Industrial network security traceability analysis method based on security agent

Abstract

The invention relates to the technical field of network security, in particular to an industrial network security traceability analysis method based on a security agent. According to the method, real-time access logs are filtered and screened, and the association degree with each storage access log is calculated; calculating an abnormal access characteristic value based on the request rate and the concurrent connection number, transferring a data packet corresponding to the real-time access log of which the abnormal access characteristic value is smaller than a preset characteristic value into the simulated security agent, and recording the access data of the simulated security agent; judging whether isolation succeeds or not based on the isolation characterization value, including analyzing a task execution action corresponding to the real-time access log if it is judged that isolation succeeds; if it is judged that isolation is not successful, a plurality of storage access logs are determined based on the correlation degree, or it is judged that the real-time access data are first abnormal data to generate corresponding storage access logs. According to the invention, the behavior action of the visitor is analyzed for security tracing, so that the accuracy of industrial network security tracing analysis is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an industrial network security tracing and analysis method based on security intelligent agents. Background Technology

[0002] With the deepening of industrial digital transformation, the deep integration of Industrial Control Systems (ICS) and the Internet of Things (IIoT) has broken the closed nature of traditional industrial networks, but it has also exposed critical infrastructure to increasingly complex network threats. The complexity of industrial protocols has led to serious delays in traceability and response, making it difficult to meet real-time protection requirements. The rise of security intelligent agent technology has become the key to breaking the deadlock. Through intelligent analysis of security logs and automatic generation of attack links, the defense efficiency has been greatly improved compared with the traditional mode, which has resolved the inherent contradiction between real-time performance and security in industrial scenarios and become the technical support for ensuring industrial network security.

[0003] For example, Chinese Patent Publication No. CN119135439A discloses a method and system for tracing network security attacks, relating to the field of network security technology. The method includes: performing anomaly analysis on the frequency of accessing IPs to obtain multiple first-level anomalous IPs and multiple first-level IP anomalies; retrieving the access timestamp set of multiple first-level anomalous IPs for anomaly analysis on access density to obtain multiple second-level anomalous IPs and multiple second-level time anomalies; retrieving the URL dispersion anomaly analysis of multiple second-level anomalous IPs to obtain multiple third-level anomalous IPs and multiple third-level URL anomalies; calculating multiple comprehensive anomalies; and combining the multiple third-level anomalous IPs to output the tracing result. This invention can solve the technical problem that existing methods typically rely on a single indicator to identify potential attack sources, resulting in low accuracy in attack tracing and an inability to effectively identify complex attack behaviors. It can significantly improve the accuracy and comprehensiveness of attack source identification and effectively respond to complex and covert network attacks.

[0004] The following problems still exist in the existing technology: Existing technologies that analyze access anomalies solely based on the number of IP addresses accessed result in inaccurate security detection of network access. Summary of the Invention

[0005] To address this issue, the present invention provides an industrial network security tracing and analysis method based on a security intelligent agent, which overcomes the problem in the prior art where analyzing access anomalies solely through the number of IP accesses leads to inaccurate security detection of network access.

[0006] To achieve the above objectives, this invention provides an industrial network security tracing and analysis method based on a security intelligent agent, comprising: Real-time access data from the industrial network is collected to generate real-time access logs. The real-time access logs are then filtered and screened, and the correlation with each stored access log is calculated. The request rate, concurrent connection count, and access traffic of each real-time access log are obtained respectively. An abnormal access feature value is calculated based on the request rate and the concurrent connection count. Data packets corresponding to real-time access logs whose abnormal access feature values ​​are less than a preset feature value are transferred to the simulated security agent and the access data of the simulated security agent is recorded. The simulated security agent access data is imported into the large security agent model to generate isolation representation values. Based on these isolation representation values, it is determined whether isolation was successful, including... If the isolation is successful, the task execution actions corresponding to the real-time access logs are analyzed, a behavior representation value is generated based on the task execution actions, and the access risk level is determined based on the behavior representation value and the corresponding handling method is determined. If isolation is deemed unsuccessful, then based on the correlation, a number of storage access logs are determined, the abnormal proportion of the number of storage access logs is determined to determine the access risk level and the corresponding processing method is determined, or the real-time access data is determined to be the first abnormal data to generate the corresponding storage access log.

