Abnormity alarm method and device for industrial control network system, and storage medium

Abstract

The invention discloses an abnormity alarm method and device for an industrial control network system and a storage medium, and belongs to the technical field of network information security. The abnormity alarm method comprises the following steps: acquiring a plurality of industrial control network messages of industrial control network equipment in a preset time period and a plurality of industrial control network data characteristics corresponding to each industrial control network message; removing abnormal industrial control network messages in the industrial control network messages according to a plurality of industrial control network data features corresponding to the industrial control network messages based on a pre-constructed white list rule to obtain a target industrial control network message; determining a data change rate corresponding to a preset number of adjacent target industrial control network message groups in a preset time period; determining abnormal data change rates which are not in a preset change rate range in the plurality of data change rates to obtain an abnormal change rate quantity; and according to the abnormal change rate quantity, judging whether to trigger a data exception alarm. According to the invention, the accuracy of abnormal identification of the industrial control network message can be improved.

Description

Technical Field

[0001] This application relates to the field of network information security technology, and specifically to an anomaly alarm method, device and storage medium for industrial control network systems. Background Technology

[0002] In the context of deep integration between industrial control systems and the Internet, industrial control network (ICS) network messages transmitted by ICS network devices within the system are easily spoofed due to the lack of redundant unauthorized protocol access and relatively fixed data transmission paths, thus threatening the security of the ICS network system. Therefore, to ensure the security of ICS network systems, existing technologies typically compare ICS network messages to a pre-set threshold range to identify anomalies in messages outside the threshold range. However, existing technologies, relying solely on pre-set threshold ranges for anomaly identification, are insufficient for deep anomaly detection and are prone to errors, reducing the accuracy of anomaly identification. Therefore, existing technologies suffer from low accuracy in identifying anomalies in ICS network messages. Summary of the Invention

[0003] The purpose of this application is to provide an anomaly alarm method, device, storage medium, and program product for industrial control network systems, in order to solve the problem of low accuracy in anomaly identification of industrial control network messages in the prior art.

[0004] To achieve the above objectives, the first aspect of this application provides an anomaly alarm method for an industrial control network system, the industrial control network system including industrial control network devices, and the anomaly alarm method comprising: Acquire multiple industrial control network packets from industrial control network devices within a preset time period, and multiple industrial control network data characteristics corresponding to each industrial control network packet; Based on pre-built whitelist rules, abnormal industrial control network packets are removed from each industrial control network packet according to multiple industrial control network data characteristics corresponding to each industrial control network packet, so as to obtain the target industrial control network packet. Determine the data change rate corresponding to a preset number of adjacent target industrial control network message groups within a preset time period; Identify the abnormal data change rates that are not within the preset change rate range from multiple data change rates to obtain the number of abnormal change rates; Determine whether to trigger a data anomaly alarm based on the number of abnormal change rates.

[0005] In this embodiment of the application, the industrial control network data features include register values. Determining the data change rate corresponding to a preset number of adjacent target industrial control network message groups within a preset time period includes: obtaining the data write time interval corresponding to a preset number of adjacent target industrial control network message groups within a preset time period; determining the difference between the register values ​​corresponding to a preset number of adjacent target industrial control network message groups within a preset time period to obtain the register difference; and determining the arctangent function value corresponding to the ratio of the data write time interval to the register difference to obtain the data change rate corresponding to a preset number of adjacent target industrial control network message groups within a preset time period.

[0006] In this embodiment of the application, based on a pre-built whitelist rule, abnormal industrial control network (ICN) packets are removed from each ICN packet according to multiple ICN data features corresponding to each ICN packet to obtain the target ICN packet. This includes: matching multiple ICN data features corresponding to each ICN packet with the whitelist rule; and removing the ICN packet if at least one of the multiple ICN data features corresponding to the ICN packet does not match the whitelist rule to obtain the target ICN packet.

