Industrial control white list generation method and device
By using the pymodbus source code that communicates with the modbus protocol in industrial control equipment, the problem of low efficiency in generating industrial control whitelists in existing technologies is solved by directly querying the pymodbus keyword corresponding to the function code, thus achieving fast and efficient generation of industrial control whitelists.
Patent Information
- Application Number
- CN202511553386.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-28
- Publication Date
- 2026-01-13
AI Technical Summary
Existing technologies require massive amounts of data to generate industrial control whitelists, resulting in low generation efficiency.
By directly querying the pymodbus keyword corresponding to the function code in the pymodbus source program that uses the modbus protocol for communication in industrial control equipment, address parameters and other parameters can be obtained, thereby generating an industrial control whitelist.
It shortens the time for generating industrial control whitelists, improves generation efficiency and accuracy, and avoids the need for long-term traffic acquisition.
Smart Images
Figure CN121333715A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of industrial network security technology, and in particular to a method for generating an industrial control system whitelist, an apparatus for generating an industrial control system whitelist, a computer device, a computer-readable storage medium, and a computer program product. Background Technology
[0002] Industrial control equipment, or JC equipment for short, refers to the combination of specialized hardware and embedded software used in industrial control systems (ICS) to perform specific industrial functions such as signal acquisition, measurement, monitoring, process control, motion control, and safety interlocking. Examples include Programmable Logic Controllers (PLCs) and Remote Terminal Units (RTUs). In a highly interconnected environment, to safeguard the "determinism" of industrial control systems and defend against the "uncertainty" threats from information technology (IT) networks and the external world, it is necessary to generate an industrial control whitelist. The industrial control whitelist defines the precise range of "legal" or "normal" behaviors within the industrial control system, such as communication protocols, function codes, communication timing, and frequencies. By configuring the industrial control whitelist in network security devices and monitoring these devices, the operational security of the industrial control equipment is ensured.
[0003] Currently, generating industrial control system (ICS) whitelists is primarily based on the traffic flow of ICS devices. Specifically, the process involves: first, obtaining the process flow of the ICS; then, deploying network security devices in "bypass" mode at appropriate locations within the ICS based on the process flow; next, controlling the ICS to operate under absolutely normal conditions; then, controlling the network security devices to record all traffic; and finally, cleaning, analyzing, and verifying the massive amounts of traffic collected to generate the ICS whitelist.
[0004] To ensure the integrity of the generated industrial control system (ICS) whitelist, it is necessary to record as much traffic as possible from ICS devices, which means acquiring traffic data from ICS devices over a long period of time. This increases the time required to acquire ICS device traffic, thereby reducing the efficiency of generating the ICS whitelist. Summary of the Invention
[0005] The purpose of this application is to provide a method, apparatus, computer device, computer-readable storage medium, and computer program product for generating an industrial control system whitelist, so as to improve the efficiency and completeness of industrial control system whitelist generation.
[0006] To address the aforementioned technical problems, this application provides the following technical solutions:
[0007] The first aspect of this application provides a method for generating an industrial control whitelist. The method includes: obtaining the PyModbus source code from an industrial control device that communicates using the Modbus protocol; matching each PyModbus keyword in a function code mapping table with the PyModbus source code, and determining the matched keyword in the PyModbus source code as the target keyword, wherein the function code mapping table includes the sequence number and name of all function codes involved in the industrial control device and their corresponding PyModbus keywords; querying the parent function that calls the target keyword in the PyModbus source code; querying the actual call location of the parent function in the PyModbus source code; obtaining the values corresponding to the address parameter, other parameters, and slave address from the code corresponding to the actual call location in the PyModbus source code; and generating an industrial control whitelist for the industrial control device based on the sequence number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values corresponding to the address parameter, other parameters, and slave address.
[0008] Compared to existing technologies, the industrial control whitelist generation method provided in the first aspect of this application, when the industrial control equipment uses the Modbus protocol for communication, can directly query the PyModbus source code in the industrial control equipment according to the PyModbus keyword corresponding to the function code. It then finds the values corresponding to the address parameter, other parameters, and slave address at the actual call location of the parent function corresponding to the queried PyModbus keyword, thereby generating the industrial control whitelist. This allows for quick acquisition of the source code, eliminating the need to spend significant time acquiring real-time traffic data, shortening the time required to obtain the data needed to generate the industrial control whitelist, and thus improving the generation efficiency.
[0009] In other embodiments provided in this application, the method further includes: querying the pymodbus source program using preset keywords to obtain query results, wherein the preset keywords include modbus, transmission mechanism, and Client; determining the first parameter in the query results as the Internet Protocol IP address of the server, and determining the second parameter in the query results as the port of the server; generating an industrial control whitelist of industrial control equipment based on the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the address parameter, other parameters, and the value corresponding to the slave address, including: generating an industrial control whitelist of industrial control equipment based on the transmission mechanism, the server's IP address, the server's port, the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the address parameter, other parameters, and the value corresponding to the slave address, respectively.
[0010] By querying the source code using Modbus, the transmission mechanism, and the Client, the server's IP address and port can be correctly obtained, thereby improving the accuracy of industrial control whitelist generation.
[0011] In other embodiments provided in this application, before querying the pymodbus source program using preset keywords, the method further includes: querying the pymodbus source program using modbusTcpClient, modbusUdpClient, and modbusSerialClient respectively; and determining the successfully queried items in modbusTcpClient, modbusUdpClient, and modbusSerialClient as preset keywords.
