.

[0059] The data collection module collects network flow data in the integrated engine and creates a second log report according to the network flow data to obtain a second attack database.

[0060] Specifically, the data collection module obtains multiple second log reports and establishes a second attack database.

[0061] The intrusion monitoring module extracts attack features from the first attack database, and determines an attack similarity report based on the attack features and features to be attacked.

[0062] Specifically, the intrusion monitoring module compares the attack characteristics and the characteristics to be attacked and obtains an attack similarity report.

[0063] The intrusion monitoring module uses a time series model to extract traffic features from the second attack database and analyzes abnormal behaviors of OT / IT protocols based on the traffic features.

[0064] The central management module generates operation logs based on attack similarity reports and abnormal behaviors, and issues alarms based on the operation status of the operation logs.

[0065] In an embodiment of the present application, the data collection module extracts device status information (including text information, image information, and file information) from the device in the integrated engine, and creates a first log report based on the collected device status information to obtain a first attack database.

[0066] The first log report can comprehensively reflect the operating status of the device and related historical records. The first attack database can systematically store and organize the first log report, effectively protecting the confidentiality of the first log report.

[0067] In an embodiment of the present application, the data collection module can also collect (also referred to as capture) network traffic data of the integrated engine and generate a second log report to obtain a second attack database.

[0068] The second log report can reflect the dynamic behavior of network communication in the integrated engine network. The purpose of building the second attack database is the same as that of building the first attack database, and will not be repeated here.

[0069] In an embodiment of the present application, the intrusion monitoring module extracts attack features from the first attack database based on the information provided by the data acquisition module, and compares and analyzes the attack features with the features to be attacked, thereby improving the reliability of the defense monitoring system. Through comparative monitoring, historical attack behaviors can be avoided, thereby enhancing the intelligent performance of the defense monitoring system.

[0070] In an embodiment of the present application, the intrusion monitoring module uses a time series model to analyze network traffic characteristics in the second attack database. The intrusion monitoring module analyzes abnormal behavior of OT / IT protocols based on traffic characteristics and identifies potential threat activities.

[0071] In an embodiment of the present application, the central management module assumes the comprehensive management function of the defense monitoring system, generates an operation log for the attack similarity reports and abnormal behaviors provided by the intrusion monitoring module, and, based on the establishment of the operation log, the central management module can issue corresponding alarms when necessary to help users quickly learn about possible problems and take corresponding countermeasures.

[0072] It is understandable that the defense monitoring system provides support for corresponding defense strategies for potential threats by collecting multi-dimensional and multi-type data, covering two major areas: device status and network traffic. By using time series models and comparative feature technology, the defense monitoring system can accurately identify possible security threats at the device and network levels, and send alerts in a timely manner, reducing the impact of attacks on the integrated engine and realizing global monitoring of the OT / IT engine to respond to ever-changing network security threats.

[0073] In some embodiments, the device status information includes: text information, image information, and file information of the device status. When the data collection module collects the device status information in the integrated engine and creates a first log report based on the device status information, it includes:

[0074] The data acquisition module aligns text information and image information based on the text-image multimodal model to obtain matching information, performs preprocessing based on the matching information and file information, and constructs information partitions. The data acquisition module creates a first log report based on the information partitions.

[0075] Among them, the image-text multimodal model can combine natural language processing and image processing to perform semantic understanding and feature extraction of text information and image information.

[0076] Preprocessing includes: eliminating redundant data from matching information and file information.

[0077] Information partitioning is a logical grouping method that can classify and store matching information and file information according to their type and source. Through partitioning operations, structured management of various information can be achieved.

[0078] In an embodiment of the present application, the data acquisition module processes text and image information through a multimodal model of text and images. The data acquisition module semantically aligns text and image information, extracts the relevance between them, and generates matching information. This ensures accurate integration of different information formats, laying the foundation for subsequent data processing. The data acquisition module can perform preprocessing based on the generated matching information and combined with file information to unify the information format, ensure its integrity and consistency, and improve the quality and usability of the matching information and file information.

[0079] As you can understand, the data collection module generates a first log report based on the established information partitions. This first log report details the multi-dimensional device status, including text, images, and file associations. This first log report not only comprehensively reflects the device's operating status but also serves as a crucial data foundation for subsequent attack signature extraction and intrusion monitoring. The data collection module enables comprehensive collection, integration, and standardized management of device status information, enhancing the system's security and defense monitoring reliability.