[0007] In this embodiment of the application, the acquisition of industrial control network packets includes: acquiring the initial industrial control network packets corresponding to the industrial control network devices within a preset time period; and removing abnormal initial industrial control network packets from multiple initial industrial control network packets according to preset industrial protocol distortion rules, so as to obtain multiple industrial control network packets.

[0008] In this embodiment of the application, determining whether to trigger a data anomaly alarm based on the number of abnormal change rates includes: triggering a data anomaly alarm when the number of abnormal change rates is greater than a preset number of change rates; and not triggering a data anomaly alarm when the number of abnormal change rates is less than or equal to the preset number of change rates.

[0009] In this embodiment of the application, the abnormal alarm method further includes: displaying alarm information on the management display interface of the industrial control network device to realize data abnormal alarm, the alarm information including industrial control network data characteristics; determining the alarm timestamp of the data abnormal alarm; and storing the alarm information according to the alarm timestamp.

[0010] In this embodiment of the application, the data characteristics of the industrial control network include: transport layer characteristics, application layer characteristics, and device association characteristics; the transport layer characteristics include source IP, destination IP, source port, destination port, and protocol type; the application layer characteristics include industrial protocol function code, register address, and message interaction cycle; the device association characteristics include the sending device type and the receiving device number.

[0011] A second aspect of this application provides an anomaly alarm device for an industrial control network system. The industrial control network system includes an industrial control network device, comprising: a memory configured to store instructions; and a processor configured to retrieve the instructions from the memory and, when executing the instructions, to implement the anomaly alarm method for the industrial control network system described above.

[0012] A third aspect of this application provides a machine-readable storage medium storing instructions for causing a machine to execute the above-described abnormal alarm method for an industrial control network system.

[0013] The fourth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described abnormal alarm method for an industrial control network system.

[0014] The above technical solution, by acquiring multiple industrial control network (ICS) packets from industrial control network (ICS) devices within a preset time period and the corresponding ICS data features for each packet, compared to existing technologies, not only removes abnormal ICS packets from each packet based on pre-built whitelist rules and the corresponding ICS data features to obtain target ICS packets, but also determines the abnormal data change rates that are outside the preset range among a preset number of adjacent target ICS packet groups within the preset time period by determining the number of abnormal change rates. Based on this number, an alarm is triggered. In other words, after whitelist rule matching, a second anomaly identification is performed on the ICS packets based on the data change rates, thereby achieving deep anomaly identification of ICS packets, reducing identification errors, and improving the accuracy of anomaly identification.

[0015] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings: Figure 1 The illustration shows a flowchart of an anomaly alarm method for an industrial control network system according to an embodiment of this application; Figure 2 The illustration shows a flowchart of constructing a whitelist rule according to an embodiment of this application; Figure 3The illustration shows a flowchart of a data anomaly alarm based on the data change rate according to an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0018] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with relevant laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0019] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0020] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0021] Figure 1 The illustration shows a flowchart of an anomaly alarm method for an industrial control network system according to an embodiment of this application. Figure 1 As shown in the illustration, this application provides an anomaly alarm method for an industrial control network system. The industrial control network system includes industrial control network devices. Taking the application of this anomaly alarm method to a processor as an example, the anomaly alarm method may include the following steps: Step S101: Obtain multiple industrial control network packets from industrial control network devices within a preset time period, and multiple industrial control network data features corresponding to each industrial control network packet.

[0022] Step S102: Based on the pre-built whitelist rules, abnormal industrial control network packets in each industrial control network packet are removed according to the multiple industrial control network data characteristics corresponding to each industrial control network packet, so as to obtain the target industrial control network packet.

[0023] Step S103: Determine the data change rate corresponding to a preset number of adjacent target industrial control network message groups within the preset time period.

[0024] Step S104: Determine the abnormal data change rates that are not within the preset change rate range among the multiple data change rates to obtain the number of abnormal change rates.

[0025] Step S105: Determine whether to trigger a data anomaly alarm based on the number of abnormal change rates.

