Method and system for identifying malicious network scanning behavior of industrial control system

Abstract

The invention discloses an identification method and system for malicious scanning of a network behavior of an industrial control system, and the method comprises the steps: obtaining a reference risk value of an operation state of to-be-monitored production equipment, carrying out the classified statistics of detection data packages of network flow through full-flow analysis equipment in a set monitoring period, obtaining a network flow risk value, and carrying out the detection of the network flow. The method comprises the steps of calculating a host log risk value according to a host log, calculating a host performance risk value according to a host performance detection result, and obtaining an industrial control equipment delay risk value according to network delay of the industrial control equipment. The quick response capability of the industrial control system when the industrial control system is subjected to scanning attack is ensured; and when the risk value is in the safety interval, the monitoring state is maintained, so that invalid occupation of a traditional continuous alarm mechanism on operation and maintenance resources is avoided. The dynamic judgment mechanism effectively balances the contradiction between the security protection intensity and the system resource consumption.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power generation industry network security, and particularly relates to a malicious scanning industrial control system network behavior identification method and system. BACKGROUND

[0002] With the rapid development of emerging technologies such as cloud computing, big data, the Internet of Things, artificial intelligence and mobile Internet, today's society is fully entering the era of Internet of Everything. Under the background of industrial Internet, industrial control systems are no longer running in isolation, and their relatively weak protection capabilities are more likely to be exploited by hackers. Due to the key position of industrial control systems in industrial production, hackers will gain huge benefits once they successfully invade, which makes industrial control systems gradually become the focus of network attacks.

[0003] In the network security protection of industrial control systems, it is crucial to accurately identify malicious scanning behavior. Hackers usually use various scanning tools for information collection and brute force scanning, and their access range often far exceeds the actual asset size of the industrial control system. It is worth noting that network security operation and maintenance personnel will also use scanning tools for vulnerability detection during daily inspection, which leads to similarities between normal scanning and malicious scanning behavior in appearance. However, due to differences in information acquisition channels, normal scanning is usually based on known information for targeted detection, while malicious scanning lacks system information and presents characteristics such as wide range, high intensity and multiple log records. Not only will it generate a large amount of abnormal network traffic, but it will also significantly affect host performance. The existing technology cannot effectively distinguish between the two scanning behaviors, resulting in serious security threats to industrial control systems.

[0004] In view of the above problems, the existing technology needs to be improved. SUMMARY

[0005] The purpose of the present application is to provide a malicious scanning industrial control system network behavior identification method and system to overcome the problem that the existing technology cannot accurately identify malicious scanning.

[0006] To achieve the above purpose, the technical solution adopted by the present application is as follows: A malicious scanning industrial control system network behavior identification method, comprising the following steps: S1, obtaining the baseline risk value of the running state of the production equipment to be monitored; S2, classifying and counting the detection data packets of network traffic using a full-flow analysis device within a set monitoring period to obtain a network traffic risk value; S3, calculating a host log risk value based on the host log, a host performance risk value based on the host performance detection result, and an industrial control device delay risk value based on the network delay of the industrial control device; S4, obtaining an accumulated dynamic risk value according to the network traffic risk value, the host log risk value, the host performance risk value and the industrial control equipment delay risk value, obtaining a summary risk value according to the accumulated dynamic risk value and a benchmark risk value of the equipment operation state, and obtaining whether the current production equipment is malicious scanning according to a final summary risk value and a malicious scanning threshold.

[0007] Preferably, in S4, the final summary risk value and the malicious scanning threshold are used for judgment, if the warning value is exceeded, it is determined that the malicious scanning is performed, and a warning signal is sent to the industrial control system network security operation personnel; otherwise, the next monitoring period is entered.

[0008] Preferably, the monitoring period T is 0.5 hours or 1 hour.

[0009] Preferably, the calculation method of the network traffic risk value is based on the classified statistical host scanning type packet quantity M and the port scanning type packet quantity N, and the specific calculation formula is as follows:

[0010] wherein is a risk value calculation function, is the packet quantity of the host scanning type in a specific time, is the packet quantity of the port scanning type in a specific time.

[0011] Preferably, the risk value calculation function is related to the monitoring period T, and the specific formula is as follows: .

[0012] Preferably, the calculation of the host log risk value is based on the number of login failures and connection failures c, and the specific calculation formula is as follows:

[0013] wherein is a risk value calculation coefficient.

[0014] Preferably, the calculation of the host performance risk value is based on the monitoring of four indexes of CPU occupancy rate, memory occupancy rate, disk read-write rate and network import-export flow rate, and the specific calculation formula is as follows: wherein is the average value of the CPU occupancy rate, the memory occupancy rate, the disk read-write rate and the network import-export flow rate.