[0012] Because of the effective transmission mechanism of industrial control equipment, by conducting experimental queries in the source program through a limited number of transmission mechanisms, while ensuring that the server IP address and port are obtained correctly, the query efficiency can be improved, and the generation efficiency of the industrial control whitelist can be further improved.
[0013] In other embodiments provided in this application, before querying the pymodbus source program using preset keywords, the method further includes: obtaining the configuration file of the industrial control equipment; querying the relevant content of protocol, mode and connection_type in the configuration file; determining the transmission mechanism contained in the relevant content as the transmission mechanism in the preset keywords, and obtaining the preset keywords.
[0014] By using the configuration files of industrial control equipment, the transmission mechanism of industrial control equipment can be accurately determined, thereby improving the accuracy of server IP address and port lookup, and further improving the accuracy of industrial control whitelist generation.
[0015] In other embodiments provided in this application, the method further includes: acquiring the traffic of the industrial control device; parsing the IP address of the industrial control device from the traffic and determining the parsed IP address as the IP address of the client; generating an industrial control whitelist of the industrial control device based on the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values of address parameters, other parameters, and slave addresses; and generating the industrial control whitelist of the industrial control device based on the client's IP address, the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values of address parameters, other parameters, and slave addresses.
[0016] In addition to obtaining the client's IP address through personnel involved in the deployment of industrial control equipment, the client's IP address can also be resolved from a limited amount of traffic within the industrial control equipment. This avoids errors caused by manually providing information, thereby improving the accuracy of obtaining the client's IP address. Without significantly affecting the efficiency of generating the industrial control whitelist, it can also improve the accuracy of generating the industrial control whitelist.
[0017] In other embodiments provided in this application, obtaining the pymodbus source code in an industrial control device that uses the modbus protocol for communication includes: scanning the installation directory of the industrial control device to identify files with the .py extension and files containing pymodbus or pymodbus-related keywords; determining whether each identified file contains an instance or function call; if at least one is yes, then the content corresponding to the file that is determined to be yes is identified as the pymodbus source code.
[0018] By filtering specified information from the installation directory of industrial control equipment and further filtering the specified information, it is possible to automatically and accurately obtain the pymodbus source code from the industrial control equipment.
[0019] In other embodiments provided in this application, before obtaining the pymodbus source code in the industrial control equipment that communicates using the Modbus protocol, the method further includes: obtaining the function code sequence number and name from the official Modbus protocol specification; extracting the defined public methods in the pymodbus / client directory of the pymodbus library source code using an Abstract Syntax Tree (AST); searching for the variable function_code in the implementation code of the public method; and constructing a function code mapping table by matching the function code sequence number and name with the value of the variable with the corresponding public method.
[0020] The function code and implementation method are obtained from official information. Then, the function code is mapped to the implementation method by using the function_code variable in the implementation method code, thereby accurately and automatically generating a function code mapping table.
[0021] A second aspect of this application provides an industrial control whitelist generation apparatus, comprising: a first acquisition module for acquiring PyModbus source code in industrial control equipment communicating via the Modbus protocol; a matching module for matching each PyModbus keyword in a function code mapping table with the PyModbus source code, and determining the matched keyword in the PyModbus source code as the target keyword, wherein the function code mapping table includes the sequence number and name of all function codes involved in the industrial control equipment and their corresponding PyModbus keywords; a first query module for querying the parent function calling the target keyword in the PyModbus source code; a second query module for querying the actual call location of the parent function in the PyModbus source code; a second acquisition module for acquiring the values corresponding to the address parameter, other parameters, and slave address from the code corresponding to the actual call location in the PyModbus source code; and a generation module for generating an industrial control whitelist of the industrial control equipment based on the sequence number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values corresponding to the address parameter, other parameters, and slave address.
[0022] A third aspect of this application provides a computer device including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method of the first aspect.
[0023] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method of the first aspect.
[0024] The fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the method of the first aspect.
[0025] The industrial control whitelist generation apparatus provided in the second aspect of this application, the computer equipment provided in the third aspect, the computer-readable storage medium provided in the fourth aspect, and the computer program product provided in the fifth aspect have the same or similar beneficial effects as the industrial control whitelist generation method provided in the first aspect. Attached Figure Description
[0026] The above and other objects, features, and advantages of exemplary embodiments of this application will become readily understood by reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of this application are illustrated by way of example and not limitation, with the same or corresponding reference numerals denoteing the same or corresponding parts, wherein:
[0027] Figure 1 This is a flowchart illustrating the method for generating the industrial control whitelist in this application embodiment. Figure 1 ;
[0028] Figure 2 This is a flowchart illustrating the method for generating the industrial control whitelist in this application embodiment. Figure 2 ;
[0029] Figure 3 This is a portion of the pymodbus source code for the industrial control equipment in the embodiments of this application;
[0030] Figure 4 This is a schematic diagram of the structure of the industrial control whitelist generation device in the embodiments of this application. Figure 1 ;
[0031] Figure 5 This is a schematic diagram of the structure of the industrial control whitelist generation device in the embodiments of this application. Figure 2 ;
[0032] Figure 6 This is a schematic diagram of the structure of the computer device in the embodiments of this application. Detailed Implementation
[0033] Exemplary embodiments of this application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of this application and to fully convey the scope of this application to those skilled in the art.
[0034] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application shall have the ordinary meaning as understood by one of ordinary skill in the art to which this application pertains.