[0026] An industrial control network (ICN) system is a network architecture used for monitoring and controlling production processes in an industrial production environment. It comprises ICN devices. ICN devices are the devices that exchange data within the ICN system. A preset time period is a pre-defined time interval, such as 10 minutes. An ICN message is a structured data unit used to transmit control commands between different ICN devices. ICN data characteristics are the inherent attribute characteristics of ICN messages. A pre-built whitelist rule is a pre-defined whitelist rule. The whitelist rule is the access and operation control rule for accessed objects; its core logic is default denial, allowing only authorized objects to pass. An abnormal ICN message is an ICN message that exhibits abnormalities. A target ICN message is an ICN message after removing abnormal ICN messages based on the pre-built whitelist rule. An adjacent target ICN message group is a combination of two adjacent target ICN messages. The data change rate corresponds to the change rate of a preset number of adjacent target ICN message groups. The abnormal data change rate is the rate of change of data that is abnormal, i.e., the rate of change of data that is not within the preset change rate range. The preset change rate range is a pre-set range of change rates. The number of abnormal change rates is the total number of abnormal data change rates within the preset quantity, and the number of abnormal change rates is less than or equal to the preset quantity.

[0027] Specifically, the processor can pre-set a preset time period, such as 8 minutes. Based on this, the processor can acquire multiple industrial control network (ICN) packets from ICN devices within the preset time period, and multiple ICN data features corresponding to each ICN packet. Based on pre-built whitelist rules, and according to the multiple ICN data features corresponding to each ICN packet, the processor performs anomaly identification on each ICN packet, removes abnormal ICN packets, and obtains the target ICN packets. Furthermore, the processor can pre-determine a preset number, such as 7, of adjacent target ICN packet groups within the preset time period, and determine the abnormal data changes that are not within the preset change rate range among the multiple data change rates, thus obtaining the number of abnormal change rates. In this way, the processor can determine whether to trigger a data anomaly alarm based on the number of abnormal change rates.

[0028] The above technical solution, by acquiring multiple industrial control network (ICS) packets from industrial control network (ICS) devices within a preset time period and the corresponding ICS data features for each packet, compared to existing technologies, not only removes abnormal ICS packets from each packet based on pre-built whitelist rules and the corresponding ICS data features to obtain target ICS packets, but also determines the abnormal data change rates that are outside the preset range among a preset number of adjacent target ICS packet groups within the preset time period by determining the number of abnormal change rates. Based on this number, an alarm is triggered. In other words, after whitelist rule matching, a second anomaly identification is performed on the ICS packets based on the data change rates, thereby achieving deep anomaly identification of ICS packets, reducing identification errors, and improving the accuracy of anomaly identification.

[0029] In this embodiment of the application, the industrial control network data features include register values. Determining the data change rate corresponding to a preset number of adjacent target industrial control network message groups within a preset time period includes: obtaining the data write time interval corresponding to a preset number of adjacent target industrial control network message groups within a preset time period; determining the difference between the register values ​​corresponding to a preset number of adjacent target industrial control network message groups within a preset time period to obtain the register difference; and determining the arctangent function value corresponding to the ratio of the data write time interval to the register difference to obtain the data change rate corresponding to a preset number of adjacent target industrial control network message groups within a preset time period.

[0030] It can be understood that the register value is the status value stored in the register of the industrial control network device, reflecting the working status of the industrial control network device. The data write interval is the time interval between two adjacent industrial control network packets in adjacent target industrial control network packet groups being written to the register. The register difference is the difference between the register values ​​corresponding to two adjacent industrial control network packets in adjacent target industrial control network packet groups.

