Vulnerability identification method based on industrial internet

Abstract

The invention discloses a vulnerability identification method based on an industrial internet, and belongs to the technical field of industrial internet security. The method comprises the following steps: determining a target industrial communication protocol and a corresponding equipment cluster and a protocol specification document, establishing a production mirror image test environment, and integrating vulnerability data to form a vulnerability baseline library; collecting protocol traffic of a target industrial communication protocol under multiple production conditions, filtering invalid data packets, extracting protocol core fields, labeling traffic identifiers, and generating effective traffic data; for the effective flow data, public vulnerabilities are matched based on a vulnerability baseline library, a normal behavior baseline is constructed at the same time, and suspicious vulnerabilities are identified through a machine learning algorithm; verifying the suspicious vulnerabilities by using a production mirror image test environment to eliminate misjudgments to obtain hidden vulnerabilities; and dividing risk levels for the confirmed vulnerabilities containing the public vulnerabilities and the hidden vulnerabilities in combination with the industrial scene dimension. According to the method, the industrial communication protocol vulnerability in the industrial internet can be accurately identified, the misjudgment rate is reduced, the risk is quantified, and the industrial production safety is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of industrial internet security technology, and specifically to a vulnerability identification method based on the industrial internet. Background Technology

[0002] With the rapid development of Industrial Internet technology, industrial control systems are deeply integrated with the Internet to form a complex industrial ecosystem. The security and stability of this ecosystem directly determine the continuity and safety of industrial production. Industrial communication protocols, as the data transmission hub connecting core devices such as PLCs, sensors, and SCADA systems, are currently a high-risk area for vulnerabilities in the Industrial Internet. Early protocol designs prioritized real-time production, commonly employing plaintext transmission and lacking security mechanisms such as authentication and data encryption, making it easy for attackers to intercept and tamper with instructions or data. Furthermore, industrial equipment has a service life of 10-20 years, resulting in outdated protocol versions and manufacturers ceasing firmware updates. Publicly disclosed vulnerabilities remain unpatched, creating long-term risks. Combined with changes in operating conditions such as equipment start-up and shutdown, and load fluctuations, this further increases the probability and concealment of protocol vulnerabilities.

[0003] Existing vulnerability identification methods are mostly derived from the traditional IT field and are difficult to adapt to the special characteristics of industrial communication protocols. On the one hand, traditional methods cannot accurately identify vulnerabilities specific to industrial protocols and are prone to misjudging normal production traffic as vulnerabilities. On the other hand, there is a lack of security vulnerability verification environments for industrial scenarios, and testing directly in the production chain can easily lead to equipment downtime. At the same time, existing risk assessments do not combine core dimensions such as the scope of impact on industrial production and the degree of security harm, and cannot provide industrial users with quantitative risk management basis. They are difficult to meet the needs of the Industrial Internet for the accuracy, security and practicality of vulnerability identification. Therefore, there is an urgent need for a dedicated vulnerability identification method that is adapted to industrial scenarios and specific to industrial communication protocols. Summary of the Invention

[0004] The purpose of this invention is to provide a vulnerability identification method based on the Industrial Internet to solve the problems mentioned in the background.

[0005] To achieve the above objectives, the present invention provides the following technical solution: A vulnerability identification method based on the Industrial Internet includes the following steps: S1. Determine the target industrial communication protocol, the corresponding device cluster and protocol specification document, build a production image test environment, and integrate the vulnerability data of the target industrial communication protocol to form a vulnerability baseline library; S2. Collect protocol traffic under multiple production conditions of the target industrial communication protocol, filter invalid data packets from the protocol traffic, extract the core protocol fields, and mark the core protocol fields with traffic identifiers to form valid traffic data; S3. Based on the vulnerability baseline library, perform known vulnerability feature matching on valid traffic data to locate public vulnerabilities. At the same time, construct the normal behavior baseline of the target industrial communication protocol, and use machine learning algorithms to identify traffic behavior that deviates from the normal behavior baseline in valid traffic data and output suspicious vulnerabilities. S4. Conduct simulated attacks to verify suspicious vulnerabilities in a production image test environment, eliminate falsely identified suspicious vulnerabilities, and obtain hidden vulnerabilities; S5. Combining the industrial scenario dimension, the confirmed vulnerabilities are classified into risk levels to output the vulnerability risk level of the confirmed vulnerabilities. The confirmed vulnerabilities include public vulnerabilities and hidden vulnerabilities.