[0080] In some embodiments, the data collection module collects network traffic data from the integrated engine and creates a second log report based on the network traffic data, including:

[0081] The data collection module collects network traffic data based on a network sniffing tool, and cleans and standardizes the network traffic data.

[0082] Among them, cleaning and standardization include: the data acquisition module obtains the byte segments of network traffic data, divides the byte segments into byte points, sets the starting point from the byte points, searches for all byte points in the neighborhood of the starting point, and if there are at least a preset number of byte points in the neighborhood, the starting point is set as the cluster center of the byte points, and the cluster is expanded from the cluster center. If the number of byte points in the neighborhood of the cluster center is less than the preset number, the byte points less than the preset number are determined as boundary points, and the starting point is repeatedly set until all byte points are set as starting points. All the boundary points obtained are eliminated, and a second log report is established based on all the cluster centers obtained.

[0083] Network sniffing tools can capture real-time network communication packets, including header information, payload data, and other relevant transmission parameters. The network traffic data collected by network sniffing tools can fully reflect the network operation status.

[0084] A byte node is the smallest logical unit of network traffic data, which contains detailed information about the traffic, such as the position of a byte in a data packet or its corresponding value.

[0085] A cluster center refers to the central node of a type of feature in network traffic data, representing the clustered features of a group of related nodes.

[0086] In an embodiment of the present application, the data acquisition module uses a network sniffing tool to obtain network traffic data. After collecting the original network traffic data, the data is cleaned and standardized to ensure the quality of the monitored data.

[0087] Specifically, the data collection module extracts byte segments from network traffic data. Byte segments are divided based on the packet length and the communication protocol field type. Each byte segment is broken down into standard units, namely byte points. By defining byte points, the data collection module can accurately analyze network traffic. The module selects a node from the byte point set as the current starting point. Using a neighborhood search method, it locates the byte points closest to this starting point, identifies the correlations and distribution patterns between the byte points, and prepares for subsequent extended clustering operations. The preset number of byte points is 10, which can be adjusted adaptively based on actual conditions. For each starting point, if the number of byte points in its neighborhood reaches or exceeds a preset threshold, the current starting point is designated as the cluster center. Starting from the cluster center, the data collection module performs an extended clustering operation on the byte points in its neighborhood, gradually assigning eligible byte points to the current cluster. Boundary points represent anomalies or isolated distributions in the network traffic data and lack clear clustering characteristics. During the cleaning operation, these boundary points are removed to avoid interfering with the data results.

[0088] It is understood that the data collection module repeats the above operations, sequentially setting starting points for all byte points and performing neighborhood searches and clustering operations until all byte points in the byte point set have been processed. The data collection module then extracts all cluster centers based on the clustering results. Cluster centers represent the core features of network traffic data and are an important basis for analyzing and monitoring network anomalies. The data collection module generates a second log report based on the cluster centers. Through the above process, the data collection module achieves accurate collection and standardization of network traffic data, eliminates boundary points, and effectively reduces data complexity. At the same time, establishing a second log report provides a reliable foundation for monitoring potential attacks, improving the analytical capabilities and response efficiency of defense monitoring.

[0089] In some embodiments, the intrusion monitoring module extracts attack features from the first attack database and determines an attack similarity report based on the attack features and features to be attacked, including:

[0090] The intrusion monitoring module identifies identical first log reports in the first attack database, constructs a first log report set, and counts the number of identical first log report elements in the first log report set. The intrusion monitoring module calculates an attack signature value based on the number of elements and the duration of the attack, and calculates a target attack signature value based on the target attack signature. The intrusion monitoring module determines an attack match similarity based on the attack signature value and the target attack signature value, and creates an attack similarity report based on the attack match similarity.

[0091] It is understandable that the intrusion monitoring module filters out identical first log reports from the first attack database and constructs a first log report set from the identical first log reports. The first log report set aggregates elements with many identical first log reports, including the attack type, attack source, and the impact of the attack target on the device status. By counting the number of identical elements, the intrusion monitoring module can evaluate the frequency and prevalence of attacks and calculate the attack feature value. The attack feature value reflects the intensity and persistence of the attack and is an important indicator for measuring attack patterns. Similarly, the intrusion monitoring module can also extract relevant information from the features to be attacked and calculate the feature value to be attacked. The feature value to be attacked represents the characteristics of the potential threat or attack behavior currently being faced, and is used for comparative analysis with existing attack features to calculate the attack matching similarity. The attack matching similarity reflects the degree of similarity between the current features to be attacked and the historical attack features. The intrusion monitoring module generates an attack similarity report based on the attack matching similarity, providing strong data support for security defense monitoring and helping to identify and predict potential security threats.