[0031] Specifically, the processor can pre-obtain the data write times corresponding to two adjacent target industrial control network packets in a preset number of adjacent target industrial control network packet groups within a preset time period, i.e. and Determine the difference in data write times corresponding to the two adjacent target industrial control network messages, i.e., the data write time interval. Based on this, the difference between the register values ​​corresponding to a preset number of adjacent target industrial control network message groups within a preset time period is determined, that is, the register values ​​corresponding to two adjacent target industrial control network messages in each adjacent target industrial control network message group are determined. , And determine the difference between the register values ​​corresponding to two adjacent target industrial control network messages, i.e., the register difference. By determining the arctangent function value corresponding to the ratio of the data write time interval to the register difference, the data change rate corresponding to a preset number of adjacent target industrial control network message groups within a preset time period can be obtained. For example, 10 consecutively written target industrial control network messages are acquired within a preset time period. These 10 messages are then numbered according to the order of their data write times. Three adjacent industrial control network message groups are randomly selected from these 10 messages: messages numbered 2 and 3, messages numbered 4 and 5, and messages numbered 7 and 8. The data write time interval corresponding to each of these adjacent target industrial control network message groups is then determined, and the... The difference between the register values ​​corresponding to each adjacent target industrial control network message group is determined to obtain the register difference corresponding to each adjacent industrial control network message group. The arctangent function value corresponding to the ratio of the data writing time interval to the register difference is determined to obtain the data change rate corresponding to each adjacent target industrial control network message group, that is, the data change rate corresponding to the target industrial control network messages labeled 2 and 3, the data change rate corresponding to the target industrial control network messages labeled 4 and 5, and the data change rate corresponding to the target industrial control network messages labeled 7 and 8.

[0032] By sampling data to obtain the data write time intervals and corresponding register differences for a preset number of adjacent target industrial control network message groups within a preset time period, the data change rate for each adjacent target industrial control network message group can be determined based on these data write time intervals and register differences. By comprehensively considering the changes in register value amplitude and data write time, data sampling can avoid the computation of large amounts of data and improve the efficiency of data computation and anomaly identification.

[0033] In this embodiment, based on pre-built whitelist rules, abnormal industrial control network (ICN) packets are removed from each ICN packet according to multiple ICN data features corresponding to each ICN packet to obtain the target ICN packet. This may include: matching multiple ICN data features corresponding to each ICN packet with the whitelist rules; and removing the ICN packet if at least one of the multiple ICN data features corresponding to the ICN packet does not match the whitelist rules to obtain the target ICN packet.

[0034] Specifically, the processor can pre-input normal industrial control network (ICN) packets into a supervised learning model (e.g., a Support Vector Machine (SVM) recognition model) to generate whitelist rules. Based on this SVM recognition model, multiple ICN data features corresponding to each ICN packet are matched with the whitelist rules. If at least one of the multiple ICN data features corresponding to one of the ICN packets does not match the whitelist rules, the ICN packet is determined to be an abnormal ICN packet. The processor can then remove the ICN packet, i.e., remove the abnormal ICN packet. After matching multiple ICN packets with whitelist rules, i.e. removing the abnormal ICN packets that do not match the whitelist rules, the target whitelist rules can be obtained. Based on the SVM algorithm, the rules are self-learned, and normal ICN packets automatically generate a whitelist according to the preset rules, replacing manual configuration and improving the efficiency and accuracy of rule generation. The processor can also manually match multiple industrial control network packets with whitelist rules to identify anomalies in multiple industrial control network packets, thereby improving the accuracy of anomaly identification.

[0035] In this embodiment of the application, the acquisition of industrial control network packets may include: acquiring the initial industrial control network packets corresponding to the industrial control network devices within a preset time period; and removing abnormal initial industrial control network packets from multiple initial industrial control network packets according to preset industrial protocol distortion rules, so as to obtain multiple industrial control network packets.

[0036] It is understandable that the preset industrial protocol distortion rules are pre-set industrial protocol distortion rules, which are detection rules for identifying messages that do not conform to the legal parameters or standard format of the industrial control protocol, such as field length exceeding limits, illegal function codes, and register address out of bounds. The initial industrial control network message is the initial message in the industrial control network data stream. An abnormal initial industrial control network message is an initial industrial control network message that contains anomalies.