[0015] Preferably, the calculation of the industrial control equipment delay risk value is based on the real-time monitored equipment network delay e, and the specific calculation formula is as follows: i*e, wherein e is a monitored network delay, and i is a risk value calculation function coefficient.

[0016] Preferably, the cumulative dynamic risk value is a weighted average of the network traffic risk value, the host log risk value, the host performance risk value and the industrial control equipment delay risk value, and the specific calculation formula is as follows: .

[0017] A malicious scanning industrial control system network behavior identification system comprises a preset module, a network traffic acquisition module, a host risk module and an identification module. The preset module acquires a baseline risk value of a production equipment operating state to be monitored. The network traffic acquisition module classifies and counts the detection data packets of the network traffic by using a full-flow analysis device in a set monitoring period to acquire a network traffic risk value. The host risk module calculates a host log risk value according to a host log, calculates a host performance risk value according to a host performance detection result, and acquires an industrial control equipment delay risk value according to a network delay of the industrial control equipment. The identification module acquires a cumulative dynamic risk value according to the network traffic risk value, the host log risk value, the host performance risk value and the industrial control equipment delay risk value, acquires a summary risk value according to the cumulative dynamic risk value and the baseline risk value of the equipment operating state, and can obtain whether the current production equipment is malicious scanning according to the final summary risk value and a malicious scanning threshold.

[0018] Compared with the prior art, the present application has the following beneficial technical effects: The present application is a malicious scanning industrial control system network behavior identification method, which acquires a baseline risk value of a production equipment operating state to be monitored, classifies and counts the detection data packets of the network traffic by using a full-flow analysis device in a set monitoring period to acquire a network traffic risk value, calculates a host log risk value according to a host log, calculates a host performance risk value according to a host performance detection result, and acquires an industrial control equipment delay risk value according to a network delay of the industrial control equipment. The present application realizes accurate grading determination of the malicious scanning behavior, triggers an alarm immediately when the risk value exceeds a warning value, guarantees the rapid response capability of the industrial control system when the industrial control system is subjected to scanning attacks, maintains the monitoring state when the risk value is in a safe interval, and avoids the invalid occupation of operation and maintenance resources by the traditional continuous alarm mechanism. This dynamic determination mechanism effectively balances the contradiction between the security protection strength and the system resource consumption. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 FIG. 1 is a flowchart of a malicious scanning industrial control system network behavior identification method according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to enable the personnel in the technical field to better understand the technical scheme of the present application, the technical scheme in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by the person skilled in the art without creative labor should belong to the protection scope of the present application.

[0021] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, such as a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0022] In the prior art, industrial control systems face severe security challenges under the trend of Internet convergence. Since the traditional industrial control system adopts a closed architecture, its security protection mechanism is difficult to adapt to the threat situation in an open network environment. Conventional scanning behavior recognition methods mainly rely on fixed thresholds or single-dimensional detection, which cannot effectively distinguish between normal operation and maintenance scanning and malicious attack scanning. For example, during the operation and maintenance process of a certain power dispatching system, security personnel found that the traditional detection system frequently misreported legal vulnerability scanning behavior, causing the normal operation and maintenance process to be blocked, and at the same time failing to identify hidden horizontal penetration scanning activities in time.

[0023] In order to solve the above problems, the research and development team observed that malicious scanning behavior has multi-dimensional characteristics, including abnormal traffic patterns, abnormal consumption of host resources, and abnormal device communication. By analyzing the operation logs of the industrial control system, it was found that malicious scanning would generate persistent high-frequency probe packets, causing network latency fluctuations and abnormal host performance indicators. Based on this, the technical scheme concept shifted to establishing a dynamic risk assessment model to correlate and analyze multi-source data such as network traffic characteristics, host operating status, and device communication quality, forming a comprehensive risk determination mechanism.

[0024] As shown in Figure 1 The present application provides a method for identifying malicious scanning of industrial control system network behavior, which utilizes the asymmetry of information and the characteristics of hacker scanning strategies, and monitors the effects of malicious scanning from three aspects of network traffic, host logs, and device performance based on the state of production equipment, specifically including the following steps: S1, obtaining a benchmark risk value of a running state of a production device to be monitored; S2, classifying and counting the probe data packets of the network traffic by using the full-flow analysis device in a set monitoring period to obtain a network traffic risk value; S3, calculating a host log risk value according to the host log, calculating a host performance risk value according to the host performance detection result, and obtaining an industrial control device delay risk value according to the network delay of the industrial control device; S4, obtaining an accumulated dynamic risk value according to the network traffic risk value, the host log risk value, the host performance risk value and the industrial control device delay risk value, obtaining a summary risk value according to the accumulated dynamic risk value and the benchmark risk value of the device running state, and obtaining whether the current production device is malicious scanning according to the final summary risk value and a malicious scanning threshold.