[0092] In some embodiments, the intrusion monitoring module calculates the attack feature value based on the number of elements and the duration of the attack, including:

[0093] The attack characteristic value satisfies the following formula:

[0094]

[0095] Among them, A represents the attack feature value, E i represents the number of elements in the ith order, T represents the duration, and T max Indicates the maximum value of the duration.

[0096] It can be understood that by calculating the attack characteristic values, the defense monitoring system can be helped to quantify the extent of different attack modes, provide a quantitative basis for subsequent analysis, reduce the time of human intervention, and thus reduce the response time of the defense monitoring system.

[0097] In some embodiments, when the intrusion monitoring module calculates the attack feature value based on the attack feature, it includes:

[0098] The intrusion monitoring module obtains the number of requests to be attacked, the number of times abnormal scripts are used, and the continuous time of access, and calculates the characteristic value to be attacked according to the number of requests, the number of times abnormal scripts are used, and the continuous time.

[0099] The characteristic value to be attacked satisfies the following formula:

[0100] B=w1×J+w2×K+L;

[0101] Where B represents the attack feature value, J represents the number of requests, K represents the number of times the abnormal script is used, L represents the continuous time, w1 represents the weight of the number of requests, w2 represents the weight of the number of times the abnormal script is used, and the sum of w1 and w2 is 1.5.

[0102] It is understandable that the intrusion monitoring module can flexibly adjust the weight ratio of the number of requests and the number of times abnormal scripts are used to the attack feature value according to actual conditions, so that the defense monitoring system can adapt to attack patterns in different environments. The attack feature value provides data support for attack matching similarity analysis and alarm triggering, thereby improving the intrusion monitoring efficiency and accuracy of the defense monitoring system.

[0103] In some embodiments, the intrusion monitoring module calculates the attack matching similarity based on the attack feature value and the feature value to be attacked, and creates an attack similarity report based on the attack matching similarity, including:

[0104] The attack matching similarity satisfies the following formula:

[0105]

[0106] Among them, A represents the attack feature value, B represents the feature value to be attacked, and C represents the attack matching similarity.

[0107] When the attack matching similarity is greater than or equal to 70%, it is set as the first attack; when the attack matching similarity is less than 70% and greater than 40%, it is set as the second attack; when the attack matching similarity is less than or equal to 40%, it is set as the third attack. The intrusion monitoring module establishes an attack similarity report based on the first attack, the second attack and the third attack.

[0108] It is understandable that the intrusion monitoring module generates an attack similarity report based on the classification results. The attack similarity report records in detail the matching degree of the first attack, the second attack, and the third attack, which improves the identification of potential threats. If the similarity between the first attack and the historical attack is greater than the first similarity threshold (i.e., the first attack is highly similar to the historical attack), a historical defense strategy can be adopted for defense. If the similarity between the second attack and the historical attack is greater than the second similarity threshold and less than the first similarity threshold (i.e., the first attack and the historical attack have a certain similarity), other defense strategies can be appropriately adopted. If the similarity between the third attack and the historical attack is less than the second similarity threshold (i.e., the first attack and the historical attack have a low degree of similarity), a certain high-defense strategy needs to be adopted to deal with the potential threat. The intrusion monitoring module improves the security management capabilities of the defense monitoring system by quantifying the similarity of the behaviors to be attacked and classifying and identifying potential threats.

[0109] In some embodiments, the intrusion monitoring module extracts traffic features from the second attack database based on the time series model and analyzes abnormal behavior of the OT / IT protocol based on the traffic features, including:

[0110] The intrusion monitoring module uses the ARIMA model to chronologically sort all second log reports in the second attack database to create a second log report time series. It then counts the sequence items of the second log reports at non-current times, determines the regression coefficient based on the mean of the sequence items, calculates the difference between the regression coefficient and the sequence item at the current time, and determines whether there is abnormal behavior based on the difference. If the difference is not equal to 0, there is abnormal behavior; if the difference is equal to 0, there is no abnormal behavior.