[0037] The processor can obtain the initial industrial control network packets corresponding to the industrial control network devices within a preset time period from the industrial control network data stream. Then, according to the preset industrial protocol distortion rules, it verifies the initial industrial control network packets, identifies distorted packets, i.e., abnormal initial industrial control network packets, and removes them. This prevents abnormal initial industrial control network packets from entering the subsequent industrial control network data processing process. It can filter out valid industrial control network packets that conform to the protocol standards, and provide high-quality basic data for the subsequent industrial control network data processing process.

[0038] In this embodiment of the application, determining whether to trigger a data anomaly alarm based on the number of abnormal change rates may include: triggering a data anomaly alarm when the number of abnormal change rates is greater than a preset number of change rates; and not triggering a data anomaly alarm when the number of abnormal change rates is less than or equal to the preset number of change rates.

[0039] It is understandable that the preset rate of change is a pre-set rate of change, which serves as the boundary value for judging data anomalies.

[0040] Specifically, the processor can determine whether to trigger an alarm by comparing the number of abnormal change rates with a preset change rate. If the number of abnormal change rates exceeds the preset change rate, it is considered that there are some abnormal packets in the industrial control network within the preset time period, requiring a data anomaly alarm to be triggered to intercept the transmission of abnormal data in a timely manner, thereby improving the security of the industrial control network system. Conversely, if the number of abnormal change rates is less than or equal to the preset change rate, it is considered that the industrial control network packets within the preset time period are still within the normal change range, and no data anomaly alarm is needed. This ensures the security of the industrial control network system while maintaining its high-efficiency, low-interference operation. The processor can also compare the number of change rates with the historical number of normal change rates to determine the ratio of the number of change rates to the historical number of normal change rates. If the ratio is greater than the preset ratio, a data anomaly alarm is triggered; otherwise, it is not triggered.

[0041] In this embodiment of the application, the abnormal alarm method may further include: displaying alarm information on the management display interface of the industrial control network device to realize data abnormal alarm, the alarm information including industrial control network data characteristics; determining the alarm timestamp of the data abnormal alarm; and storing the alarm information according to the alarm timestamp.

[0042] As can be understood, alarm information refers to alerts issued in response to abnormal industrial control network (ICS) packets. Alarm information may include, but is not limited to, the ICS data characteristics corresponding to the target ICS packet. The alarm timestamp represents the moment the alarm information was issued.

[0043] Specifically, the processor can display alarm information in real time on the management interface of industrial control network devices and sound an alarm bell. Simultaneously, the processor can push alarm information to the device management terminal via SMS or email, promptly alerting the terminal holder to abnormal data and enabling one-click blocking of abnormal industrial control network packets, thus improving the security of the industrial control network system. Furthermore, the processor determines the alarm timestamps for abnormal data alarms and stores the alarm information in chronological order, facilitating subsequent source tracing and analysis of abnormal industrial control network packets for targeted blocking.

[0044] In this embodiment of the application, the data characteristics of the industrial control network may include: transport layer characteristics, application layer characteristics, and device association characteristics; the transport layer characteristics include source IP, destination IP, source port, destination port, and protocol type; the application layer characteristics include industrial protocol function code, register address, and message interaction cycle; the device association characteristics include the sending device type and the receiving device number.

[0045] It is understood that the characteristics of industrial control network data can include, but are not limited to, transport layer characteristics, application layer characteristics, and device-related characteristics. Transport layer characteristics are the attribute characteristics used by the transport layer to identify or control the transmission of industrial control network messages. Application layer characteristics are the attribute characteristics of the application layer related to specific business logic and protocol functions. Device-related characteristics are the attribute characteristics related to the attributes of the sending and receiving devices of the industrial control network messages themselves.

[0046] Transport layer characteristics can include a five-tuple: source IP, destination IP, source port, destination port, and protocol type. The source IP is the Internet Protocol address (IPA) of the industrial control network (ICS) device sending the ICS message. The destination IP is the IPA of the ICS device receiving the ICS message. The source port is the port number on the ICS device that sends the ICS message. The destination port is the port number on the ICS device that receives the ICS message. The protocol type is the communication protocol used by the transport layer.