[0025] In the specific embodiment of the present application, the device for production condition representation is mainly detected, and the production needs to rely on the device to run. According to the state of the selected device in the industrial control system, the running state and the maintenance state of the production are determined, and the corresponding basic risk value is determined according to the running state of the production , and the basic risk value is determined according to the running and maintenance state of the production .

[0026] In the specific embodiment of the present application, different monitoring periods are adopted for data monitoring of different devices, and the set monitoring period is T. Generally, the value is 0.5h or 1h.

[0027] In the monitoring period, the network traffic of the industrial control system is analyzed by using the full-flow analysis device, the data packets are captured and counted according to the port scanning and host scanning types, and the risk value is calculated according to the number; The host scanning types include ICMP Echo scanning, Broadcast ICMP scanning and ICMP Timestamp scanning; The port scanning types include TCP connect scanning, TCP SYN scanning, TCP ACK scanning, TCP FIN scanning, TCP Xmas scanning and TCP NULL scanning; The number of data packets of the host scanning type is M, the number of data packets of the port scanning type is N, and the network traffic risk value is The calculation method is as follows:

[0028] The number of login and connection failures c is counted according to the host log, and the host log risk value is calculated according to the number ; from CPU occupancy, memory occupancy, disk read-write rate, network import and export traffic rate four indicators monitoring host sex, disk read-write rate and network import and export rate index according to the maximum value of 0-1 between the conversion value, calculate the average value of host performance d, and then get the calculation host performance risk value ; real-time monitoring of network delay e of industrial control equipment, unit millisecond, calculate the network delay risk value ;

[0029]

[0030]

[0031] In the formula, Risk value calculation coefficient, g generally takes the value of 0.5.

[0032] According to the network traffic risk value, host log risk value, host performance risk value and industrial control equipment delay risk value, the cumulative dynamic risk value is obtained, specifically including: the calculation of dynamic risk .

[0033] According to the cumulative dynamic risk value and the reference risk value of the equipment running state, the summary risk value is obtained, specifically including: when in production state, the summary risk When in maintenance state, the summary risk .

[0034] According to the final summary risk value and the malicious scanning threshold value, it can be obtained whether the current production equipment is malicious scanning. Set the malicious scanning warning value h, judge whether the final summary risk value p in the current monitoring period reaches the warning value. If it exceeds the warning value, it is determined to be malicious scanning, and the industrial control system network security operation and maintenance personnel are reminded; otherwise, enter the next monitoring period to continue identification.

[0035] The main factor to determine whether the scanning behavior is malicious is the running and maintenance state of the production. If the production equipment state cannot be automatically obtained, the risk base score can be determined by manual input.

[0036] By accumulating the scanning behavior and impact, the hidden malicious scanning behavior of avoiding anti-scanning strategy and breaking down the whole into parts can be found.

[0037] The benchmark risk value is specifically a risk evaluation benchmark of the equipment under normal working conditions, and can be obtained by analyzing historical operation data, and is used to establish a risk baseline of the normal operation state of the equipment. The network traffic risk value calculation involves classification statistics of probe data packets, and specifically, deep packet inspection technology can be used to identify host scanning and port scanning feature data packets, such as classification by analyzing the TCP SYN flag bit and port access frequency. The host log risk value is related to system authentication logs and connection logs, and specifically, login failure events and abnormal connection termination events can be extracted as the basis for calculation. The host performance risk value integrates CPU, memory, disk and network resource usage states, and specifically, real-time index data can be collected by using a system performance monitoring tool. The industrial control equipment delay risk value monitors network communication quality, and specifically, the end-to-end transmission delay can be measured by using the ICMP protocol or a special probe.

[0038] Specifically, when the method is implemented, first, the equipment operation benchmark parameters are established, such as obtaining the normal range of the CPU occupancy rate and the memory usage index by continuous monitoring. In a set period, the full-flow analysis equipment captures network data packets in real time, and identifies host scanning and port scanning data packets by protocol analysis. At the same time, the host audit system records abnormal login events, the performance monitoring module collects resource usage data, and the network probe measures the communication delay between devices. After standardization processing of the data in each dimension, dynamic risk values are generated according to the predetermined algorithm. Finally, a comprehensive risk score is formed by weighted aggregation, and a security alarm is triggered when the score exceeds the preset threshold.

[0039] The present application effectively distinguishes between normal operation and maintenance and malicious scanning behavior through multi-dimensional data fusion analysis. For example, in the actual measurement of a DCS system in a chemical plant, the false positive rate of the traditional detection method based on the traffic threshold reaches 37%, and by introducing the correlation analysis of equipment performance indicators, the false positive rate is reduced to below 8%.

[0040] Through the above technical solutions, the present application realizes accurate identification of malicious scanning behavior of the industrial control system. By combining dynamic benchmarks with real-time monitoring data, the problem of poor adaptability of traditional static detection mechanisms is solved; by multi-dimensional data fusion analysis, the false judgment defects of single-dimensional detection are overcome; and by risk value aggregation calculation, an elastic judgment mechanism adaptable to different industrial control scenes is established. The method ensures normal operation and maintenance while effectively improving the detection rate and accuracy of malicious scanning behavior.