[0035] Currently, generating industrial control system (ICS) whitelists primarily involves acquiring massive amounts of traffic data from ICS devices. However, acquiring such massive amounts of traffic is time-consuming, thus reducing the efficiency of ICS whitelist generation.
[0036] In view of this, embodiments of this application provide a method, apparatus, computer device, computer-readable storage medium, and computer program product for generating an industrial control system (ICS) whitelist. If the ICS device uses the Modbus protocol for communication, the values of address parameters, other parameters, and slave addresses can be obtained by querying the PyModbus source code of the ICS device and finding the PyModbus keywords corresponding to each function code. This allows for rapid generation of the ICS whitelist by quickly obtaining the source code without requiring a lengthy acquisition of massive amounts of data.
[0037] It should be noted that all components, data, and related processing methods involved in this application are authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data comply with the relevant laws, regulations, and standards of the relevant countries and regions.
[0038] First, the method for generating the industrial control whitelist provided in the embodiments of this application will be described in detail.
[0039] Figure 1 This is a flowchart illustrating the method for generating the industrial control whitelist in this application embodiment. Figure 1 See Figure 1 As shown, the method may include:
[0040] S11: Obtain the pymodbus source code from industrial control equipment that uses the modbus protocol for communication.
[0041] For industrial control equipment (ICS) to be used in generating the ICS whitelist, Modbus protocol communication is required. For ICS that do not use Modbus protocol communication, it is necessary to acquire and analyze the traffic of the ICS to generate the ICS whitelist.
[0042] The Modbus protocol is a serial communication protocol used in industrial automation to establish simple and reliable client / server communication between master and slave devices.
[0043] The pymodbus source code refers to the source code files of an application written using the open-source Python library pymodbus to implement Modbus protocol communication.
[0044] To obtain the pymodbus source code from industrial control equipment, you can request it from the equipment developer or project deployment personnel, or you can obtain it from the equipment itself through its management interface. The specific method for obtaining the pymodbus source code from industrial control equipment is not specified here.
[0045] S12: Match each pymodbus keyword in the function code mapping table with the pymodbus source program, and determine the matched keyword in the pymodbus source program as the target keyword.
[0046] The function code mapping table includes the serial number and name of all function codes involved in industrial control equipment and their corresponding pymodbus keywords.
[0047] The function code is a core field in the Modbus protocol data frame. It is a unique numerical code used to tell the slave device what operation to perform.
[0048] The pymodbus keyword corresponding to the function code refers to the specific function or method name in the pymodbus programming library used to implement the operation represented by a particular Modbus function code.
[0049] Table 1 below is a schematic function code mapping table.
[0050] Table 1 Function Code Mapping Table
[0051] Figure 1 pymodbus keywords 001 Read Coils read_coils 005 Write Single Coil write_coil 003 Read Holding Registers read_holding_registers …… ……
[0052] In practical applications, the function code mapping table is pre-established. It can be created manually based on experience, or it can be obtained and integrated from various officially released information sources. The specific method for creating the function code mapping table is not limited here.
[0053] After obtaining the pymodbus source code, for each pymodbus keyword in the function code mapping table, the pymodbus keyword is matched against the pymodbus source code. If a match is successful, the pymodbus keyword is identified as the target keyword. If a match fails, the pymodbus keyword is not the target keyword, and the next pymodbus keyword is matched against in the pymodbus source code. This process continues until all pymodbus keywords in the function code mapping table have been matched against the pymodbus source code.
[0054] S13: Locate the parent function that calls the target keyword in the pymodbus source code.
[0055] S14: Locate the actual call location of the parent function in the pymodbus source code.
[0056] S15: Obtain the values of the address parameter, other parameters, and slave address from the code corresponding to the actual call location of the pymodbus source program.
[0057] For the pymodbus keyword matched in the pymodbus source code, it is not possible to determine some information in the industrial control whitelist directly by the pymodbus keyword. Instead, it is necessary to find the relevant code in the pymodbus source code by using the pymodbus keyword, and then determine the corresponding information and its value in the industrial control whitelist by using the parameter value in the relevant code.
[0058] For example, suppose the pymodbus source code is as follows:
[0059]
[0060]
[0061] Assume the Pymodbus keyword corresponding to function code 005 (Write Single Coil) is `write_coil`. First, search for "write_coil" in the Pymodbus source code. The search finds line 7: `result = client.write_coil(address = 0x10, value = True, unit = 1)`. Then, line 13: `result = client.write_coil(address = 0x20, value = state, unit = 2)`. Analyzing the code structure reveals that the `write_coil` call on line 7 is located within the `motor_start` function. Therefore, `motor_start` is the parent function of the first `write_coil` call. A global search for "motor_start" in the Pymodbus source code finds line 18: `motor_start("10.0.0.44")`. This line is where the parent function `motor_start` is actually executed, which is the source of the parameters. Finally, examining the `defmotor_start(device_ip):` function reveals that the parameters in the `write_coil` call are directly given literals or constants. address = 0x10 -> The address parameter is 0x10 (i.e., decimal 16). value = True -> Other parameters (the values written) are True. unit = 1 -> The slave address is 1.
[0062] S16: Generate an industrial control whitelist for industrial control equipment based on the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values of address parameters, other parameters, and slave addresses.
[0063] In other words, the sequence number and name of the current function code, along with the values of the address parameters, other parameters, and slave address, are used as one line of information in the industrial control whitelist. By performing steps S13-S15 for each target keyword, the sequence number and name of the corresponding function code, along with the values of the address parameters, other parameters, and slave address, are obtained and used as the corresponding line of information in the industrial control whitelist. Finally, the industrial control whitelist is obtained.