[0006] Preferably, the method for setting up the production image testing environment is as follows: The simulated equipment is selected through an industrial equipment simulator to ensure that the selected simulated equipment is completely consistent with the equipment model and hardware parameters of the equipment in the equipment cluster corresponding to the target industrial communication protocol, and the ratio of the number of simulated equipment to the number of equipment in the equipment cluster corresponding to the target industrial communication protocol is 1:1, so as to cover the core control equipment and edge sensing equipment in the equipment cluster. Based on the protocol specification document corresponding to the target industrial communication protocol, the operating parameters of the target industrial communication protocol are extracted using a protocol parsing tool. The operating parameters include the protocol version, data frame format, command interaction timing, and field definitions. Then, the operating parameters are configured to the simulated device using a protocol simulation tool. During the configuration process, it is ensured that the protocol interaction timing of the simulated device is within ±10ms of that of the real device. At the same time, based on the actual connection relationship of the device cluster corresponding to the target industrial communication protocol and the interaction logic of the target industrial communication protocol, a network topology simulation tool is used to construct the communication topology between the simulated devices, restoring the network node connection method in real production, and forming a production mirror test environment consistent with the functions and interaction logic of the real production environment.

[0007] Preferably, the process of integrating vulnerability data of target industrial communication protocols to form a vulnerability baseline library is as follows: We collect vulnerability data related to the target industrial communication protocol from publicly available vulnerability databases in the industrial control field, security bulletins from equipment manufacturers, and historical industrial network attack events. Publicly available vulnerability databases in the industrial control field include, but are not limited to, the CVE industrial control vulnerability sub-database, the ICS-CERT vulnerability bulletin database, and the NVD industrial control system vulnerability database. All vulnerability data is filtered and screened to remove invalid vulnerability data that does not match the version of the target industrial communication protocol, is incompatible with the equipment model in the equipment cluster, or lacks a description of the vulnerability triggering conditions. Valid vulnerability data that can clearly associate with the version of the target industrial communication protocol and the equipment is retained. Then, vulnerability features are extracted from each valid vulnerability data using the OpenVAS industrial vulnerability feature extraction plugin or the industrial vulnerability information structured parser tool. The vulnerability features include vulnerability identifier, trigger function code, abnormal data frame features, authentication requirements, and attack vector identifier. All vulnerability features are associated with and stored with the target industrial communication protocol, and then archived according to the target industrial communication protocol type and vulnerability type to obtain a vulnerability baseline library.

[0008] Preferably, the filtering of invalid data packets in the protocol traffic includes: removing, from the collected protocol traffic of the target industrial communication protocol by using an industrial data packet cleaning module or Wireshark Industrial Edition filtering rules, frames with CRC check failures determined by the inconsistency between the frame tail CRC value and the calculated value, duplicate transmission frames filtered out after retaining the first frame by the frame sequence number deduplication algorithm, broadcast test frames filtered out based on the frame header test flag, and interference frames of non-target industrial communication protocols filtered out after matching the protocol type field with the target industrial communication protocol; The core fields of the protocol include a function code field that records protocol control instructions, a data frame structure field containing frame length and parameter values, an identity authentication field that stores device authentication information, and an address and vector field containing source and destination IP addresses and data packet timing. It also includes a traffic identifier that includes the target industrial communication protocol type, device address, and timestamp to form valid traffic data.

[0009] Preferably, the process of matching known vulnerability features of effective traffic data to locate public vulnerabilities is as follows: the protocol core fields in the effective traffic data are compared with each vulnerability feature in the vulnerability baseline library according to preset dimensions. The preset dimensions are: first, the target industrial communication protocol type associated with the protocol core field is compared with the target industrial communication protocol associated with the vulnerability feature; then, the function code field is compared with the trigger function code, the data frame structure field is compared with the abnormal data frame feature, the identity authentication field is compared with the identity authentication requirements, and the address and vector field is compared with the attack vector identifier. When at least one dimension field in the core fields of the protocol matches the corresponding content of the same vulnerability feature, it is determined to be a feature match, and the valid traffic data is marked as having a public vulnerability. At the same time, the vulnerability identifier corresponding to the vulnerability feature in the vulnerability baseline library is associated with it, and the specific value of the matching dimension field and the traffic identifier of the valid traffic data are recorded to form the public vulnerability of the valid traffic data.