[0007] Furthermore, the process of filtering and screening the real-time access logs and calculating the correlation with each storage access log includes, Extract the structure fields from the real-time access log; The similarity between the structure field and the storage fields in each storage access log is calculated as the correlation degree.

[0008] Furthermore, the process of calculating the abnormal access characteristic value based on the request rate and the number of concurrent connections includes, The ratio of the request rate to the normal rate is determined as the rate impact factor. The ratio of concurrent connections to general connections is determined as the connection number influence factor; The weighted sum of the rate influence factor and the connection number influence factor is determined to be the abnormal access characteristic value.

[0009] Furthermore, the process of recording the simulated secure intelligent agent's access data includes, The abnormal access feature value is compared with the preset feature value, and the comparison result determines whether to transfer the data packet corresponding to the real-time access log to the simulated security agent. The corresponding simulated security agent is invoked based on the real-time access logs; The interaction information between the data packets corresponding to the real-time access logs transferred to the simulated security agent and the data in the simulated security agent is collected to generate the access data of the simulated security agent.

[0010] Furthermore, the process of importing the simulated security agent access data into the large security agent model to generate isolation representation values, and determining whether isolation is successful based on the isolation representation values, includes the following steps: Import the simulated security agent access data into the large security agent model to generate query counts, file read counts, and login attempt counts; The isolation characterization value is generated based on the number of queries, the number of file reads, and the number of login attempts. The isolation characterization value is compared with a preset characterization value, and the isolation success is determined based on the comparison result.

[0011] Furthermore, the step of determining whether isolation was successful based on the comparison results includes, If the isolation characterization value is greater than or equal to the preset characterization value, then the isolation is determined to be successful.

[0012] Furthermore, the process of determining the access risk level and the corresponding handling method based on the behavioral representation value includes, Obtain the reconnaissance action data, lateral movement action data, and execution action data corresponding to the real-time access log; The behavioral representation value is generated based on the reconnaissance action data, the lateral movement action data, and the execution action data; The behavioral representation value is compared with several preset behavioral values, and the access risk level is determined based on the comparison result, and the corresponding processing method is determined.

[0013] Furthermore, based on the comparison results between the behavioral representation value and several preset behavioral values, the access risk level is determined, and the corresponding handling method is determined, wherein, If the behavior representation value is greater than or equal to the first preset behavior value, the access risk level is determined to be the first risk level, and the method of terminating access and disconnecting the network is adopted. If the behavior representation value is less than the first preset behavior value and greater than or equal to the second preset behavior value, then the access risk level is determined to be the second risk level, and access restriction and access tracing are implemented. If the behavior representation value is less than the second preset behavior value, the access risk level is determined to be the third risk level, and a method for monitoring access behavior is adopted. Wherein, the first preset behavior value is greater than the second preset behavior value.

[0014] Furthermore, the process of determining the access risk level and the corresponding handling method based on the anomaly ratio includes, Calculate the total number of associated storage access logs whose correlation degree is greater than the preset correlation degree and determine the abnormal associated access logs included therein; Calculate the proportion of the abnormal associated access logs to the total number of associations to generate the abnormality ratio; The abnormal ratio is compared with several preset ratios, and the access risk level is determined based on the comparison results, and the corresponding handling method is determined.

[0015] Furthermore, based on the comparison results between the abnormality rate and several preset rates, the access risk level is determined and the corresponding handling method is determined, wherein, If the abnormal ratio is greater than or equal to the first preset ratio, the access risk level is determined to be the first risk level, and the method of terminating access and disconnecting the network is adopted. If the abnormal ratio is less than the first preset ratio and greater than or equal to the second preset ratio, the access risk level is determined to be the second risk level, and access restriction and access tracing are implemented. If the abnormal ratio is less than the second preset ratio, the access risk level is determined to be the third risk level, and a method for monitoring access behavior is adopted. The first preset ratio and the second preset ratio are both positively correlated with the active time of the data packets corresponding to the real-time access logs being transferred into the simulated security agent, and the first preset ratio is greater than the second preset ratio.