[0064] Continuing with the example above, the resulting industrial control whitelist includes: 005Write Single Coil,0x10,True,1.
[0065] As described above, the industrial control whitelist generation method provided in this application, when the industrial control equipment uses the Modbus protocol for communication, can directly query the PyModbus source code in the industrial control equipment according to the PyModbus keyword corresponding to the function code. It then finds the values corresponding to the address parameter, other parameters, and slave address at the actual call location of the parent function corresponding to the queried PyModbus keyword, thereby generating the industrial control whitelist. This allows for quick acquisition of the source code, eliminating the need to spend significant time acquiring real-time traffic, shortening the time required to obtain the data needed to generate the industrial control whitelist, and thus improving the generation efficiency of the industrial control whitelist.
[0066] Furthermore, as Figure 1 In a refinement and extension of the method shown, this application embodiment also provides a method for generating an industrial control whitelist.
[0067] Figure 2 This is a flowchart illustrating the method for generating the industrial control whitelist in this application embodiment. Figure 2 See Figure 2 As shown, the method may include:
[0068] S21: Construct a function code mapping table.
[0069] In addition to being built based on human knowledge reserves, function code mapping tables can also be built automatically.
[0070] Specifically, step S21 above may include:
[0071] S211: Obtain the function code number and name from the official Modbus protocol specification.
[0072] The official Modbus protocol specification refers to the authoritative set of standard documents published and maintained by the Modbus organization, which defines all the technical details of the Modbus communication protocol.
[0073] The official Modbus protocol specification contains a complete and structured set of rules, defining all the details from the physical layer to the application layer. In short, the specification answers three fundamental questions: what to operate on (data model), how to operate on it (function codes), and where to operate on it (network mapping). Therefore, the official Modbus protocol specification allows you to obtain the sequence number and name of all function codes.
[0074] The official Modbus protocol specification can be obtained from the documentation published on the official website.
[0075] The pymodbus keyword corresponding to the function code can be obtained from the source code of the pymodbus library.
[0076] S212: Extract the defined public methods from the pymodbus / client directory of the pymodbus library source code using the AST.
[0077] Since the pymodbus library is open source, its source code can be obtained directly from the information publicly available on the official pymodbus library website.
[0078] In the source code of the pymodbus library, the public methods under the pymodbus / client directory are the application programming interface (API) that the library designers want users to call directly, corresponding to the modbus function codes. Therefore, the public methods extracted from the pymodbus / client directory of the pymodbus library source code are the pymodbus keywords.
[0079] The AST extraction public method, compared to simple text search, can achieve accurate and reliable pymodbus keyword acquisition.
[0080] At this point, all function codes and pymodbus keywords have been obtained. The next step is to map each function code to its corresponding pymodbus keyword.
[0081] S213: Locate the variable function_code in the implementation code of the public method.
[0082] S214: Construct a function code mapping table by assigning the function code number and name that are the same as the value of the variable, and the corresponding public method of the variable.
[0083] Because the pymodbus library hardcodes the official Modbus function codes in its underlying implementation, which maps high-level Python method calls to low-level, digitized Modbus protocol instructions at the protocol layer, the function_code variable corresponds to the official Modbus function codes and can be used here to map each function code to a specific pymodbus keyword.
[0084] Finding the implementation code of public methods, i.e., locating the definition of the method, can be done manually, by running command lines, or in various other ways. The specific methods for finding the implementation code of public methods are standard code-finding techniques and will not be elaborated upon here.
[0085] After finding the implementation code, look for the "function_code" field in the code. The value of the variable corresponding to function_code is the function code number.
[0086] In this way, each pymodbus keyword corresponds to a function_code variable, and each function code corresponds to a sequence number. Associating the variables with the same values in the sequence numbers establishes the relationship between the corresponding pymodbus keywords and function codes. Once all associations are complete, the function code mapping table is obtained.
[0087] S22: Obtain the IP address of the client of the industrial control equipment.
[0088] On the one hand, the IP address of the client for industrial control equipment can be provided directly by the equipment supplier or the equipment deployer. On the other hand, the IP address of the client for industrial control equipment can also be automatically obtained through a small amount of traffic from the industrial control equipment.
[0089] Since one of the functions of industrial control equipment is communication, and the communication information inevitably involves the sender's IP address, the client IP address of the industrial control equipment can be obtained by observing the traffic of the industrial control equipment in a short period of time.
[0090] It should be noted that step S22 can be executed sequentially with subsequent steps, or it can be executed simultaneously with the acquisition of server IP address and port, address parameters, other parameters, and slave address values in subsequent steps. This avoids the additional time spent generating the industrial control whitelist due to traffic acquisition, and achieves automatic acquisition of industrial control device client IP addresses without reducing the efficiency of industrial control whitelist generation.
[0091] Specifically, step S22 above may include:
[0092] S221: Obtain the flow rate of industrial control equipment.
[0093] When acquiring traffic, you can acquire the traffic sent and received by the industrial control device within a preset time period, or you can acquire a preset amount of data sent and received by the industrial control device. That is, once the preset amount of traffic is acquired, no more traffic will be acquired. The preset time period and preset data amount can be set according to actual needs. That is, the higher the required generation efficiency, the shorter the preset time period and the smaller the preset data amount (the data amount of a single traffic stream sent and received by the industrial control device is generally small, and a small data amount can also achieve complete stream acquisition). There are no restrictions here.