[0010] Preferably, the normal behavior baseline includes the normal frequency range of instruction transmission, the normal value range of data fields, and the device interaction process specification of the target industrial communication protocol. Based on the effective traffic data of the production equipment under normal operation, start-up and shutdown, and peak load conditions without vulnerabilities, the operation behavior of the target industrial communication protocol is quantitatively analyzed using an industrial traffic behavior analysis plugin. The number of instruction transmissions per unit time is counted from the effective traffic data to determine the normal frequency range of instruction transmission. Clustering calculations are performed on the data field values ​​in the effective traffic data to define the normal value range of data fields. The timing process of instruction sending, response, and disconnection between devices recorded in the effective traffic data is sorted out to form the device interaction process specification. The machine learning algorithm performs real-time analysis of valid traffic data. This algorithm includes the Isolation Forest algorithm, the LSTM algorithm, and a sequence model. The Isolation Forest algorithm quickly identifies abnormal behaviors that deviate from the normal frequency range of instruction transmission or the normal value range of data fields by calculating the isolation degree of traffic behavior. The LSTM algorithm (Long Short-Term Memory Neural Network) learns the temporal characteristics of normal device interaction processes to identify abnormal behaviors where the device interaction process deviates from the specified temporal order. The sequence model marks abnormal behaviors where the interaction path deviates from the specified interaction process by comparing the differences between the traffic behavior's interaction path and the device interaction process specification. The analysis results of the machine learning algorithms are then intersected, and traffic behaviors that ultimately deviate from the baseline of normal behavior are marked as suspicious vulnerabilities in the valid traffic data. The traffic behavior refers to the key behaviors in the effective traffic data that reflect the operating status of the target industrial communication protocol, specifically including command transmission frequency, data field values, and device interaction process.

[0011] Preferably, the process of simulating attack verification is as follows: constructing attack data packets based on the traffic characteristics corresponding to the suspected vulnerability, constructing attack data packets using an industrial attack data packet construction tool, sending the attack data packets to the corresponding simulated device in the production image test environment according to the interaction sequence of the target industrial communication protocol, and using an industrial equipment status monitoring tool to observe whether the simulated device executes illegal instructions and returns a vulnerability trigger response. If the simulated device does not execute illegal instructions and does not return a vulnerability trigger response, the suspected vulnerability is determined to be a false vulnerability and is excluded. The traffic features corresponding to the suspected vulnerability are extracted from the marked valid traffic data that deviates from the normal behavior baseline, specifically including the abnormal function code field, data frame structure field, and the corresponding device address and timestamp.

[0012] Preferably, the industrial scenario dimension includes vulnerability exploitability, production impact scope, and security hazard level. Vulnerability exploitability is quantified by assessing the technical complexity required for an attacker to exploit the vulnerability, scored from 0 to 10. Production impact scope is quantified by counting the number of devices or production lines affected by the vulnerability, also scored from 0 to 10. Security hazard level is quantified by judging the severity of the consequences caused by the vulnerability, also scored from 0 to 10. The vulnerability risk level includes critical, high-risk, medium-risk, and low-risk levels, and is determined by confirming the vulnerability's risk score. A risk score of 8-10 corresponds to a critical level, 5-7 corresponds to a high-risk level, 3-4 corresponds to a medium-risk level, and 0-2 corresponds to a low-risk level. The risk score is calculated using a weighted scoring method. In the weighted scoring method, the weight range for vulnerability exploitability is 35%-50%, the weight range for production impact is 25%-35%, and the weight range for security hazard is 25%-45%. The sum of the weights for vulnerability exploitability, production impact, and security hazard is 100%. The formula for calculating the weighted scoring method is as follows:

[0013] in, It is a risk score. , and These are the weights for vulnerability exploitability, production impact, and security hazard severity. , and These are scores for vulnerability exploitability, production impact, and security hazard level.

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. Existing industrial vulnerability testing often relies on simplified simulation environments, leading to significant deviations in verification results due to mismatched device parameters and distorted communication topologies. This invention utilizes an industrial equipment simulator, selecting a simulated device with the same model and hardware parameters as the real equipment at a 1:1 scale. It then uses protocol parsing tools to accurately extract operational parameters and complete configuration verification. Finally, it constructs a communication topology based on the connection relationships of the real devices, creating a mirror environment that perfectly matches the protocol behavior and device interactions of the production environment. This environment provides a high-fidelity platform for vulnerability verification, significantly reducing the risk of misjudgments due to environmental differences and addressing the core pain point that traditional testing environments cannot support accurate verification.