[0016] Compared with existing technologies, this invention generates access logs by collecting access data in industrial networks, filters and selects real-time access logs and calculates their correlation with various stored access logs, collects all access data and generates structured logs, avoiding the inability to locate key nodes during tracing due to data gaps, and provides a complete and traceable data source for subsequent analysis. Real-time filtering and selection can compress the amount of data to be analyzed. Based on accurate tracing of real-time and correlated logs, common attack paths can be discovered in the early stages of anomalies by tracing the correlation of multiple events. Based on attack patterns, targeted reinforcement can be carried out, improving the accuracy of industrial network security tracing and analysis.

[0017] Furthermore, this invention makes a preliminary judgment on access based on request rate and concurrent connection count, imports data packets with abnormal access into a simulated security agent, collects the visitor's operations within the simulated security agent, and analyzes these operations. Traditional defenses can only passively alert for abnormal access in industrial networks, while the simulated security agent technology can achieve proactive defense through the following methods: When the system detects that the request rate of a certain IP exceeds a threshold or the number of concurrent connections is abnormal, it automatically redirects the subsequent traffic of that IP to the simulated security agent. This process can quickly cut off the attack path and prevent real devices from being compromised. The simulated security agent interacts with attackers through a highly realistic industrial scenario, making them mistakenly believe that they have successfully compromised real devices, thereby consuming attack resources and extending the attack timeline. Through full-dimensional behavior recording and attack intent analysis, the simulated security agent can solve the problem of fragmented traditional log data, significantly improving the accuracy of source tracing and further enhancing the accuracy of industrial network security source tracing analysis.

[0018] Furthermore, this invention analyzes the actions of visitors within the simulated security agent to determine whether the visitor has realized they have been isolated. If the visitor is determined not to have been exposed, the invention categorizes their behavior and takes corresponding actions. Industrial network attacks often achieve long-term infiltration through covert penetration. The simulated security agent, through dynamic camouflage technology and interactive response strategies, allows attackers to continue operating without noticing isolation, thereby capturing the complete attack chain. The simulated security agent can dynamically optimize the simulation environment and response mechanism based on real-time feedback from attackers, enabling interactive attribution and solving the problems of incomplete log data and delayed analysis in traditional methods. It achieves a full-dimensional reconstruction of the attack chain, and through lightweight deployment, improves defense efficiency without affecting production, building a sustainably optimizable security defense system and further enhancing the accuracy of industrial network security attribution analysis.

[0019] Furthermore, this invention analyzes the actions of visitors within a simulated security agent. Upon determining that the visitor has discovered their exposure, it filters logs with high correlation based on the correlation values ​​between real-time access logs and stored historical logs. This analysis determines the proportion of abnormal accesses to assess the risk level of the access and implement corresponding handling methods. After discovering exposure, visitors typically interrupt their operations immediately, such as closing connections, ceasing malicious behavior, or clearing traces, leading to fragmentation of real-time operational data within the simulated security agent. High-correlation log filtering quickly connects the current exposure event with historical behavior, filling evidentiary gaps. High-correlation logs can reveal previous intrusion attempts by the visitor or similar visitors, preventing a break in the tracing chain due to current operational interruptions that only reveal the simulated security agent event without knowing the intrusion source. The visitor's post-exposure interruption behavior can easily obscure their true intentions, while high-correlation log analysis can deduce the true purpose through historical behavior, making the tracing conclusion more complete and further improving the accuracy of industrial network security tracing analysis. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating the steps of the industrial network security tracing and analysis method based on a security intelligent agent according to the present invention. Figure 2 This is a diagram illustrating the steps for determining whether isolation was successful according to an embodiment of the present invention; Figure 3 This is a logic diagram for determining whether isolation is successful in an embodiment of the present invention; Figure 4 This is a logic diagram illustrating how an embodiment of the present invention determines the access risk level and the corresponding processing method based on behavioral representation values. Detailed Implementation

[0021] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0022] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0023] It should be noted that in the description of this invention, the terms "upper," "lower," "inner," "outer," etc., which indicate the direction or positional relationship, are based on the direction or positional relationship shown in the drawings. This is only for the convenience of description and is not intended to indicate or imply that the device or element must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, it should not be construed as a limitation of this invention.