[0111] As can be understood, the intrusion monitoring module uses the ARIMA model to analyze all second log reports in the second attack database to construct a complete time series. Based on this constructed time series, the intrusion monitoring module counts the sequence items of all second log reports other than the current time and calculates the mean of the sequence items. The intrusion monitoring module determines the regression coefficient in the time series model, which describes the trend of the time series. The difference between the determined regression coefficient and the sequence item at the current time reflects the degree to which the current network traffic matches the expected pattern. If the difference is 0, it indicates that the current traffic characteristics are completely consistent with the historical behavior pattern and fall within the prediction range of the ARIMA model. This indicates that the current network behavior is normal, consistent with historical trends and expectations, and there is no abnormal behavior. If the difference is not equal to 0, it indicates that there is a deviation between the current network traffic characteristics and the historical behavior pattern, indicating that abnormal behavior has occurred in the OT / IT engine's network protocol. By using the time series ARIMA model to monitor the changing patterns of network traffic in real time, the module accurately identifies potential abnormal behavior in the OT / IT network protocol and improves the accuracy of intrusion detection.

[0112] In some embodiments, the central management module generates an operation log based on the attack similarity report and the abnormal behavior. When the central management module issues an alarm based on the operation status of the operation log, the central management module includes:

[0113] The central management module establishes a first operation log based on the first attack, the second attack, and the third attack, and establishes a second operation log based on the abnormal behavior. When the first operation log and the second operation log are established at the same time, a first level alarm is issued. When the first operation log and the second operation log are not established at the same time, a second level alarm is issued.

[0114] It is understandable that the central management module can generate a first operation log based on the first attack, the second attack and the third attack, recording the types and characteristics of existing attacks. At the same time, the central management module generates a second operation log based on the detected abnormal behavior, recording in detail the information related to the network protocol anomaly. If the first operation log and the second operation log are established at the same time, it means that the defense monitoring system has detected clear attack characteristics and abnormal behavior at the same time. The central management module issues a first-level alarm, indicating that there may be a major security threat. If the first operation log and the second operation log are not established at the same time, it means that the defense monitoring system has only detected a single anomaly or attack feature. The central management module issues a second-level alarm, indicating a potential medium-risk threat. The present application can monitor the operating status of potential threats of different degrees in real time and trigger alarms of different levels, thereby improving the flexibility of the defense monitoring system and reducing the allocation of network security resources.

[0115] As can be seen above, the defense monitoring system uses the data acquisition module to simultaneously collect device status information and network traffic data, generating primary and secondary log reports, respectively. Furthermore, it constructs primary and secondary attack databases, enabling comprehensive monitoring of the multi-dimensional data within the OT / IT integrated engine, improving monitoring accuracy and coverage. The intrusion monitoring module extracts attack signatures from the primary attack database and compares them with the signatures of the target attack to generate attack similarity reports, enabling accurate identification of potential attacks. Simultaneously, it utilizes a time series model to extract traffic signatures from the secondary attack database and analyze OT / IT protocol anomalies, effectively detecting protocol-level abnormal operations or unknown threats and enhancing its ability to analyze complex attacks. The central management module generates an operation log by combining attack similarity reports with anomaly behavior, comprehensively recording the system's operational status and triggering corresponding alerts based on the log's status. A tiered alert mechanism allows the system to issue alerts at different levels based on threat severity, ensuring that critical threats are prioritized. This automated monitoring integrates, analyzes, and triggers multi-dimensional data. This improves the efficiency and speed of potential threat detection and response, providing a strong security guarantee for the stable operation of the OT / IT integrated engine.

[0116] In some embodiments, as Figure 2 As shown, the embodiment of the present application also provides a defense monitoring method, which is applied to the above Figure 1 The defense monitoring system in the system includes:

[0117] S201: Collect device status information in the integrated engine, and create a first log report based on the device status information to obtain a first attack database.

[0118] Device status information includes: text information, image information and file information of device status.

[0119] S202: Collect network traffic data from the integrated engine, and create a second log report based on the network traffic data to obtain a second attack database.

[0120] S203: Extract attack features from the first attack database, and determine an attack similarity report based on the attack features and features to be attacked.