[0015] 2. Traditional technologies often rely solely on feature matching to identify known vulnerabilities or analyze abnormal behavior using a single algorithm, resulting in problems such as missed detection of hidden vulnerabilities and high false positive rates. This invention first performs multi-dimensional comparisons between core protocol fields and a multi-source, precisely constructed vulnerability baseline library to quickly locate publicly known vulnerabilities. Then, based on effective traffic data from multiple operating conditions, it constructs a normal behavior baseline including command frequency, data values, and interaction flows. It utilizes the Isolation Forest algorithm, LSTM algorithm, and sequence model to identify discrete anomalies and temporal disorder behaviors, reducing false positives through the intersection of multiple algorithm results. This system fills the blind spot in the identification of hidden vulnerabilities in traditional methods, achieving full coverage of both publicly known and unknown vulnerabilities.

[0016] 3. Existing technologies rely heavily on manual analysis for identifying suspected vulnerabilities using algorithms, lacking empirical verification methods, leading to difficulties in eliminating false positives. This invention extracts features such as abnormal function codes and data frame structures from valid traffic data corresponding to suspected vulnerabilities. Attack test cases are generated using an industrial attack data packet construction tool, and attacks are simulated in a production image testing environment while monitoring device responses. The authenticity of the vulnerability is determined based on whether illegal instructions are executed and whether a vulnerability-triggered response is returned. This mechanism forms an automated closed loop of identification, verification, and confirmation, solving the pain point of difficulty in verifying the authenticity of hidden vulnerabilities and significantly improving the credibility of vulnerability identification results. Attached Figure Description

[0017] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of the method steps of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be described in detail below. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other implementation methods obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0020] Examples, such as Figure 1 As shown, a vulnerability identification method based on the Industrial Internet includes the following steps: S1. Determine the target industrial communication protocol, the corresponding device cluster and protocol specification document, build a production image test environment, and integrate the vulnerability data of the target industrial communication protocol to form a vulnerability baseline library; S2. Collect protocol traffic under multiple production conditions of the target industrial communication protocol, filter invalid data packets from the protocol traffic, extract the core protocol fields, and mark the core protocol fields with traffic identifiers to form valid traffic data; S3. Based on the vulnerability baseline library, perform known vulnerability feature matching on valid traffic data to locate public vulnerabilities. At the same time, construct the normal behavior baseline of the target industrial communication protocol, and use machine learning algorithms to identify traffic behavior that deviates from the normal behavior baseline in valid traffic data and output suspicious vulnerabilities. S4. Conduct simulated attacks to verify suspicious vulnerabilities in a production image test environment, eliminate falsely identified suspicious vulnerabilities, and obtain hidden vulnerabilities; S5. Combining the industrial scenario dimension, the confirmed vulnerabilities are classified into risk levels to output the vulnerability risk level of the confirmed vulnerabilities. The confirmed vulnerabilities include public vulnerabilities and hidden vulnerabilities.

[0021] Furthermore, the working principle of the present invention will be illustrated below through embodiments: This embodiment uses a Modbus TCP protocol PLC control system in a smart manufacturing plant as an application scenario. The control system includes 10 Siemens S7-1200 PLCs, 20 temperature sensors, and 5 frequency converters. There is 1 Siemens S7-1200 PLC as the master station and 9 Siemens S7-1200 PLCs as slave stations. The target industrial communication protocol is Modbus TCP V1.1.