[0024] Please see Figure 1The diagram illustrates the steps of the industrial network security tracing and analysis method based on a security intelligent agent according to the present invention. The method includes: Step S1: Collect real-time access data from the industrial network to generate real-time access logs, filter and screen the real-time access logs, and calculate the correlation with each storage access log. Step S2: Obtain the request rate, concurrent connection count and access traffic of each real-time access log, calculate the abnormal access feature value based on the request rate and concurrent connection count, and transfer the data packets corresponding to the real-time access logs with abnormal access feature values ​​less than the preset feature value to the simulated security agent and record the access data of the simulated security agent. Step S3: Import the simulated security agent access data into the large security agent model to generate isolation representation values. Determine whether isolation is successful based on the isolation representation values, including: Step S4: If the isolation is successful, analyze the task execution actions corresponding to the real-time access logs, generate a behavior representation value based on the task execution actions, determine the access risk level based on the behavior representation value, and determine the corresponding handling method. Step S5: If isolation is deemed unsuccessful, determine a number of storage access logs based on correlation, determine the abnormal proportion of the storage access logs to determine the access risk level and the corresponding handling method, or determine that the real-time access data is the first abnormal data to generate the corresponding storage access log.

[0025] Specifically, in step S1, the process of filtering and screening the real-time access logs and calculating their correlation with each storage access log includes, Extract the structure fields from the real-time access logs; The similarity between the structure field and the storage fields in each storage access log is calculated as the correlation degree.

[0026] Specifically, the structure fields include, but are not limited to, basic identification classes, business operation classes, time feature classes, and content feature classes. Among them, the basic identification classes include source IP, target IP, target device ID, and access account, etc.; the business operation classes include protocol type, operation instructions, and port number, etc.; the time feature classes include access timestamp and access duration, etc.; and the content feature classes include data hash and anomaly marker, etc.

[0027] Specifically, the similarity MP between the list of structured fields (YB1, YB2, ..., YBj, ..., YBm) of the real-time access log and the list of structured fields EB=(EB1, EB2, ..., EBj, ..., EBm) of the stored access log; where j=1,2, ...,m; Relevance: MP=∑mj=1YBj*EBj / (sqrt(∑mj=1(YBj)2)*sqrt(∑mj=1(EBj)2)).

[0028] Specifically, this invention generates access logs by collecting access data from industrial networks, filters and selects real-time access logs, and calculates the correlation between real-time access logs and various stored access logs. It collects all access data and generates structured logs, avoiding the inability to locate key nodes during tracing due to data gaps. This provides a complete and traceable data source for subsequent analysis. Real-time filtering and selection can compress the amount of data to be analyzed. Based on accurate tracing of real-time and correlated logs, common attack paths can be discovered in the early stages of anomalies by tracing the correlation of multiple events. Based on attack patterns, targeted reinforcement can be carried out, improving the accuracy of industrial network security tracing and analysis.

[0029] Specifically, in step S2, the process of calculating the abnormal access characteristic value based on the request rate and the number of concurrent connections includes, The ratio of the request rate to the normal rate is determined as the rate impact factor. The ratio of concurrent connections to general connections is determined as the connection number influence factor; The weighted sum of the rate influence factor and the connection number influence factor is determined to be the abnormal access characteristic value.

[0030] Specifically, in practice, the general rate is the average number of times a number of visitors make data access requests within a predetermined time period, and the general connection number is the average number of network connections when a number of visitors access data within a predetermined time period.

[0031] Specifically, the sum of the weighting coefficients of the rate influence factor and the connection number influence factor is 1, the weighting coefficient of the rate influence factor is 0.5, and the weighting coefficient of the connection number influence factor is 0.5.

[0032] Specifically, in step S2, the process of recording the simulated secure agent's access to data includes, The abnormal access feature value is compared with the preset feature value, and the comparison result determines whether to transfer the data packet corresponding to the real-time access log to the simulated security agent. The corresponding simulated security agent is invoked based on real-time access logs; Collect the data packets corresponding to the real-time access logs transferred to the simulated security agent and the interaction information of the data in the simulated security agent to generate simulated security agent access data.