[0041] The present application further proposes that in S4, the final aggregated risk value and the malicious scanning threshold are used for judgment, if the value exceeds the warning value, it is determined as malicious scanning, and a reminder signal is sent to the industrial control system network security operation and maintenance personnel; otherwise, the next monitoring period is entered.

[0042] The final aggregated risk value is a value calculated by integrating the dynamic risk value and the device operation state benchmark risk value, and can be specifically implemented by using a weighted average or a linear superposition algorithm, and is used to reflect the overall security risk level of the current system. The malicious scanning threshold is a pre-set risk judgment critical value, which can be specifically determined by analyzing historical security event data, and is used to distinguish between normal scanning behavior and abnormal attack behavior. The warning value is a dividing point for triggering an alarm in the malicious scanning threshold, which can be specifically implemented by using a dynamic threshold or a static threshold setting method, and is used to control the alarm triggering sensitivity. The reminder signal is a way to deliver alarm information to the operation and maintenance personnel, which can be specifically implemented by using a sound and light alarm, a pop-up prompt or a short message notification mechanism, and is used to realize the immediate response of the risk event.

[0043] Specifically, after the final aggregated risk value is calculated by integrating the dynamic risk value and the benchmark risk value, the value is compared with the pre-set malicious scanning threshold in real time. If the final aggregated risk value exceeds the upper limit of the warning value interval in the threshold, the alarm mechanism is automatically triggered to generate a reminder signal, and the current monitoring period is terminated; if the warning value is not exceeded, the monitoring state is maintained and the next monitoring period is entered. This judgment mechanism realizes dynamic identification and hierarchical response to malicious scanning behavior through periodic risk value comparison.

[0044] The application can trigger an alarm in a timely manner at the initial stage of risk accumulation by setting a warning value interval and combining a periodic monitoring mechanism, thereby avoiding the false negative or false positive problems caused by single detection error in traditional methods.

[0045] Through the above technical solutions, the application realizes accurate hierarchical judgment of malicious scanning behavior, triggers an alarm immediately when the risk value exceeds the warning value, and guarantees the rapid response capability of the industrial control system when it is attacked by scanning; maintains the monitoring state when the risk value is in the safe interval, thereby avoiding the invalid occupation of operation and maintenance resources by the traditional continuous alarm mechanism. This dynamic judgment mechanism effectively balances the contradiction between security protection strength and system resource consumption.

[0046] The application further proposes that the monitoring period T is 0.5 hours or 1 hour.

[0047] The monitoring period T is a fixed time interval for the system to collect data on network traffic and host status and calculate risks, which can be specifically implemented by using a timer trigger or a polling mechanism, and this parameter is used to balance the relationship between detection real-time performance and system resource consumption. By limiting the selectable range of the monitoring period, the real-time performance requirements of different industrial control scenarios can be adapted, and the system performance loss caused by too high detection frequency or the missed judgment of malicious behavior caused by too long detection interval can be avoided.

[0048] Specifically, the monitoring period is set to two optional modes of 0.5 hours or 1 hour. During the operation of the industrial control system, the full-flow analysis device periodically collects the number of network probe data packets based on the period, and synchronously acquires host logs, performance indicators, and device delay data. For example, in the power monitoring system, when a 1-hour period is used, the system performs traffic feature extraction and risk value calculation once every hour; and in the chemical production control system, if there is a high real-time requirement, a 0.5-hour period can be selected for more intensive monitoring. This discrete period setting not only ensures the timeliness of malicious scan behavior identification, but also avoids the problem of overloading of computing resources caused by continuous monitoring.

[0049] By limiting the optional period range of 0.5-1 hour, the application not only conforms to the typical time characteristics of network behavior changes of industrial control systems, but also provides flexible selection space for different industrial scenarios, while ensuring the ability to capture malicious scan behavior, effectively controlling the periodic consumption of computing resources.

[0050] Through the above technical solutions, the application can select a matching detection frequency threshold according to the security level requirements of specific industrial scenarios. On the premise of ensuring the real-time operation stability of the industrial control system, the short-term burst of abnormal scan behavior characteristics is accurately captured, while avoiding the problem of normal scan misjudgment or malicious scan missed detection caused by improper monitoring frequency setting, realizing the optimization balance of detection accuracy and system performance.