[0022] S1. The target industrial communication protocol is identified as Modbus TCP V1.1, and the corresponding equipment cluster consists of the aforementioned 10 PLCs, 20 sensors, and 5 frequency converters. Obtain the "Modbus TCP V1.1 Protocol Specification Document" provided by Siemens, along with a hardware parameter table containing information such as the PLC processor model (CPU 1214C) and sensor communication interface (RS485). Next, a production mirror test environment is built. Using the Siemens PLCSIM Advanced industrial equipment simulator, 10 simulated PLCs with identical models and hardware parameters to the actual PLCs, 20 simulated temperature sensors, and 5 simulated frequency converters are selected. The Modbus TCP V1.1 operating parameters are extracted from the protocol specification document using the Wireshark Industrial Edition protocol parsing tool. These operating parameters include the protocol version V1.1, the data frame format (RTU), the instruction interaction timing error (±10ms), and field definitions including a 1-byte function code field and a 2-byte data length field. This is then analyzed using Profinet Protocol. The Emulator protocol simulation tool configures the operating parameters to the simulated device and verifies them using a protocol conformance testing tool. Then, based on the actual bus-type connection relationship of the control system, the GNS3 industrial version network topology simulation tool is used to construct the communication topology between the simulated devices, ultimately forming a production mirror test environment. Finally, a vulnerability baseline library is built, collecting vulnerability data from multiple sources, including the CVE industrial control vulnerability sub-library, the ICS-CERT vulnerability bulletin library, and the Siemens website's "S7-1200 PLC Security Bulletin." Invalid data related to Modbus TCP V1.0 and incompatible with Siemens S7-1200 are removed, retaining 3 valid vulnerability data. The OpenVAS industrial vulnerability feature extraction plugin is used to extract the vulnerability features of each valid vulnerability data. For example, a vulnerability might have the following features: vulnerability identifier CVE-2023-28572, trigger function code 0x06 (write to a single register), abnormal data frame characteristics exceeding 16 bytes in length, authentication requirement not requiring authentication, and attack vector identifier source IP spoofing as 192.168.1.1. All vulnerability features are then compared with Modbus TCP... V1.1 is archived according to the target industrial communication protocol Modbus TCP V1.1 to obtain the vulnerability baseline library.

[0023] S2. Collect protocol traffic. On the Huawei S5720 industrial switch of the actual control system, set the ports connected to the master PLC and slave devices as mirror source ports, and specify port Gi0 / 0 / 10 as the mirror destination port. Connect to the destination port through the Colasoft Industrial Network Analyzer to collect protocol traffic under normal operating conditions (8 consecutive hours, 9:00-17:00), start-up and shutdown conditions (30 minutes after power-on, 8:30-9:00 and 30 minutes before power-off, 17:00-17:30), and peak load conditions (production line full load period, 10:00-16:00). Then filter the protocol traffic. Invalid data packets in the protocol traffic are filtered using Wireshark Industrial Edition rules. Frames with failed CRC checks are removed from the collected protocol traffic. These failed frames have a CRC value of 0x8A7B at the end of the frame that does not match the calculated value of 0x3C4D. Duplicate transmission frames, broadcast test frames with a frame header test flag of 0x01, and interference frames from the non-target industrial communication protocol Profinet are also removed. Finally, core protocol fields are extracted and labeled with traffic identifiers. Core protocol fields include the function code field value 0x03 (read register), the data frame structure field (length 10 bytes, temperature parameter value 25℃), and the authentication field (empty, Modbus). The system uses TCP (without default authentication) and address and vector fields (source IP 192.168.1.100, destination IP 192.168.1.101, time stamp 14:30:00.123), traffic identifiers such as target industrial communication protocol type Modbus TCP V1.1, device address 192.168.1.100 and timestamp 2024-05-2014:30:00.123, to finally generate valid traffic data.

[0024] S3. First, locate the publicly disclosed vulnerability. Compare the core protocol fields of the valid traffic data with the vulnerability baseline library item by item according to preset dimensions. When the function code field value of a valid traffic data is 0x06 (write to a single register) and the authentication field is empty, which matches the "trigger function code 0x06, no authentication required" feature of CVE-2023-28572, it is determined to be a feature match. The valid traffic data is marked as having a publicly disclosed vulnerability, associated with the vulnerability identifier CVE-2023-28572, and the matching field values ​​and traffic identifier are recorded. Next, construct a normal behavior baseline. Based on the valid traffic data under multiple operating conditions, use the industrial traffic behavior analysis plugin to perform quantitative analysis, such as statistically obtaining the normal frequency range of instruction transmission (function code 0x03 (read register) 1 time / second, function code 0x06 (write register) 0.5 times / second) and the normal value range of data fields (temperature sensor data field value 20-30℃). The inverter frequency field value is 50-60Hz. The timing process of sending, responding, and disconnecting commands between devices is sorted out to form a device interaction process specification (master PLC sends request command → slave device returns response command → master confirms receipt, and resends once if there is no response). Finally, suspicious vulnerabilities are identified. Machine learning algorithms are used to analyze the effective traffic data in real time. The Isolation Forest algorithm identifies an abnormal traffic with function code 0x03 and a transmission frequency of 0.1 times / second by calculating the isolation degree of traffic behavior. The LSTM algorithm identifies an abnormal traffic of "slave sending response without receiving request" by learning the normal interaction timing. The sequence model (Markov chain) identifies an abnormal traffic of "master sending request 3 times without receiving response" (path deviation) by comparing the interaction path. The intersection of the analysis results of the three algorithms is taken to mark the traffic behavior corresponding to the above three abnormal traffic as suspicious vulnerabilities.