[0121] S204. Extract traffic features of the second attack database based on the time series model, and analyze abnormal behaviors of the OT / IT protocol based on the traffic features.

[0122] S205: Generate an operation log based on the attack similarity report and abnormal behavior, and issue an alarm based on the operation status of the operation log.

[0123] In some embodiments, the device status information includes: text information, image information, and file information of the device status; collecting the device status information in the integrated engine, and creating a first log report based on the device status information include:

[0124] The data acquisition module aligns text information and image information based on the text-image multimodal model to obtain matching information, preprocesses the matching information and file information, and constructs information partitions. The data acquisition module creates a first log report based on the information partitions.

[0125] In some embodiments, the data collection module collects network traffic data from the integrated engine and creates a second log report based on the network traffic data, including:

[0126] Collect network traffic data based on network sniffing tools, and clean and standardize the network traffic data.

[0127] The cleaning and standardization steps include obtaining byte segments of network traffic data and dividing the byte segments into byte points. A starting point is set among the byte points, and all byte points in the neighborhood of the starting point are searched. If at least a preset number of byte points exist in the neighborhood, the starting point is designated as the cluster center of the byte points. Clustering is then expanded from the cluster center. If the number of byte points in the neighborhood of the cluster center is less than a preset number, the byte points that are less than the preset number are determined to be boundary points. The starting point is repeatedly set until all byte points are set as starting points. All boundary points are removed, and a second log report is created based on all the cluster centers obtained.

[0128] In some embodiments, extracting attack features from the first attack database and determining an attack similarity report based on the attack features and features to be attacked include:

[0129] The same first log report is determined from the first attack database, and a first log report set is constructed, and the number of elements of the same first log report in the first log report set is counted.

[0130] The attack feature value is calculated according to the number of elements and the duration of the attack, and the feature value to be attacked is calculated according to the feature to be attacked.

[0131] The attack matching similarity is determined based on the attack feature value and the feature value to be attacked, and an attack similarity report is created based on the attack matching similarity.

[0132] In some embodiments, calculating the attack feature value based on the number of elements and the duration of the attack includes:

[0133] The attack characteristic value satisfies the following formula:

[0134]

[0135] Among them, A represents the attack feature value, E i represents the number of elements in the ith order, T represents the duration, and T max Indicates the maximum value of the duration.

[0136] In some embodiments, calculating the feature value to be attacked based on the feature to be attacked includes:

[0137] Get the number of requests to be attacked, the number of times abnormal scripts are used, and the continuous duration of access.

[0138] The attack signature value is calculated based on the number of requests, the number of times the abnormal script is used, and the continuous time.

[0139] The characteristic value to be attacked satisfies the following formula:

[0140] B=w1×J+w2×K+L;

[0141] Where B represents the attack feature value, J represents the number of requests, K represents the number of times the abnormal script is used, L represents the continuous time, w1 represents the weight of the number of requests, w2 represents the weight of the number of times the abnormal script is used, and the sum of w1 and w2 is 1.5.

[0142] In some embodiments, determining attack matching similarity based on the attack feature value and the feature value to be attacked, and creating an attack similarity report based on the attack matching similarity includes:

[0143] The attack matching similarity satisfies the following formula:

[0144]

[0145] Among them, A represents the attack feature value, B represents the feature value to be attacked, and C represents the attack matching similarity. When the attack matching similarity is greater than or equal to 70%, it is set as the first attack. When the attack matching similarity is less than 70% and greater than 40%, it is set as the second attack. When the attack matching similarity is less than or equal to 40%, it is set as the third attack. An attack similarity report is established based on the first attack, the second attack, and the third attack.

[0146] In some embodiments, traffic features of the second attack database are extracted based on a time series model, and abnormal behavior of the OT / IT protocol is analyzed based on the traffic features, including:

[0147] The ARIMA model is used to arrange all the second log reports in the second attack database in chronological order.

[0148] A second log report time series is established, sequence items of the second log report at a non-current moment are counted, and a regression coefficient is determined according to the mean of the sequence items.

[0149] The difference between the regression coefficient and the sequence item at the current moment is calculated to determine whether there is abnormal behavior.

[0150] If the difference is not equal to 0, there is abnormal behavior; if the difference is equal to 0, there is no abnormal behavior.