[0051] Specifically, the host scan type data packet is a data packet generated by a connection request or a probe behavior for different hosts in the target network, which can be specifically realized by the full-flow analysis device to count the access frequency of the source IP address, and is used to reflect the coverage range of the scan behavior on the host assets. The port scan type data packet is a data packet generated by probing different ports of the same host, which can be specifically realized by analyzing the port access distribution characteristics of the target IP address, and is used to reflect the depth of the scan behavior on a single device. The risk value calculation function f is a mathematical relationship for mapping the number of data packets to a risk score, which can be specifically realized by a linear function or a segmented function, and is used to convert the intensity of different scan behaviors into a quantifiable risk indicator.

[0052] Specifically, within the set monitoring period, the full-flow analysis device captures and classifies the network traffic, and the number of host scan type data packets M and the number of port scan type data packets N are recorded respectively. The sum of the two types of data packet numbers is input into the risk value calculation function f, and the network traffic risk value is output. For example, when the monitoring period T is 1 hour, if the number of host scan data packets M is 200 and the number of port scan data packets N is 150, then through the function f = 1 / (3600M + 360N), the risk value is calculated as 0.0005. T) The risk value is calculated =(200+150) / (360 1)≈0.97. This value participates in the dynamic risk assessment together with other subsequent risk values.

[0053] The application can more accurately reflect the comprehensive threat level of scanning behavior by distinguishing between the two behavior types of host scanning and port scanning and combining the superposition effect of the number of data packets. At the same time, the risk value calculation function is dynamically associated with the monitoring period, avoiding evaluation deviations caused by different monitoring durations.

[0054] Through the above technical solutions, the application can effectively quantify the risk level of scanning behavior in network traffic, improve the recognition accuracy of malicious scanning characteristics by distinguishing between scanning types and dynamically calculating functions, and provide a reliable data basis for subsequent cumulative risk value calculation, so that the determination of malicious scanning behavior no longer depends on a single index or static rules, thereby reducing the false positive rate and the false negative rate.

[0055] The application further proposes that the risk value calculation function is related to the monitoring period T, specifically: f = 1 / 360T.

[0056] The risk value calculation function is a mathematical relationship for converting the number of data packets of host scanning and port scanning into a risk value, which can be implemented by a linear function or a nonlinear function, such as constructing a normalization coefficient through a time period parameter. The monitoring period T is the length of the time window for network traffic statistics, which can be implemented by a fixed duration or a dynamically adjusted interval, such as being manually configured by system preset or operation and maintenance personnel, for controlling the time granularity of risk value calculation.

[0057] Specifically, after setting the monitoring period T, the sum of the number of data packets of host scanning type M and the number of data packets of port scanning type N is multiplied by the reciprocal of 360T to realize dynamic calibration of the risk value. For example, when the monitoring period T is set to 1 hour, the value of function f is 1 / 360, and at this time, the risk value increment is about 0.00278 for each additional scanning data packet. This calculation method can adjust the sensitivity of the risk value according to actual monitoring requirements, automatically increase the calculation frequency of the risk value when the monitoring period is shortened, and reduce the calculation density when the monitoring period is extended.

[0058] The application establishes a mathematical relationship between the risk value calculation function and the monitoring period, so that the calculation parameters of the risk value can be dynamically adjusted with the monitoring time window, effectively solving the problem of risk value calculation deviation caused by fixed coefficients at different detection frequencies.

[0059] By the technical solution, the network flow risk value is dynamically calibrated, the threat degree of scanning behavior under different monitoring periods can be accurately reflected, the overaccumulation of risk value in short-period monitoring is avoided, the insensitivity of risk value in long-period monitoring is prevented, and thus the accuracy of malicious scanning behavior identification is improved.

[0060] The application further proposes that the calculation of the host log risk value is based on the number of login failures and connection failures, and the specific calculation formula is: the host log risk value is equal to the risk value calculation coefficient multiplied by the total number of login failures and connection failures.

[0061] The number of login failures is the number of times that a user attempts to log in to the system but fails to pass the verification in the monitoring period, and can be specifically counted by the authentication failure events recorded in the audit log. The number of connection failures is the number of times that a device attempts to establish a network connection with the outside but fails in the monitoring period, and can be specifically counted by the TCP handshake failure events recorded in the firewall log or network flow log. The risk value calculation coefficient is used to map the number of failures to a risk quantitative value, and can specifically adopt a dynamically adjusted weight coefficient, such as determining according to the correlation between the number of failures and attack behavior in historical data.

[0062] Specifically, the host log is collected and analyzed in real time in the monitoring period, and log entries containing login authentication failure and network connection failure are extracted. For example, when the keyword "authentication failed" appears in the audit log, the number of login failures is incremented by one; when "SYN_SENT no ACK response received" appears in the network log, the number of connection failures is incremented by one. After accumulating the total number of two types of failures, the preset risk coefficient is multiplied to obtain a numerical index representing the risk degree of host abnormal access behavior. The numerical index can dynamically reflect the risk level of the system suffering from brute force cracking or abnormal detection.