[0025] S4. Extract traffic features from the valid traffic data corresponding to the three suspected vulnerabilities. For example, one of the traffic features includes function code 0x03, frequency 0.1 times / second, data frame length 15 bytes (exceeding the normal 10 bytes), device address 192.168.1.102, and timestamp 2024-05-2015:10:00.456. Based on the traffic features of the three suspected vulnerabilities, construct an attack packet (function code 0x03, data frame length 15 bytes, source IP spoofed as 192.168.1.100) using the Scapy industrial protocol plugin. The attack packets were sent to the corresponding simulated PLC (address 192.168.1.102) in the production image test environment according to the ModbusTCP interaction sequence (request interval of 0.1 seconds). Finally, the response of the simulated PLC was observed using Siemens PLC status monitoring software. It was found that two attack packets triggered the PLC to return error code 0x02 (data address error) and the PLC performed an illegal register read operation. These were identified as real vulnerabilities and confirmed as hidden vulnerabilities. One attack packet did not trigger an abnormal response from the PLC and was identified as a false vulnerability and eliminated.

[0026] S5. Determine the scoring and weighting for the industrial scenario dimension. Taking publicly disclosed vulnerabilities as an example, the exploitability of a publicly disclosed vulnerability is scored 8 points (40% weight) because attackers can exploit it using only conventional network tools without requiring specialized tools; the production impact of a publicly disclosed vulnerability is scored 7 points (30% weight) because its exploitation affects two core production lines (out of three); the security hazard of a publicly disclosed vulnerability is scored 6 points (30% weight) because it causes a one-hour production line shutdown and minor economic losses; then, the weighted scoring method is used to calculate the score. Where S is the risk score. The weights for vulnerability exploitability, production impact, and security hazard are respectively assigned, with A, B, and C representing the scores for the corresponding dimensions. The risk score for the publicly disclosed vulnerability is calculated as S = 8 × 40% + 7 × 30% + 6 × 30% = 7.1 points. Finally, based on the risk score range, the publicly disclosed vulnerability is determined to be of high risk. Following the vulnerability risk level determination method for publicly disclosed vulnerabilities, the other two hidden vulnerabilities are also determined, confirming that both hidden vulnerabilities are also of high risk. Based on this, the vulnerability risk level and related information of the confirmed vulnerability, which includes one publicly disclosed vulnerability and two hidden vulnerabilities, are obtained.

[0027] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them; modifications to the technical solutions described in the foregoing embodiments, or equivalent substitutions of some of the technical features, do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A vulnerability identification method based on the Industrial Internet, characterized in that, Includes the following steps: S1. Determine the target industrial communication protocol, the corresponding device cluster and protocol specification document, build a production image test environment, and integrate the vulnerability data of the target industrial communication protocol to form a vulnerability baseline library; S2. Collect protocol traffic of the target industrial communication protocol under multiple production conditions, filter invalid data packets from the protocol traffic, extract the core protocol fields, and mark the core protocol fields with traffic identifiers to form valid traffic data; S3. Based on the vulnerability baseline library, perform known vulnerability feature matching on valid traffic data to locate public vulnerabilities. At the same time, construct the normal behavior baseline of the target industrial communication protocol, and use machine learning algorithms to identify traffic behavior that deviates from the normal behavior baseline in valid traffic data and output suspicious vulnerabilities. S4. Conduct simulated attacks to verify suspicious vulnerabilities in a production image test environment, eliminate falsely identified suspicious vulnerabilities, and obtain hidden vulnerabilities; S5. Combining the industrial scenario dimension, the confirmed vulnerabilities are classified into risk levels to output the vulnerability risk level of the confirmed vulnerabilities. The confirmed vulnerabilities include public vulnerabilities and hidden vulnerabilities.