[0094] S222: Extract the IP address of the industrial control device from the traffic and determine the extracted IP address as the client's IP address.
[0095] Since industrial control equipment generally acts as the master device in Modbus protocol communication and sends commands outwards, the source IP address resolved from the traffic of the industrial control equipment is the IP address of the client of the industrial control equipment.
[0096] The process of resolving the source IP address from traffic is a conventional data parsing technique, so the specific process of resolving the source IP address from traffic will not be described here.
[0097] At this point, the IP address of the industrial control equipment's client has been obtained. Next, the pymodbus source code is used to obtain the IP address and port of the industrial control equipment's server, as well as the corresponding function codes and their address parameters, other parameters, and the values corresponding to the slave addresses.
[0098] To obtain the Pymodbus source code for industrial control equipment, it can be provided by the equipment supplier or automatically obtained from the equipment itself.
[0099] S23: Obtain the pymodbus source code from the industrial control equipment.
[0100] Specifically, step S23 above may include:
[0101] S231: Scan the installation directory of industrial control equipment to identify files with the .py extension and files containing pymodbus or related keywords.
[0102] As software used in industrial control equipment, PyModbus source code possesses certain identifying characteristics, such as a .py extension and the presence of "pymodbus" or related keywords. Furthermore, a precise global search can be achieved through the installation directory. Therefore, the installation directory of the industrial control equipment is scanned first to identify files with the .py extension and those containing "pymodbus" or related keywords, serving as an initial identification of the PyModbus source code.
[0103] The files identified at this point may refer to fragments or functional descriptions. These fragments or information do not necessarily represent the actual operations that the industrial control equipment needs to perform. Therefore, the files corresponding to these fragments or information need to be deleted. While ensuring that subsequent identification of server IP addresses and other information is still possible, this approach aims to reduce the amount of file processing, improve the efficiency of obtaining server IP addresses, and further enhance the efficiency of generating the industrial control whitelist.
[0104] S232: Determine whether each identified file contains an instance or a function call. If at least one is yes, execute S233; if neither is yes, execute S234.
[0105] In other words, we search the AST for nodes that represent "actions to be performed", not just "definition" nodes, and find the parts of the code that will actually be executed.
[0106] When determining whether an "instance" has been created, in the pyModbus context, an "instance" typically refers to a Modbus client object that has been created, such as ModbusTcpClient. The corresponding AST node is ast.Call. Specifically, the process involves searching the AST; if the function part of the ast.Call node is ast.Name or ast.Attribute, and its name or attribute matches the name of the pymodbus client class, then the corresponding file is identified as an instance.
[0107] When determining whether a file contains a "function call," in the pymodbus context, a "function call" refers to a call to a Modbus operation method, such as `read_coils` or `write_register`. The corresponding AST node is `ast.Call`. Specifically, the process involves searching the AST; if the `func` part of the `ast.Call` node is `ast.Attribute`, and its attribute name matches a pymodbus function name, then the corresponding file is identified as a function call.
[0108] Furthermore, even if a file doesn't have direct instance creation or function calls, it might use pymodbus through variable references or function wrappers. Therefore, it's also possible to check if a file contains top-level logic that will be executed immediately. The corresponding AST node is: the top-level `ast.Call` (not within any function / class definition). The `ast.If__name__ == '__main__'` block.
[0109] S233: The content corresponding to the file that is determined to be true is identified as the pymodbus source program.
[0110] The file contains instances or function calls, indicating that the file is intended for execution and that the server IP address can be extracted from it. Therefore, the file is identified as a pymodbus source program.
[0111] S234: Discard files where all conditions are negative.
[0112] Since the file contains neither instances nor function calls, it indicates that the file is not intended for execution. Consequently, it is impossible to extract information such as the server IP address from it. Therefore, the file is determined to be not a pymodbus source program and is discarded. The process then moves on to the next file.
[0113] In some cases, multiple industrial control devices may require corresponding industrial control whitelists. Furthermore, a single industrial control device may contain multiple pymodbus source programs. Therefore, whether obtained from the vendor or automatically, a device source program mapping table can be generated after acquisition. This table lists each source program for each device as a single row, ensuring accurate retrieval during subsequent industrial control whitelist generation and thus improving the accuracy of whitelist generation.
[0114] Table 2 below is a schematic diagram of the device source code mapping table.
[0115] Table 2 Equipment Source Program Mapping Table
[0116] Device Number Device IP Program Name 001 10.0.0.1 plc_101.py 001 10.0.0.1 plc_101.py 002 10.0.0.2 plc_201.py …… …… ……
[0117] At this point, the pymodbus source code for the industrial control equipment has been automatically obtained. Next, you can use the pymodbus source code to obtain information such as the server IP address of the industrial control equipment.
[0118] S24: Obtain the IP address and port of the server for industrial control equipment based on the pymodbus source code.
[0119] Specifically, step S24 may include:
[0120] S241: Use preset keywords to perform a query in the pymodbus source program and obtain the query results.
[0121] The preset keywords include modbus, transmission mechanism, and client.
[0122] In other words, the combination of the three elements—"modbus transport mechanism Client"—is used in the pymodbus source code for matching.
[0123] The transmission mechanism here refers to the entire set of underlying protocols, rules, and physical media that enable reliable and efficient data transfer from a source node to a destination node in a communication system. Examples of transmission mechanisms include TCP connections, UDP connections, and serial port connections.