[0033] In one specific embodiment, a preset feature value is set to 0.95. If the abnormal access feature value is 0.86, which is less than the preset feature value, it is determined that the data packet corresponding to the real-time access log will be transferred to the simulated security intelligent agent. If the abnormal access characteristic value is 0.98, which is greater than the preset characteristic value, then it is determined that no action will be taken on the data packets corresponding to the real-time access log. Specifically, to ensure the accuracy and security of abnormal access detection, the preset feature value preferably ranges from 0.9 to 0.95. Please see Figure 2 The diagram illustrates the steps for determining whether isolation was successful according to an embodiment of the present invention. In step S3, an isolation characterization value is generated based on the simulated security agent access data. The process of determining whether isolation was successful based on the isolation characterization value includes... Step S301: Import the simulated security agent access data into the large security agent model to generate the number of queries, the number of file reads, and the number of login attempts; Step S302: Generate an isolation characterization value based on the number of queries, the number of file reads, and the number of login attempts; Step S303: Compare the isolation characterization value with the preset characterization value, and determine whether the isolation is successful based on the comparison result.

[0034] Specifically, the ratio of the number of queries to the number of general queries is determined as the query number influence factor; The ratio of the number of file reads to the normal number of file reads is determined as the file read count influence factor; The ratio of the number of login attempts to the number of normal login attempts is determined as the login attempt count influence factor; The weighted sum of the factors affecting query count, file read count, and login attempt count is determined as the isolation characterization value.

[0035] Specifically, in implementation, the general query count is the average number of times a number of visitors query data within a predetermined time period, the general file read count is the average number of times a number of visitors read files within a predetermined time period, and the general login attempt count is the average number of times a number of visitors attempt to log in to their accounts within a predetermined time period.

[0036] Specifically, the sum of the weight coefficients of the query count impact factor, the file read count impact factor, and the login attempt count impact factor is 1; the weight coefficient of the query count impact factor is 0.4; the weight coefficient of the file read count impact factor is 0.3; and the weight coefficient of the login attempt count impact factor is 0.3.

[0037] Specifically, this invention makes a preliminary judgment on access based on request rate and concurrent connection count. Data packets with abnormal access are imported into a simulated security agent. The actions of the visitor in the simulated security agent are collected and analyzed. For abnormal access in industrial networks, traditional defenses can only passively alert, while the simulated security agent technology can achieve active defense in the following ways: When the system detects that the request rate of a certain IP exceeds the threshold or the number of concurrent connections is abnormal, it automatically redirects the subsequent traffic of that IP to the simulated security agent. This process can quickly cut off the attack path and prevent real devices from being compromised. The simulated security agent interacts with the attacker through a highly realistic industrial scenario, making the attacker mistakenly believe that it has successfully compromised the real device, thereby consuming attack resources and prolonging the attack timeline. Through full-dimensional behavior recording and attack intent analysis, the simulated security agent can solve the problem of fragmented traditional log data, significantly improve the accuracy of source tracing, and further improve the accuracy of industrial network security source tracing analysis.

[0038] Please see Figure 3 As shown, this is a logic diagram for determining whether isolation is successful according to an embodiment of the present invention. In step S3, whether isolation is successful is determined based on the comparison result. If the isolation characterization value is greater than or equal to the preset characterization value, the isolation is considered successful. If the isolation characterization value is less than the preset characterization value, the isolation is deemed unsuccessful.

[0039] In one specific embodiment, a preset characterization value is set to 0.9. If the isolation characterization value is 1.8, which is greater than the preset characterization value, then the isolation is determined to be successful. If the isolation characterization value is 0.84, which is less than the preset characterization value, then the isolation is deemed unsuccessful.

[0040] Specifically, in order to effectively determine whether visitors in the simulated security agent have discovered that they have been exposed, the preset representation value preferably ranges from 0.9 to 1.

[0041] Specifically, in step S4, the process of determining the access risk level and the corresponding handling method based on the behavioral representation value includes, Obtain reconnaissance action data, lateral movement action data, and execution action data corresponding to the real-time access logs; Generate behavioral representation values ​​based on reconnaissance action data, lateral movement action data, and execution action data; The behavioral representation value is compared with several preset behavioral values, and the access risk level is determined based on the comparison results, and the corresponding handling method is determined.

[0042] Specifically, the weighted sum of reconnaissance action data, lateral movement action data, and execution action data is determined as the behavior characterization value. Among them, reconnaissance action data is the number of times the visitor actively collects target network information in the simulated security agent per minute; lateral movement action data is the number of new target IPs that the visitor adds in the simulated security agent per minute; and execution action data is the number of times the visitor modifies code in the simulated security agent per minute. The sum of the weight coefficients of reconnaissance action data, lateral movement action data, and execution action data is 1, the weight coefficient of reconnaissance action data is 0.4, the weight coefficient of lateral movement action data is 0.3, and the weight coefficient of execution action data is 0.3.