[0047] Application layer characteristics may include industry protocol function codes, register addresses, and message exchange cycles. Application layer characteristics also include register values. Industry protocol function codes are operation instruction identifiers defined in the industry protocol. Register addresses are unique identifiers of registers in industrial control network devices. Message exchange cycles are the time intervals between consecutive transmissions of the same type of message in the network.

[0048] Device association characteristics can include the sending device type and the receiving device number. The sending device type is the device type corresponding to the industrial control network device that sends the industrial control network message, and the receiving device number is the unique number corresponding to the industrial control network device that receives the industrial control network message.

[0049] A specific embodiment of this application also provides an anomaly alarm method for an industrial control network system, the industrial control network system including industrial control network devices, the anomaly alarm method may include: After receiving the industrial control network (ICN) data stream, the industrial control firewall determines whether the first packet of the session is a TCP SYN packet and preliminarily determines the protocol type based on the destination port. After the TCP three-way handshake is completed, it parses the TCP data content of the first data packet, extracts protocol feature fields, and finally accurately identifies the protocol name, forming a "session-protocol" mapping table. Subsequent ICN packets from this session begin parsing. By obtaining the application packet type field in the packet's TCP data, the packet type is determined. Following a preset packet format, the packet is parsed sequentially, extracting data related to function codes (operations), addresses (PLC addresses), and values, thus determining the ICN data characteristics within the initial ICN packet. The ICN devices can include, but are not limited to, industrial control firewalls.

[0050] Based on this, such as Figure 2 As shown, the processor can acquire the initial industrial control network packets corresponding to the industrial control network devices within a preset time period. Then, according to the preset industrial protocol anomaly rules, it verifies the initial industrial control network packets, identifies anomaly packets, i.e., abnormal initial industrial control network packets, removes them, and records the anomaly log. This prevents abnormal initial industrial control network packets from entering the subsequent industrial control network data processing process. It can obtain valid industrial control network packets that conform to the protocol standards through screening, and can provide high-quality basic data for the subsequent industrial control network data processing process.

[0051] The processor can also match multiple industrial control network (ICS) data features corresponding to each ICS packet with pre-built whitelist rules to identify abnormal ICS packets among the multiple ICS packets, and remove the abnormal ICS packets to obtain the target ICS packet. The construction of whitelist rules is as follows: Figure 2As shown, multiple industrial control network (ICN) data features corresponding to ICN messages are extracted to form training samples that can be recognized by the support vector machine (SVM) algorithm. The extracted ICN data features are used to generate sample text in the format of "feature name-feature value". Normal samples are marked with "+1", while manually injected abnormal samples are marked with "-1". To address the imbalance problem of "more normal samples and fewer abnormal samples" in ICN messages, an oversampling method is used to generate abnormal samples. The list of used function codes and register addresses of the target programmable logic controller (PLC) is loaded, such as used function codes 03 / 06 and addresses 4x0000-4x0010. Valid combinations outside the used range are generated as abnormal samples. These abnormal samples are divided into three categories: valid function code + invalid address (e.g., function code 03, address 4x9999), invalid function code + valid address (e.g., function code 99, address 4x0001), and both invalid function code and address (e.g., function code 99, address 4x9999). Adjust the ratio of normal samples to abnormal samples to 1 / 25 to avoid the SVM recognition model being biased towards the majority class.

[0052] Therefore, in industrial control networks, the main task is to classify data streams into two categories: normal data streams and abnormal data streams. This is a binary classification task. Training samples can be represented as... ,in, For the first The feature vectors of each training sample , For the first The sample labels of each training sample, (+1 represents normal, 1 represents an anomaly.

[0053] The cost function is:

[0054] in, The normal vector of the classification hyperplane, Normal vector The length of the mold, The penalty coefficient is... This represents the total number of training samples. For the first Relaxation variables for each training sample.

[0055] The constraints are:

[0056] in, For the first The true labels of each training sample For the first The feature vectors of each training sample The bias term for the classification hyperplane.