[0124] To reduce the number of searches for preset keywords in the pymodbus source code and improve search efficiency, and to ensure that the correct preset keywords corresponding to the transmission mechanism of the pymodbus source code are used for searching and improve search efficiency, the transmission mechanism of the industrial control equipment can be identified first, then a unique preset keyword can be determined, and then the unique preset keyword can be used for efficient and correct searching.
[0125] Specifically, prior to step S241 above, the method may further include:
[0126] S2401: Use modbusTcpClient, modbusUdpClient, and modbusSerialClient to query the pymodbus source code respectively.
[0127] S2402: Select the successfully queried items from modbusTcpClient, modbusUdpClient, and modbusSerialClient as preset keywords.
[0128] Since the Modbus protocol has a limited number of transmission mechanisms, these mechanisms can be obtained through enumeration. Then, a search can be performed in the PyModbus source code using preset keywords that contain different transmission mechanisms. Since the PyModbus source code only contains the words for the actual transmission mechanism it uses, the transmission mechanism in the preset keywords that are successfully searched is the actual transmission mechanism used in the industrial control equipment.
[0129] In addition to determining the transmission mechanism of industrial control equipment through enumeration and matching common sense, the transmission mechanism of industrial control equipment can also be quickly determined directly through the configuration file of the industrial control equipment.
[0130] Specifically, prior to step S241 above, the method may further include:
[0131] S240a: Obtain the configuration file of the industrial control equipment.
[0132] Configuration files for industrial control equipment can be provided by the equipment supplier or obtained directly through the equipment's interface. Obtaining configuration files through the equipment's interface is the same as the conventional method of obtaining configuration files via an interface, and will not be elaborated upon here.
[0133] S240b: Query the relevant information for protocol, mode, and connection_type in the configuration file.
[0134] Generally, configuration files contain information about the transport mechanism. You can locate the specific location of this transport mechanism information within the configuration file using fields such as protocol, mode, and connection_type, and thus find the relevant content.
[0135] S240c: The transmission mechanism contained in the relevant content is determined as the transmission mechanism in the preset keyword to obtain the preset keyword.
[0136] Because the Modbus protocol has limited transmission mechanisms, we can pre-list the various specific transmission mechanisms and then search for their existence within the relevant data. The found transmission mechanisms are then identified as the actual transmission mechanisms used by the industrial control equipment.
[0137] Once the transmission mechanism of the industrial control equipment is determined, a unique Modbus transmission mechanism Client can be obtained, i.e., a unique preset key. Then, the preset key is used to query the PyModbus source code to obtain the query results.
[0138] S242: Determine the first parameter in the query result as the server's Internet Protocol (IP) address, and the second parameter in the query result as the server's port.
[0139] For example, here's a sample code snippet for a pymodus TCP connection using the Modbus protocol:
[0140] client=ModbusTcpClient("10.0.0.44",port=502)
[0141] Using ModbusTcpClient, a query is performed in the source code, followed by a conventional recursive query to obtain the query parameters. The first parameter is the server IP address, and the second parameter is the server port number. This method yields the following information from the industrial network security whitelist: protocol (TCP), server address (10.0.0.44), and server port number (502).
[0142] For another example, here's a sample PyModus code snippet for a UDP connection using the Modbus protocol:
[0143] client=ModbusUdpClient(host='192.168.1.100',port=50002)
[0144] The ModbusUdpClient is used to perform a query in the source code, followed by a conventional recursive query to obtain the query parameters. The first parameter is the server IP address, and the second parameter is the server port number. Using this method, the following can be obtained from the industrial network security whitelist: protocol (UDP), server address (192.168.1.100), and server port number (50002).
[0145] For another example, here's a sample PyModus code snippet for a serial port connection using the Modbus protocol:
[0146] client=ModbusSerialClient(method='ascii',port=' / dev / ttyUSB0',baudrate=9600,stopbits=1,bytesize=8,parity='N')
[0147] If you use ModbusSerialClient to query the source code and find this keyword, you can parse it to show that the current connection is a serial port protocol.
[0148] At this point, we have also obtained the protocol type of the industrial control equipment, the IP address and port of the server. Next, based on the pymodbus source code, we will continue to obtain the values of the address parameters, other parameters, and slave addresses of the industrial control equipment.
[0149] S25: Match each pymodbus keyword in the function code mapping table with the pymodbus source program, and determine the matched keyword in the pymodbus source program as the target keyword.
[0150] S26: Locate the parent function that calls the target keyword in the pymodbus source code.
[0151] S27: Locate the actual call location of the parent function in the pymodbus source code.
[0152] S28: Obtain the values of the address parameter, other parameters, and slave address from the code corresponding to the actual call location of the pymodbus source program.
[0153] Steps S25-S28 here are implemented in the same way as steps S12-S15 in the previous embodiments, and can be found in the relevant descriptions in the previous embodiments. They will not be repeated here.
[0154] At this point, we have obtained the IP address of the client, the IP address and port of the server, the address parameters, other parameters, and the values corresponding to the slave address of the industrial control equipment.
[0155] S29: Based on the client's IP address, transmission mechanism, server's IP address, server's port, the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values of address parameters, other parameters, and slave address, generate an industrial control whitelist for industrial control equipment.
[0156] The industrial control whitelist based on Modbus can include: protocol (TCP, UDP, serial port), client address (applicable to TCP and UDP), server address (applicable to TCP and UDP), server port number (applicable to TCP and UDP), function code, parameter address, other parameter 1, other parameter 2, and slave address (applicable to serial port protocol).