[0043] Please see Figure 4 As shown, this is a logic diagram of an embodiment of the present invention for determining the access risk level and the corresponding processing method based on behavioral representation values. In step S4, the access risk level and the corresponding processing method are determined based on the comparison result between the behavioral representation values ​​and several preset behavioral values. If the behavior representation value is greater than or equal to the first preset behavior value, the access risk level is determined to be the first risk level, and the method of terminating access and disconnecting the network is adopted. If the behavior representation value is less than the first preset behavior value and greater than or equal to the second preset behavior value, the access risk level is determined to be the second risk level, and access restriction and access tracing are implemented. If the behavior representation value is less than the second preset behavior value, the access risk level is determined to be the third risk level, and the access behavior is monitored. Among them, the first preset behavior value is greater than the second preset behavior value.

[0044] In one specific embodiment, a first preset behavior value is set to 1, and a second preset behavior value is set to 0.6. If the behavior representation value is 1.4, which is greater than the first preset behavior value, the access danger level is determined to be the first danger level, and a method of terminating access and disconnecting the network is adopted. If the behavior representation value is 0.7, which is less than the first preset behavior value but greater than the second preset behavior value, the access risk level is determined to be the second risk level, and access restriction and access tracing are implemented. If the behavior representation value is 0.3, which is less than the second preset behavior value, the access risk level is determined to be the third risk level, and the access behavior is monitored.

[0045] Understandably, a non-malicious visitor cannot have reconnaissance action data, lateral movement action data, or execution action data in the simulated security agent. A visitor whose behavior corresponds to all three types of data should be judged as a malicious visitor causing serious damage. A visitor whose behavior corresponds to two types of data should be judged as a malicious visitor causing damage. A visitor whose behavior corresponds to one type of data should be judged as a visitor that needs to be monitored. Therefore, the first preset behavior value is 1, and the second preset behavior value is 0.6.

[0046] Specifically, this invention analyzes the actions of visitors within a simulated security agent to determine whether the visitor has realized they have been isolated. If the visitor is deemed unaware of their exposure, the invention categorizes their behavior and takes corresponding action. Industrial network attacks often achieve long-term infiltration through covert penetration. The simulated security agent, through dynamic camouflage technology and interactive response strategies, allows attackers to continue operating without noticing isolation, thereby capturing the complete attack chain. The simulated security agent can dynamically optimize the simulation environment and response mechanism based on real-time feedback from attackers, enabling interactive attribution and solving the problems of incomplete log data and delayed analysis in traditional methods. It achieves a full-dimensional reconstruction of the attack chain, improves defense efficiency without affecting production through lightweight deployment, and builds a sustainably optimizable security defense system, further enhancing the accuracy of industrial network security attribution analysis.

[0047] Specifically, in step S5, the process of determining the access risk level and the corresponding handling method based on the anomaly ratio includes, Calculate the total number of associated storage access logs with an association degree greater than the preset association degree and determine the abnormal associated access logs included therein; Calculate the proportion of abnormal associated access logs to the total number of associated logs to generate the abnormality ratio; The abnormal ratio is compared with several preset ratios, and the access risk level is determined based on the comparison results, and the corresponding handling method is determined.

[0048] Specifically, to ensure network security, the preset correlation coefficient is generally set to a value between 0.8 and 0.9.

[0049] Specifically, in step S5, the access risk level is determined based on the comparison result between the abnormal ratio and several preset ratios, and the corresponding handling method is determined. If the abnormal ratio is greater than or equal to the first preset ratio, the access risk level is determined to be the first risk level, and the method of terminating access and disconnecting the network is adopted. If the abnormal ratio is less than the first preset ratio but greater than or equal to the second preset ratio, the access risk level is determined to be the second risk level, and access restriction and access tracing are implemented. If the abnormal ratio is less than the second preset ratio, the access risk level is determined to be the third risk level, and the access behavior is monitored. Among them, both the first preset ratio and the second preset ratio are positively correlated with the active time of the data packets corresponding to the real-time access logs being transferred into the simulated security agent, and the first preset ratio is greater than the second preset ratio.