[0063] Compared with the prior art, the traditional method only records the log statically or gives a simple threshold alarm, and cannot correlate and analyze different types of failure events. In the prior art, the number of login failures is usually counted separately, but the possible horizontal penetration behavior accompanied by network connection failure is not considered. The application can more comprehensively reflect the characteristics of potential attack behavior by integrating the two types of failures and introducing quantitative calculation.

[0064] Through the technical solution, the application realizes fine evaluation of the abnormal access behavior of the host. By quantitatively analyzing the comprehensive influence of authentication failure and connection failure, normal operation and maintenance operation and malicious scanning behavior can be effectively distinguished. For example, when an attacker performs brute force cracking, the system will not only generate a large number of login failure records, but also generate connection failure records due to attempts to connect to unopened ports. The superimposed calculation of the double indicators can improve the detection sensitivity. At the same time, the introduction of the risk coefficient enables flexible adjustment of the detection strategy in different application scenarios, avoiding false positives or false negatives caused by fixed thresholds.

[0065] The CPU occupancy rate is the usage ratio of the processor resource, which can be collected in real time through the performance counter provided by the operating system, and is used to reflect the host computing load state. The memory occupancy rate is the usage ratio of the physical memory, which can be obtained through the system monitoring tool, and is used to evaluate the memory resource consumption. The disk read-write rate is the number of bytes of disk data read and written per unit time, which can be monitored through the I / O performance interface of the storage device, and is used to judge the disk activity intensity. The network import and export traffic rate is the amount of data sent and received per unit time through the network interface, which can be obtained through the network traffic probe or the network card statistical function, and is used to analyze the network communication load. The average value d of the above four indicators is used to quantitatively evaluate the overall performance state of the host, and the coefficient 5 is used to amplify the influence weight of abnormal fluctuations on the risk value.

[0066] Specifically, in the monitoring period, the real-time data of the CPU occupancy rate, the memory occupancy rate, the disk read-write rate and the network import and export traffic rate are continuously collected through the system interface. The monitoring values of the four indicators are arithmetically averaged to obtain the value d, and then the average value is multiplied by the fixed coefficient 5 to generate the host performance risk value p_5. When malicious scanning behavior occurs, abnormal network requests will cause an increase in CPU and memory resource consumption, frequent log writing will increase disk activity intensity, and a large amount of probe data packet transmission will significantly change the network traffic rate. Through the comprehensive calculation of multiple performance indicators, the abnormal fluctuations caused by malicious scanning can be effectively captured.

[0067] Compared with the prior art, the traditional method usually only monitors a single performance indicator or uses a fixed threshold to judge the abnormality, which is easy to produce false alarms due to normal business fluctuations. The application realizes multi-index fusion calculation and dynamic weighting processing, which not only avoids the limitations of single-point monitoring, but also eliminates the interference of accidental fluctuations through average calculation, and more accurately reflects the systematic influence of malicious scanning on the host performance.

[0068] Through the technical solution, the application can realize real-time sensing of multi-dimensional performance abnormalities caused by malicious scanning, such as CPU load surge, memory resource depletion, disk abnormal read-write and network traffic mutation, and improve the sensitivity of risk judgment through the weighted calculation model, providing reliable performance state evaluation basis for distinguishing between normal operation and maintenance scanning and malicious attacks.

[0069] The application further proposes that the calculation of the delay risk value of the industrial control device is based on the real-time monitored network delay of the device, and the specific calculation formula is as follows: the delay risk value of the industrial control device is equal to the risk value calculation function coefficient multiplied by the network delay obtained by monitoring.

[0070] Among them, the network delay is the time difference required for a data packet to be sent from the sending end to the receiving end, which can be obtained by deploying real-time monitoring tools between the industrial control device and the network node, such as using timestamp recording or special network probe measurement. This parameter is used to quantify the abnormal delay of network communication. Malicious scanning behavior may cause network congestion or abnormal device response, thereby significantly increasing the delay. Among them, the risk value calculation function coefficient is a proportional factor for converting network delay into risk value, which can be determined by a pre-set weight parameter or a dynamic adjustment algorithm. This coefficient can adjust the contribution of delay to the overall risk according to the actual network environment, such as setting a higher coefficient in critical devices to enhance sensitivity.

[0071] Specifically, during the operation of the industrial control system, the network communication data between devices is collected in real time, and the average network delay in each monitoring period is calculated. Multiply the delay value by the preset coefficient to get the delay risk value of the industrial control device. For example, when the network delay exceeds the normal threshold, the risk value will increase linearly with the delay, thereby reflecting the network load anomaly caused by potential malicious scanning. This risk value is further combined with other indicators (such as host performance risk value) to dynamically assess the security status of the system.

[0072] Compared with the prior art, the existing method usually relies on fixed threshold to judge network anomaly, and cannot dynamically quantify the influence of delay on malicious scanning. By introducing a linear calculation model of delay risk value and combining real-time monitoring data, the application can more accurately capture changes in network behavior caused by malicious scanning, and adapt to the running characteristics of different devices through coefficient adjustment.