2. The vulnerability identification method based on the Industrial Internet according to claim 1, characterized in that, The method for setting up a production image testing environment is as follows: The simulation device is selected from the device cluster corresponding to the target industrial communication protocol by means of an industrial equipment simulator, and the number of the simulation device is in a ratio of 1:1 to the number of devices in the device cluster corresponding to the target industrial communication protocol. Based on the protocol specification document corresponding to the target industrial communication protocol, the operating parameters of the target industrial communication protocol are extracted using a protocol parsing tool, and the operating parameters are configured to the simulated device using a protocol simulation tool. At the same time, based on the actual connection relationship of the device cluster corresponding to the target industrial communication protocol and the interaction logic of the target industrial communication protocol, a network topology simulation tool is used to construct the communication topology between the simulated devices, thereby obtaining the production image test environment. The operating parameters include protocol version, data frame format, command interaction timing, and field definitions.

3. The vulnerability identification method based on the Industrial Internet according to claim 2, characterized in that, The process of integrating vulnerability data from target industrial communication protocols to form a vulnerability baseline library is as follows: We collect vulnerability data related to the target industrial communication protocol from publicly available vulnerability databases, equipment manufacturer security announcements, and historical industrial network attack incidents in the industrial control field. We filter and screen the vulnerability data to obtain multiple valid vulnerability data. After extracting the vulnerability features of each valid vulnerability data using a vulnerability feature extraction tool, we associate and store all vulnerability features with the target industrial communication protocol to obtain a vulnerability baseline database. The vulnerability characteristics include vulnerability identifier, trigger function code, abnormal data frame characteristics, authentication requirements, and attack vector identifier.

4. The vulnerability identification method based on the Industrial Internet according to claim 1, characterized in that, The protocol traffic is obtained from the traffic mirroring port configured through the industrial switch; the multiple production conditions include normal operation of production equipment, start-up and shutdown of production equipment, and peak load of production equipment.

5. The vulnerability identification method based on the Industrial Internet according to claim 4, characterized in that, The filtering of invalid data packets for protocol traffic includes: removing frames with failed CRC checks, duplicate transmission frames, broadcast test frames, and interference frames of non-target industrial communication protocols; the core protocol fields include function code fields, data frame structure fields, authentication fields, and address and vector fields, and are marked with traffic identifiers including the target industrial communication protocol type, device address, and timestamp.

6. The vulnerability identification method based on the Industrial Internet according to claim 5, characterized in that, The process of matching known vulnerability features of valid traffic data to locate public vulnerabilities is as follows: the protocol core fields in the valid traffic data are compared item by item with each vulnerability feature in the vulnerability baseline library. When there is a field in the protocol core fields that matches the vulnerability feature, the valid traffic data is marked as having a public vulnerability, and the vulnerability identifier of the vulnerability feature in the vulnerability baseline library is associated with it.

7. The vulnerability identification method based on the Industrial Internet according to claim 6, characterized in that, The normal behavior baseline includes the normal frequency range of instruction transmission, the normal value range of data fields, and the device interaction process specifications of the target industrial communication protocol; the machine learning algorithm performs real-time analysis of effective traffic data and marks traffic behaviors that deviate from the normal behavior baseline as suspicious vulnerabilities in the effective traffic data. The machine learning algorithm includes the Isolation Forest algorithm, the LSTM algorithm, and the sequence model.

8. The vulnerability identification method based on the Industrial Internet according to claim 7, characterized in that, The process of simulating attack verification is as follows: construct an attack data packet based on the traffic characteristics corresponding to the suspected vulnerability, send the attack data packet to the corresponding simulated device in the production image test environment, and observe whether the simulated device executes illegal instructions and returns a vulnerability trigger response. If the simulated device does not execute illegal instructions and does not return a vulnerability trigger response, the suspected vulnerability is determined to be a false vulnerability and is eliminated.

9. The vulnerability identification method based on the Industrial Internet according to claim 8, characterized in that, The industrial scenario dimension includes vulnerability exploitability, production impact scope, and security hazard level; the vulnerability risk level includes critical, high-risk, medium-risk, and low-risk levels, and is obtained by classifying the risk score of the confirmed vulnerability; the risk score is calculated using a weighted scoring method, in which the weight of vulnerability exploitability ranges from 35% to 50%, the weight of production impact scope ranges from 25% to 35%, and the weight of security hazard level ranges from 25% to 45%, and the sum of the weights of vulnerability exploitability, production impact scope, and security hazard level is 100%.

Images