[0050] It is understandable that the longer the data packets corresponding to the real-time access logs are active in the simulated security agent, the more destructive behaviors are taken, and the more historical destructive behavior logs with a high correlation are generated. Therefore, the first preset ratio and the second preset ratio are both positively correlated with the active time of the data packets corresponding to the real-time access logs being transferred into the simulated security agent. Preferably, the active time of the data packets corresponding to the real-time access logs being transferred into the simulated security agent is 1 minute, the first preset ratio is 0.5, and the second preset ratio is 0.4. The data packets corresponding to the real-time access logs are transferred to the simulated security agent within 3 minutes of activity, with a first preset ratio of 0.6 and a second preset ratio of 0.5. The data packets corresponding to the real-time access logs are transferred to the simulated security agent within 5 minutes of activity. The first preset ratio is 0.8, and the second preset ratio is 0.7.

[0051] In a specific embodiment, the first preset ratio is set to 0.8 and the second preset ratio is set to 0.7. If the abnormal ratio is 0.96, which is greater than the first preset ratio, the access danger level is determined to be the first danger level, and the method of terminating access and disconnecting the network is adopted. If the abnormal ratio is 0.76, which is less than the first preset ratio but greater than the second preset ratio, the access risk level is determined to be the second risk level, and access restriction and access tracing are implemented. If the abnormality rate is 0.64, which is less than the second preset rate, the access risk level is determined to be the third risk level, and the access behavior is monitored.

[0052] Specifically, this invention analyzes the actions of visitors within a simulated security agent. Upon determining that the visitor has discovered their exposure, it filters logs with high correlation based on the correlation values ​​between real-time access logs and stored historical logs. This analysis determines the proportion of abnormal accesses to assess the risk level of the visit and implement corresponding handling methods. After discovering exposure, visitors typically interrupt their operations immediately, such as closing connections, ceasing malicious behavior, or clearing traces, leading to fragmentation of real-time operational data within the simulated security agent. By filtering highly correlated logs, the current exposure event can be quickly connected to historical behavior, filling evidentiary gaps. Highly correlated logs can reveal previous intrusion attempts by the visitor or similar visitors, preventing a break in the tracing chain due to current operational interruptions that only reveal the simulated security agent event without knowing the source of the intrusion. The visitor's post-exposure interruption behavior can easily obscure their true intentions, while highly correlated log analysis can deduce the true purpose through historical behavior, making the tracing conclusion more complete and further improving the accuracy of industrial network security tracing analysis.

[0053] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A method for tracing and analyzing industrial network security based on security intelligent agents, characterized in that, include: Real-time access data from the industrial network is collected to generate real-time access logs. The real-time access logs are then filtered and screened, and the correlation with each stored access log is calculated. The request rate, concurrent connection count, and access traffic of each real-time access log are obtained respectively. An abnormal access feature value is calculated based on the request rate and the concurrent connection count. Data packets corresponding to real-time access logs whose abnormal access feature values ​​are less than a preset feature value are transferred to the simulated security agent and the access data of the simulated security agent is recorded. The simulated security agent access data is imported into the large security agent model to generate isolation representation values. Based on these isolation representation values, it is determined whether isolation was successful, including... If the isolation is successful, the task execution actions corresponding to the real-time access logs are analyzed, a behavior representation value is generated based on the task execution actions, and the access risk level is determined based on the behavior representation value and the corresponding handling method is determined. If isolation is deemed unsuccessful, then based on the correlation, a number of storage access logs are determined, the abnormal proportion of the number of storage access logs is determined to determine the access risk level and the corresponding processing method is determined, or the real-time access data is determined to be the first abnormal data to generate the corresponding storage access log.

2. The industrial network security tracing and analysis method based on security intelligent agents according to claim 1, characterized in that, The process of filtering and screening the real-time access logs and calculating the correlation with each storage access log includes, Extract the structure fields from the real-time access log; The similarity between the structure field and the storage fields in each storage access log is calculated as the correlation degree.