[0151] In some embodiments, generating an operation log based on the attack similarity report and the abnormal behavior, and issuing an alert based on the operation status of the operation log, includes:

[0152] A first operation log is created according to the first attack, the second attack, and the third attack, and a second operation log is created according to the abnormal behavior.

[0153] When the first and second operation logs are created simultaneously, a first-level alarm is issued; when the first and second operation logs are not created simultaneously, a second-level alarm is issued. It is understood that in the embodiments of the present application, text information, image information, and file information about the device status in the integrated engine are collected to generate a first log report, and multiple first log reports are aggregated to establish a first attack database. Network traffic data is collected to generate a second log report, and multiple second log reports are aggregated to establish a second attack database. This facilitates unified structural management of multiple data and improves the efficiency of monitoring and management. Attack features are extracted from the first attack database and compared and analyzed with features to be attacked to generate an attack similarity report. For the second attack database, a time series model is used to extract traffic features, and abnormal behavior in OT / IT protocols is analyzed based on these features. Intelligent processing of various forms of data improves the reliability of defense monitoring and ensures the monitoring of potential threats. Operation logs are generated by combining attack similarity reports and abnormal behavior. Different levels of alarms are triggered based on the operation logs to indicate potential risks or major security threats, thus achieving efficient multi-dimensional security monitoring and early warning functions.

[0154] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily appreciate that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0155] In the embodiments of the present application, the defense monitoring device can be divided into functional modules according to the above-described method examples. For example, each functional module can be divided according to its function, or two or more functions can be integrated into a single processing module. The above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. Optionally, the module division in the embodiments of the present application is illustrative and is merely a logical functional division. In actual implementation, other division methods may be used.

[0156] like Figure 3 , which is a schematic structural diagram of a defense monitoring device provided in an embodiment of the present application. Figure 3The defense monitoring device shown includes: a communication unit 301 and a processing unit 302. The communication unit 301 is used to collect device status information from the integrated engine and create a first log report based on the device status information to obtain a first attack database. The communication unit 301 is also used to collect network traffic data from the integrated engine and create a second log report based on the network traffic data to obtain a second attack database. The processing unit 302 is used to extract attack features from the first attack database and determine an attack similarity report based on the attack features and features to be attacked. The processing unit 302 is also used to extract traffic features from the second attack database based on a time series model and analyze abnormal behavior of the OT / IT protocol based on the traffic features. The processing unit 302 is also used to generate an operation log based on the attack similarity report and abnormal behavior, and issue an alarm based on the operation status of the operation log.

[0157] Optionally, the device status information includes: text information, image information and file information of the device status; the communication unit 301 is specifically used for: the data acquisition module aligns the text information and image information based on the text-image multimodal model to obtain matching information, pre-processes the matching information and file information, and constructs information partitions, and the data acquisition module establishes a first log report based on the information partitions.

[0158] Optionally, the communication unit 301 is specifically used to: collect network traffic data based on a network sniffing tool, and clean and standardize the network traffic data; the cleaning and standardization includes: obtaining byte segments of the network traffic data, and dividing the byte segments into byte points; setting a starting point from the byte points, searching for all byte points in the neighborhood of the starting point, and if there are at least a preset number of byte points in the neighborhood, the starting point is defined as the cluster center of the byte points; expanding the cluster from the cluster center, and if the number of byte points in the neighborhood of the cluster center is less than a preset number, the byte points less than the preset number are determined as boundary points; repeatedly setting the starting point until all byte points are set as starting points, eliminating all the obtained boundary points, and establishing a second log report based on all the obtained cluster centers.

[0159] Optionally, the processing unit 302 is specifically used to: determine the same first log report from the first attack database, and construct a first log report set, and count the number of elements of the same first log report in the first log report set; calculate the attack feature value based on the number of elements and the duration of launching the attack, and calculate the feature value to be attacked based on the feature to be attacked; determine the attack matching similarity based on the attack feature value and the feature value to be attacked, and establish an attack similarity report based on the attack matching similarity.

[0160] Optionally, the processing unit 302 is specifically configured to: the attack feature value satisfies the following formula:

[0161]

[0162] Among them, A represents the attack feature value, E i represents the number of elements in the ith order, T represents the duration, and T max Indicates the maximum value of the duration.