[0157] For example: TCP, source IP, destination IP, service port number, 005Write Single Coil, 0x0, 1. Another example: UDP, source IP, destination IP, service port number, 005Write Single Coil, 0x0, 1. Yet another example: serial port, slave address 1, 005Write Single Coil, 0x0, 1.
[0158] Finally, a specific example will be used to clearly illustrate the method for generating industrial control whitelists provided in the embodiments of this application.
[0159] Figure 3 Taking the "write coil" function code as an example, the PyModbus source code for the industrial control equipment in this embodiment first finds the `write_coil` corresponding to 005Write Single Coil in the function code mapping table. The source code then checks if the `write_coil` keyword exists, and uses a known upward lookup to determine that the `dev_write_coil` function references this keyword. Continuing the recursive lookup, `dev_write_coil` is actually called, with the parameters `address = 0`, `value = True`, and `unit = 1`. At this point, the function code information is 005Write Single Coil, with the address parameter 0, `value` being True, and `unit` (from the address) being 1.
[0160] Based on specific analysis, there may be three different industrial control whitelists corresponding to different protocols, as follows:
[0161] 1. TCP, source IP, destination IP, service port number, 005 Write Single Coil, 0x0, 1
[0162] 2. UDP, source IP, destination IP, service port number, 005 Write Single Coil, 0x0, 1
[0163] 3. Serial port, from address 1, 005 Write Single Coil, 0x0, 1
[0164] Next, the industrial control system whitelist is stored in the network device. The network device can then perform network security monitoring on the industrial control system through the industrial control system whitelist.
[0165] This concludes the explanation of the method for generating industrial control whitelists provided in this application embodiment.
[0166] Based on the same inventive concept, embodiments of this application also provide an industrial control whitelist generation device.
[0167] Figure 4 This is a schematic diagram of the structure of the industrial control whitelist generation device in the embodiments of this application. Figure 1 See Figure 4 As shown, the device may include:
[0168] The first acquisition module 41 is used to acquire the pymodbus source code in industrial control equipment that uses the modbus protocol for communication;
[0169] Matching module 42 is used to match each pymodbus keyword in the function code mapping table with the pymodbus source program, and to determine the matched keyword in the pymodbus source program as the target keyword. The function code mapping table includes the serial number and name of all function codes involved in the industrial control equipment and their corresponding pymodbus keywords.
[0170] The first query module 43 is used to query the parent function that calls the target keyword in the pymodbus source program;
[0171] The second query module 44 is used to query the actual call location of the parent function in the pymodbus source program;
[0172] The second acquisition module 45 is used to obtain the values of the address parameter, other parameters, and slave address from the code corresponding to the actual call location of the pymodbus source program;
[0173] The generation module 46 is used to generate an industrial control whitelist of industrial control equipment based on the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values of address parameters, other parameters, and slave addresses.
[0174] Furthermore, as Figure 4 In a refinement and extension of the illustrated device, this application embodiment also provides an industrial control whitelist generation device.
[0175] Figure 5 This is a schematic diagram of the structure of the industrial control whitelist generation device in the embodiments of this application. Figure 2 See Figure 5 As shown, the device may include:
[0176] Module 51 is used to obtain the function code sequence number and name from the official Modbus protocol specification; extract the defined public methods in the pymodbus / client directory of the pymodbus library source code using an abstract syntax tree (AST); find the variable function_code in the implementation code of the public method; and construct a function code mapping table by matching the function code sequence number and name with the value of the variable with the corresponding public method.
[0177] The third acquisition module 52 is used to acquire the traffic of the industrial control equipment; to parse the IP address of the industrial control equipment from the traffic, and to determine the parsed IP address as the IP address of the client.
[0178] The first acquisition module 53 is used to scan the installation directory of the industrial control equipment, identify files with the .py extension, and identify files containing pymodbus or pymodbus-related keywords; determine whether each identified file contains an instance or function call; if at least one is yes, then the content corresponding to the file that is determined to be yes is identified as the pymodbus source program.
[0179] The fourth acquisition module 54 is used to perform a query in the pymodbus source program using preset keywords to obtain query results. The preset keywords include modbus, transmission mechanism and Client. The first parameter in the query result is determined as the Internet Protocol IP address of the server, and the second parameter in the query result is determined as the port of the server.
[0180] The fourth acquisition module 54 is also used to perform queries in the pymodbus source program using modbusTcpClient, modbusUdpClient, and modbusSerialClient respectively; and to determine the successfully queried items in modbusTcpClient, modbusUdpClient, and modbusSerialClient as preset keywords.
[0181] The fourth acquisition module 54 is also used to acquire the configuration file of the industrial control equipment; query the relevant content of protocol, mode and connection_type in the configuration file; determine the transmission mechanism contained in the relevant content as the transmission mechanism in the preset keywords, and obtain the preset keywords.
[0182] Matching module 55 is used to match each pymodbus keyword in the function code mapping table with the pymodbus source program, and to determine the matched keyword in the pymodbus source program as the target keyword. The function code mapping table includes the serial number and name of all function codes involved in the industrial control equipment and their corresponding pymodbus keywords.
[0183] The first query module 56 is used to query the parent function that calls the target keyword in the pymodbus source program.
[0184] The second query module 57 is used to query the actual call location of the parent function in the pymodbus source program.
[0185] The second acquisition module 58 is used to obtain the values of the address parameters, other parameters, and slave address from the code corresponding to the actual call location of the pymodbus source program.
[0186] The generation module 59 is used to generate an industrial control whitelist for industrial control equipment based on the client's IP address, transmission mechanism, server's IP address, server's port, the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values corresponding to the address parameters, other parameters, and slave address.