3. The industrial network security tracing and analysis method based on security intelligent agents according to claim 2, characterized in that, The process of calculating abnormal access characteristic values ​​based on the request rate and the number of concurrent connections includes, The ratio of the request rate to the normal rate is determined as the rate impact factor. The ratio of concurrent connections to general connections is determined as the connection number influence factor; The weighted sum of the rate influence factor and the connection number influence factor is determined to be the abnormal access characteristic value.

4. The industrial network security tracing and analysis method based on security intelligent agents according to claim 3, characterized in that, The process of recording simulated secure intelligent agent access data includes: The abnormal access feature value is compared with the preset feature value, and the comparison result determines whether to transfer the data packet corresponding to the real-time access log to the simulated security agent. The corresponding simulated security agent is invoked based on the real-time access logs; The interaction information between the data packets corresponding to the real-time access logs transferred to the simulated security agent and the data in the simulated security agent is collected to generate the access data of the simulated security agent.

5. The industrial network security tracing and analysis method based on security intelligent agents according to claim 4, characterized in that, The process of importing the simulated security agent access data into the large security agent model to generate isolation representation values, and determining whether isolation was successful based on the isolation representation values, includes the following steps: The simulated security agent access data is imported into the large security agent model to generate the number of queries, the number of file reads, and the number of login attempts; The isolation characterization value is generated based on the number of queries, the number of file reads, and the number of login attempts. The isolation characterization value is compared with a preset characterization value, and the isolation success is determined based on the comparison result.

6. The industrial network security tracing and analysis method based on security intelligent agents according to claim 5, characterized in that, The step of determining whether isolation was successful based on the comparison results is as follows: If the isolation characterization value is greater than or equal to the preset characterization value, then the isolation is determined to be successful.

7. The industrial network security tracing and analysis method based on security intelligent agents according to claim 6, characterized in that, The process of determining the access risk level and the corresponding handling method based on the behavioral representation value includes: Obtain the reconnaissance action data, lateral movement action data, and execution action data corresponding to the real-time access log; The behavioral representation value is generated based on the reconnaissance action data, the lateral movement action data, and the execution action data; The behavioral representation value is compared with several preset behavioral values, and the access risk level is determined based on the comparison result, and the corresponding processing method is determined.

8. The industrial network security tracing and analysis method based on security intelligent agents according to claim 7, characterized in that, The access risk level is determined based on the comparison between the behavioral representation value and several preset behavioral values, and the corresponding handling method is determined accordingly. If the behavior representation value is greater than or equal to the first preset behavior value, the access risk level is determined to be the first risk level, and the method of terminating access and disconnecting the network is adopted. If the behavior representation value is less than the first preset behavior value and greater than or equal to the second preset behavior value, then the access risk level is determined to be the second risk level, and access restriction and access tracing are implemented. If the behavior representation value is less than the second preset behavior value, the access risk level is determined to be the third risk level, and a method for monitoring access behavior is adopted. Wherein, the first preset behavior value is greater than the second preset behavior value.

9. The industrial network security tracing and analysis method based on a security intelligent agent according to claim 8, characterized in that, The process of determining the access risk level and the corresponding handling method based on the aforementioned anomaly ratio includes: Calculate the total number of associated storage access logs whose correlation degree is greater than the preset correlation degree and determine the abnormal associated access logs included therein; Calculate the proportion of the abnormal associated access logs to the total number of associations to generate the abnormality ratio; The abnormal ratio is compared with several preset ratios, and the access risk level is determined based on the comparison results, and the corresponding handling method is determined.

10. The industrial network security tracing and analysis method based on a security intelligent agent according to claim 9, characterized in that, The access risk level is determined based on a comparison between the abnormal ratio and several preset ratios, and the corresponding handling method is determined accordingly. If the abnormal ratio is greater than or equal to the first preset ratio, the access risk level is determined to be the first risk level, and the method of terminating access and disconnecting the network is adopted. If the abnormal ratio is less than the first preset ratio and greater than or equal to the second preset ratio, the access risk level is determined to be the second risk level, and access restriction and access tracing are implemented. If the abnormal ratio is less than the second preset ratio, the access risk level is determined to be the third risk level, and a method for monitoring access behavior is adopted. The first preset ratio and the second preset ratio are both positively correlated with the active time of the data packets corresponding to the real-time access logs being transferred into the simulated security agent, and the first preset ratio is greater than the second preset ratio.

Images