[0073] Through the above technical solutions, the application can effectively identify network delay anomalies caused by malicious scanning and avoid false positives or false negatives caused by static thresholds. For example, when the industrial control device is blocked due to high-frequency port scanning, the dynamic increase of the delay risk value can quickly trigger an early warning, providing more timely risk response basis for operation and maintenance personnel.

[0074] The weighted average is a calculation manner of linear combination of multiple risk indicators according to weight coefficients, and can be realized by superimposing operation of each risk value according to preset weight coefficients. The influence degree of different risk factors on the overall security situation is reflected through weight distribution. The cumulative dynamic risk value is a comprehensive quantitative index reflecting the real-time security threat degree, which can be realized by continuously collecting network flow, host log, performance parameter and device delay data and dynamically calculating, and is used to represent the possibility of current system suffering from malicious scanning attack.

[0075] Specifically, in the set monitoring period, the network flow risk value is calculated by counting the number of host scanning and port scanning data packets, the host log risk value is generated based on the frequency of login failure and connection failure events, the host performance risk value is derived from the monitoring of CPU, memory, disk and network resource occupation rate, and the industrial control device delay risk value is determined according to real-time network communication delay data. The above four risk values form the cumulative dynamic risk value by direct superposition, and the value is compared and analyzed with the preset reference risk value, and finally the malicious scanning behavior is identified through the risk threshold judgment mechanism.

[0076] In some embodiments, the superimposition operation of risk values can adopt equal weight calculation manner, such as directly adding the four risk values. In other embodiments, different weight coefficients can be configured according to different industrial control scenes, such as assigning higher weight to the network flow risk value to strengthen scanning behavior monitoring.

[0077] Compared with the prior art, the traditional method usually adopts a single risk indicator or simple logic judgment for scanning behavior identification, such as relying only on network flow anomaly detection or host log analysis. The present application can more comprehensively capture the correlation characteristics of malicious scanning behavior in multiple aspects by constructing a multi-dimensional risk indicator system and performing dynamic weighted calculation, effectively solving the misjudgment problem caused by single information dimension of traditional method.

[0078] Through the above technical solutions, the present application can realize panoramic risk assessment of industrial control system network behavior, accurately identify malicious scanning behavior with extensive detection characteristics while maintaining normal operation and maintenance scanning operation, and provide an intelligent identification mechanism for industrial control system that takes into account operation efficiency and security protection.

[0079] The application further provides an identification system for malicious scanning of network behaviors of an industrial control system, comprising a preset module, a network traffic acquisition module, a host risk module and an identification module: the preset module is used to acquire a benchmark risk value of a running state of a production device to be monitored; the network traffic acquisition module is used to classify and count detection data packets of network traffic in a set monitoring period by using a full-traffic analysis device and acquire a network traffic risk value; the host risk module is used to calculate a host log risk value according to host logs, calculate a host performance risk value according to host performance detection results, and acquire an industrial control device delay risk value according to network delay of the industrial control device; the identification module is used to acquire an accumulated dynamic risk value according to the network traffic risk value, the host log risk value, the host performance risk value and the industrial control device delay risk value, acquire a summary risk value according to the accumulated dynamic risk value and the benchmark risk value of the device running state, and judge whether the current production device is malicious scanning according to the final summary risk value and a malicious scanning threshold.

[0080] Among them, the full-traffic analysis device is a hardware or software device capable of capturing and classifying network data packets, which can be implemented by using a deep packet inspection technology, and is used to distinguish data packets of host scanning and port scanning types. The host log risk value calculation involves the number statistics of login failures and connection failures, which can be realized by collecting abnormal event data in real time through a log analysis tool, and is used to reflect the behavior characteristics of the system suffering from brute force cracking. The industrial control device delay risk value is calculated based on network communication delay data, which can be measured by using a network probe or a protocol analyzer to measure the end-to-end transmission delay, and is used to identify abnormal network congestion or illegal connection behaviors.

[0081] Specifically, the preset module establishes a benchmark risk value of a device in a normal running state through baseline learning, the network traffic acquisition module counts the number of scanning data packets in a fixed period and converts it into a traffic risk value, and the host risk module synchronously calculates three types of risk indexes of log abnormalities, performance fluctuations and communication delays. The identification module performs weighted fusion of dynamic risk indexes and benchmark values, and triggers an alarm mechanism when the summary risk value exceeds a preset threshold. Each module realizes information interaction through a data bus, such as time sequence correlation analysis of traffic statistics results and host performance data, so as to distinguish between normal operation and maintenance scanning and malicious detection behaviors.