[0187] It should be noted that the description of the above device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.
[0188] Based on the same inventive concept, this application also provides a computer device.
[0189] Figure 6 This is a schematic diagram of the structure of the computer device in an embodiment of this application. See also... Figure 6 As shown, the computer device may include: a memory 61, a processor 62, and a computer program stored on the memory 61, wherein the processor 62 executes the computer program to implement the methods described in the foregoing embodiments.
[0190] It should be noted that the description of the above computer device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the computer device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.
[0191] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the methods described in the foregoing embodiments.
[0192] It should be noted that the description of the above computer-readable storage medium embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the computer-readable storage medium embodiments of this application, please refer to the description of the method embodiments of this application for understanding.
[0193] Based on the same inventive concept, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the methods described in the foregoing embodiments.
[0194] It should be noted that the descriptions of the above computer program product embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the computer program product embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.
[0195] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A method for generating an industrial control whitelist, characterized in that, The method includes: Obtain the pymodbus source code from industrial control equipment that uses the modbus protocol for communication; Each pymodbus keyword in the function code mapping table is matched with the pymodbus source program, and the keyword matched in the pymodbus source program is determined as the target keyword. The function code mapping table includes the sequence number and name of all function codes involved in the industrial control equipment and their corresponding pymodbus keywords. In the pymodbus source code, query the parent function that calls the target keyword; Locate the actual call position of the parent function in the pymodbus source code; Obtain the values of the address parameter, other parameters, and slave address from the code corresponding to the actual call location in the pymodbus source program; Based on the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values corresponding to the address parameter, other parameters, and slave address, an industrial control whitelist for the industrial control equipment is generated.
2. The method according to claim 1, characterized in that, The method further includes: The pymodbus source code is queried using preset keywords to obtain query results, wherein the preset keywords include modbus, transmission mechanism and Client; The first parameter in the query result is determined to be the server's Internet Protocol (IP) address, and the second parameter in the query result is determined to be the server's port. The process of generating an industrial control whitelist for the industrial control equipment based on the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values corresponding to the address parameter, other parameters, and slave address, includes: Based on the transmission mechanism, the server's IP address, the server's port, the function code number and name corresponding to the target keyword in the function code mapping table, and the values corresponding to the address parameter, other parameters, and slave address, an industrial control whitelist for the industrial control equipment is generated.
3. The method according to claim 2, characterized in that, Before performing a query in the pymodbus source program using preset keywords, the method further includes: The modbusTcpClient, modbusUdpClient, and modbusSerialClient were used to perform queries in the pymodbus source code, respectively. The successfully queried items in modbusTcpClient, modbusUdpClient, and modbusSerialClient are identified as the preset keywords.
4. The method according to claim 2, characterized in that, Before performing a query in the pymodbus source program using preset keywords, the method further includes: Obtain the configuration file of the industrial control equipment; Query the relevant information for protocol, mode, and connection_type in the configuration file; The transmission mechanism contained in the relevant content is determined as the transmission mechanism in the preset keyword, and the preset keyword is obtained.
5. The method according to claim 1, characterized in that, The method further includes: Obtain the flow rate of the industrial control equipment; The IP address of the industrial control device is parsed from the traffic, and the parsed IP address is determined as the IP address of the client. The process of generating an industrial control whitelist for the industrial control equipment based on the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values corresponding to the address parameter, other parameters, and slave address, includes: Based on the client's IP address, the serial number and name of the function code corresponding to the target keyword in the function code mapping table, and the values corresponding to the address parameter, other parameters, and slave address, an industrial control whitelist for the industrial control equipment is generated.
6. The method according to claim 1, characterized in that, The process of obtaining the pymodbus source code from industrial control equipment that uses the Modbus protocol for communication includes: The installation directory of the industrial control equipment is scanned to identify files with the .py extension and files containing pymodbus or related keywords. Determine whether each identified file contains an instance or function call; If at least one is yes, then the content corresponding to the file that is determined to be yes is identified as the pymodbus source program.
7. The method according to any one of claims 1 to 6, characterized in that, Before obtaining the pymodbus source code from industrial control equipment that uses the modbus protocol for communication, the method further includes: Obtain the function code number and name from the official Modbus protocol specification; The public methods defined in the pymodbus / client directory of the pymodbus library source code are extracted using an Abstract Syntax Tree (AST). Locate the variable `function_code` in the implementation code of the public method; The function code mapping table is constructed by assigning the serial number and name of the function code that has the same value as the variable, and the corresponding public method of the variable.
8. An industrial control whitelist generation device, characterized in that, The device includes: The first acquisition module is used to acquire the pymodbus source code in industrial control equipment that uses the modbus protocol for communication; The matching module is used to match each pymodbus keyword in the function code mapping table with the pymodbus source program, and to determine the matched keyword in the pymodbus source program as the target keyword. The function code mapping table includes the sequence number and name of all function codes involved in the industrial control equipment and their corresponding pymodbus keywords. The first query module is used to query the parent function that calls the target keyword in the pymodbus source program; The second query module is used to query the actual call location of the parent function in the pymodbus source program; The second acquisition module is used to obtain the values of the address parameter, other parameters, and slave address from the code corresponding to the actual call location of the pymodbus source program. The generation module is used to generate an industrial control whitelist for the industrial control equipment based on the serial number and name of the function code corresponding to the target keyword in the function code mapping table, as well as the values corresponding to the address parameter, other parameters, and slave address.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.