[0163] Optionally, the processing unit 302 is specifically configured to: obtain the number of requests to be attacked, the number of times the abnormal script is used, and the continuous time of access; and calculate a characteristic value to be attacked based on the number of requests, the number of times the abnormal script is used, and the continuous time; the characteristic value to be attacked satisfies the following formula:

[0164] B=w1×J+w2×K+L;

[0165] Where B represents the attack feature value, J represents the number of requests, K represents the number of times the abnormal script is used, L represents the continuous time, w1 represents the weight of the number of requests, w2 represents the weight of the number of times the abnormal script is used, and the sum of w1 and w2 is 1.5.

[0166] Optionally, the processing unit 302 is specifically configured to: the attack matching similarity satisfies the following formula:

[0167]

[0168] Among them, A represents the attack feature value, B represents the feature value to be attacked, and C represents the attack matching similarity; when the attack matching similarity is greater than or equal to 70%, it is set as the first attack; when the attack matching similarity is less than 70% and greater than 40%, it is set as the second attack; when the attack matching similarity is less than or equal to 40%, it is set as the third attack; an attack similarity report is established based on the first attack, the second attack, and the third attack.

[0169] Optionally, the processing unit 302 is specifically used to: use the ARIMA model to arrange all the second log reports in the second attack database in chronological order; establish a second log report time series, count the sequence items of the second log reports not at the current moment, and determine the regression coefficient according to the mean of the sequence item; perform a difference calculation based on the regression coefficient and the sequence item at the current moment to determine whether there is abnormal behavior; if the difference is not equal to 0, there is abnormal behavior; if the difference is equal to 0, there is no abnormal behavior.

[0170] Optionally, the processing unit 302 is specifically used to: establish a first operation log based on the first attack, the second attack, and the third attack, and establish a second operation log based on the abnormal behavior; when the first operation log and the second operation log are established at the same time, issue a first level alarm; when the first operation log and the second operation log are not established at the same time, issue a second level alarm.

[0171] The present application also provides a computer program product that can be directly loaded into a memory and contains software code. When loaded and executed by a computer, the computer program product can implement the defense monitoring method provided in the above-described embodiment. Finally, it should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions may be made to the technical solutions of the present invention, and that such modifications or equivalent substitutions will not cause the modified technical solutions to depart from the spirit and scope of the technical solutions of the present invention.

[0172] The system provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the modules or steps in the embodiments of the present invention can be further decomposed or combined. For example, the modules in the above embodiment can be combined into one module or further divided into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present invention are only for distinguishing the modules or steps and are not to be regarded as improper limitations of the present invention.

[0173] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0174] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0175] These computer program instructions may also be stored in a computer-readable storage device that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable storage device produce an article of manufacture comprising an instruction device that implements the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0176] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0177] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and not to limit them. Although the present application has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present application can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present application should be included in the scope of protection of the claims of the present application.

Claims

1. A defense monitoring system, characterized in that: include: Data collection module, intrusion monitoring module and central management module; The data collection module is configured to collect device status information in the integrated engine and create a first log report based on the device status information to obtain a first attack database; The data collection module is further configured to collect network traffic data in the integrated engine and create a second log report based on the network traffic data to obtain a second attack database; The intrusion monitoring module is configured to extract attack features from the first attack database and determine an attack similarity report based on the attack features and features to be attacked; The intrusion monitoring module is further configured to extract traffic features of the second attack database based on a time series model, and analyze abnormal behaviors of the operational technology (OT) / information technology (IT) protocol based on the traffic features; The central management module is configured to generate an operation log according to the attack similarity report and the abnormal behavior, and issue an alarm according to the operation status of the operation log.

2. The defense monitoring system according to claim 1, characterized in that: The device status information includes: text information, image information and file information of the device status; the device status information in the integrated engine is collected, and when a first log report is created based on the device status information, it includes: The data acquisition module aligns the text information and the image information based on the image-text multimodal model to obtain matching information, preprocesses the matching information and the file information, and constructs information partitions. The data acquisition module creates the first log report based on the information partitions.

3. The defense monitoring system according to claim 2, characterized in that: The collecting of network traffic data in the integrated engine and creating a second log report based on the network traffic data includes: The network traffic data is collected based on a network sniffing tool, and the network traffic data is cleaned and standardized; the cleaning and standardization includes: Obtaining byte segments of the network traffic data, and dividing the byte segments into byte nodes; A starting point is set from the bit points, and all bit points in the neighborhood of the starting point are searched. If there are at least a preset number of bit points in the neighborhood, the starting point is determined as the cluster center of the bit points; Expanding the cluster from the cluster center, if the number of bit points in the neighborhood of the cluster center is less than the preset number, determining the bit points less than the preset number as boundary points; The starting point is repeatedly set until all sub-points are set as the starting point, all the obtained boundary points are eliminated, and a second log report is created based on all the obtained cluster centers.