[0082] Compared with the prior art, the traditional industrial control security system usually adopts a single-dimensional detection method, such as relying only on traffic analysis or log auditing, which is difficult to accurately identify malicious scanning disguised as legal scanning. The application fuses multi-source heterogeneous data to construct a three-dimensional detection model covering the network layer, the host layer and the device layer, which can effectively identify hidden attack behaviors implemented by using legal scanning tools, and at the same time reduce the false positive rate caused by operation and maintenance operations.

[0083] Through the technical solution, the application realizes accurate identification of malicious scanning behavior of an industrial control system, abnormal scanning activities beyond the normal operation and maintenance range can be found in time through multi-dimensional calculation of a dynamic risk value and a benchmark comparison mechanism.

[0084] The above merely describes the embodiments of the application and is not used to limit the protection scope of the application.

[0085] The application provides an identification method for malicious scanning behavior of an industrial control system, which has the following beneficial technical effects: a correlation between information mastered by hackers and scanning strategies taken by the hackers and an impact generated by scanning an industrial control system is established, real-time identification of malicious scanning behavior of an industrial control system is performed from three aspects of network traffic, host logs and device performance according to an operation condition of the industrial control system when the scanning behavior occurs, attack behavior of hackers can be found in an information collection stage of an early network attack, and the security protection capability of the industrial control system is effectively improved.

Claims

1. A method for identifying malicious scanning of industrial control system network behavior, characterized in that, The method comprises the following steps: S1, obtaining a benchmark risk value of a running state of a production device to be monitored; S2, classifying and counting the probe data packets of network traffic by using a full-flow analysis device in a set monitoring period to obtain a network traffic risk value; S3, calculating a host log risk value according to host logs, calculating a host performance risk value according to host performance detection results, and obtaining an industrial control device delay risk value according to network delay of the industrial control device; S4, obtaining an accumulated dynamic risk value according to the network traffic risk value, the host log risk value, the host performance risk value, and the industrial control device delay risk value, obtaining a summary risk value according to the accumulated dynamic risk value and the benchmark risk value of the running state of the device, and obtaining whether the current production device is malicious scanning according to the final summary risk value and a malicious scanning threshold.

2. The method of claim 1, wherein the method further comprises: In S4, the final summary risk value and the malicious scanning threshold are used for judgment, if the value exceeds a warning value, it is determined that the scanning is malicious, and a warning signal is sent to an industrial control system network security operation and maintenance personnel; otherwise, the next monitoring period is entered.

3. The method of claim 1, wherein the method further comprises: The monitoring period T is 0.5 hours or 1 hour.

4. The method of claim 1, wherein the method further comprises: The calculation method of the network traffic risk value is based on the classified statistical host scanning type packet quantity M and the port scanning type packet quantity N, and the specific calculation formula is as follows: wherein is a risk value calculation function, is a number of data packets of the host scan type within a certain time, is a number of data packets of the port scan type within a certain time.

5. The method of claim 4, wherein the method further comprises: The risk value calculation function is related to the monitoring period T, and specifically: 。 6. The method of claim 1, wherein the method further comprises: the host log risk value The calculation is based on the number of login failures and connection failures c, and the specific calculation formula is as follows: wherein is a risk value calculation coefficient.

7. The method of claim 1, wherein the method further comprises: The calculation of the host performance risk value is based on the monitoring of four indexes of CPU occupancy, memory occupancy, disk read-write rate, and network import and export flow rate, and the specific calculation formula is as follows: wherein is the average value of CPU occupancy, memory occupancy, disk read / write rate, network import / export traffic rate indicators.

8. The method of claim 1, wherein the method further comprises: The industrial control device delay risk value The calculation is based on the real-time monitored device network delay e, and the specific calculation formula is as follows: i*e, wherein e is the monitored network delay, and i is a risk value calculation function coefficient.

9. The method of claim 1, wherein the method further comprises: The cumulative dynamic risk value is a weighted average of network traffic risk value, host log risk value, host performance risk value and industrial control equipment delay risk value, and the specific calculation formula is as follows: .

10. An identification system of malicious scanning industrial control system network behavior, characterized in that, The method comprises a preset module, a network traffic acquisition module, a host risk module, and an identification module: The preset module obtains a benchmark risk value of a running state of a production device to be monitored; The network traffic acquisition module classifies and counts the probe data packets of network traffic by using a full-flow analysis device in a set monitoring period to obtain a network traffic risk value; The host risk module calculates a host log risk value according to host logs, calculates a host performance risk value according to host performance detection results, and obtains an industrial control device delay risk value according to network delay of the industrial control device; The identification module obtains an accumulated dynamic risk value according to the network traffic risk value, the host log risk value, the host performance risk value, and the industrial control device delay risk value, obtains a summary risk value according to the accumulated dynamic risk value and the benchmark risk value of the running state of the device, and obtains whether the current production device is malicious scanning according to the final summary risk value and a malicious scanning threshold.

Images