4. The defense monitoring system according to claim 3, characterized in that: The step of extracting attack features from the first attack database and determining an attack similarity report based on the attack features and features to be attacked includes: Determining identical first log reports from the first attack database, constructing a first log report set, and counting the number of identical first log report elements in the first log report set; Calculating an attack feature value according to the number of elements and the duration of the attack, and calculating a feature value to be attacked according to the feature to be attacked; An attack matching similarity is determined according to the attack feature value and the feature value to be attacked, and an attack similarity report is created according to the attack matching similarity.

5. The defense monitoring system according to claim 4, characterized in that: Calculating the attack characteristic value according to the number of elements and the duration of the attack includes: The attack characteristic value satisfies the following formula: Wherein, A represents the attack feature value, E i represents the number of the i-th element, T represents the duration, T max Indicates the maximum value of the duration.

6. The defense monitoring system according to claim 5, characterized in that: The step of calculating the feature value to be attacked according to the feature to be attacked includes: Obtain the number of requests to be attacked, the number of times abnormal scripts are used, and the continuous duration of access; Calculate a feature value to be attacked according to the number of requests, the number of times the abnormal script is used, and the continuous time; The characteristic value to be attacked satisfies the following formula: B=w1×J+w2×K+L; Among them, B represents the characteristic value to be attacked, J represents the number of requests, K represents the number of times the abnormal script is used, L represents the continuous time, w1 represents the weight of the number of requests, w2 represents the weight of the number of times the abnormal script is used, and the sum of w1 and w2 is 1.

5.

7. The defense monitoring system according to claim 6, characterized in that: The determining of the attack matching similarity based on the attack feature value and the feature value to be attacked, and creating an attack similarity report based on the attack matching similarity, includes: The attack matching similarity satisfies the following formula: Wherein, A represents the attack feature value, B represents the feature value to be attacked, and C represents the attack matching similarity; When the attack matching similarity is greater than or equal to 70%, it is set as the first attack; When the attack matching similarity is less than 70% and greater than 40%, it is set as the second attack; When the attack matching similarity is less than or equal to 40%, it is set as the third attack; The attack similarity report is created based on the first attack, the second attack, and the third attack.

8. The defense monitoring system according to claim 7, characterized in that: The extracting of traffic features of the second attack database based on the time series model and analyzing abnormal behaviors of the OT / IT protocol according to the traffic features includes: Arranging all second log reports in the second attack database in chronological order using an ARIMA model; Establishing a second log report time series, counting sequence items of the second log report at a non-current moment, and determining a regression coefficient based on a mean value of the sequence items; A difference is calculated based on the regression coefficient and the sequence item at the current moment, and whether abnormal behavior exists is determined based on the difference; if the difference is not equal to 0, the abnormal behavior exists; if the difference is equal to 0, the abnormal behavior does not exist.

9. The defense monitoring system according to claim 8, characterized in that: The step of generating an operation log according to the attack similarity report and the abnormal behavior, and issuing an alarm according to the operation status of the operation log, includes: Creating a first operation log according to the first attack, the second attack, and the third attack, and creating a second operation log according to the abnormal behavior; When the first operation log and the second operation log are simultaneously established, a first level alarm is issued; When the first operation log and the second operation log are not created at the same time, a second level alarm is issued.

10. A defense monitoring method, applied to the defense monitoring system according to any one of claims 1 to 9, characterized in that: include: Collecting device status information in the integrated engine and creating a first log report based on the device status information to obtain a first attack database; collecting network traffic data from the integrated engine and creating a second log report based on the network traffic data to obtain a second attack database; Extracting attack features from the first attack database, and determining an attack similarity report based on the attack features and features to be attacked; Extracting traffic features of the second attack database based on a time series model, and analyzing abnormal behaviors of the OT / IT protocol based on the traffic features; An operation log is generated according to the attack similarity report and the abnormal behavior, and an alarm is issued according to the operation status of the operation log.

Images