[0057] After training the SVM recognition model using the above training samples, the optimal normal vector can be obtained. and bias terms The processor can also obtain the initial decision function. :

[0058] in, This is the feature vector of the new sample.

[0059] Because industrial control data may be "non-linear" (cannot be separated by a straight line / plane), SVM introduces a Gaussian kernel function:

[0060] At this point, the initial decision function By combining the Gaussian kernel function, the objective decision function can be obtained:

[0061] in, Let be the objective decision function. No. The Lagrange multipliers corresponding to each new sample Here, sgn represents the optimal bias term in the SVM identification model, and sgn is the sign function. This is the Gaussian kernel function.

[0062] The feature vector corresponding to the industrial control network data features extracted from the industrial control network messages to be detected is input into the target decision function. Based on the output, if the output is 1, the data is considered normal and added to the whitelist according to a certain pattern; if the output is -1, it is considered abnormal data and is discarded directly. In this process, an improved grid search method is used to optimize the model parameters (penalty constant C, kernel function parameter γ): first, a wide step size is used for a large-scale search, and then a narrow step size is used for fine optimization near the optimal parameters to find the optimal SVM model parameters. Simultaneously, the feature vector of the industrial control network packet to be detected is input into the SVM recognition model. If the output is "+1", it is considered normal data, thus obtaining the target industrial control network packet. Whitelist rules are automatically generated according to a preset format, and the rule table is stored in the industrial firewall's whitelist rule base.

[0063] For the two types of data change characteristics in industrial control network systems, namely "process control" and "discrete control", the data change rate is defined as "the angle between the secant and tangent of the numerical trend curve at any time point". The processor can pre-obtain the data write times corresponding to two adjacent target industrial control network packets in a preset number of adjacent target industrial control network packet groups within a preset time period, i.e. and Determine the difference in data write times corresponding to the two adjacent target industrial control network messages, i.e., the data write time interval. Based on this, the difference between the register values ​​corresponding to a preset number of adjacent target industrial control network message groups within a preset time period is determined, that is, the register values ​​corresponding to two adjacent target industrial control network messages in each adjacent target industrial control network message group are determined. , And determine the difference between the register values ​​corresponding to two adjacent target industrial control network messages, i.e., the register difference. By determining the arctangent function value corresponding to the ratio of the data write time interval to the register difference, the data change rate corresponding to a preset number of adjacent target industrial control network message groups within a preset time period can be obtained. Specifically, the processor can determine the data change rate corresponding to adjacent target industrial control network message groups according to the following formula:

[0064]

[0065] in, For the first The register value corresponding to each target industrial control network message. For the first +1 register value corresponding to the target industrial control network message For the first The data write time corresponding to each target industrial control network message. For the first +1 data write time corresponding to the target industrial control network message For the first The target industrial control network message and the first The ratio of the register difference corresponding to the target industrial control network (ICN) packet group consisting of +1 target ICN packets to the data write time interval. The rate of change of data corresponding to the target industrial control network message group.

[0066] Based on this, the processor can collect the data change rate within a normal production cycle, using the process characteristics of industrial control network equipment and in firewall learning mode. Statistical analysis of data change rate within a preset time period The maximum and minimum values ​​are obtained, thus yielding the preset rate of change range Ra(n). Word rate of change is then detected on the target industrial control network message, and messages falling within the preset rate of change range (e.g., ...) are identified. The target industrial control network message is considered to be a normal fluctuation, while the target industrial control network message that is not within the preset rate of change is considered to be an abnormal mutation. That is, the preset rate of change range is used to distinguish between normal fluctuations and abnormal mutations.

[0067] Considering the risk of misjudgment in single-data change rate detection, a "short-cycle, multiple sampling" strategy is adopted. A sampling period and number of samples are set, and an anomaly count threshold is preset. When the number of anomalies within a period exceeds this threshold, it is judged as a "combined anomaly," triggering an alarm. For industrial control network packets that do not match the whitelist rules, they are directly judged as anomalies, triggering an alarm. Figure 3 As shown, the data change rate (i.e., the rate of change of a preset number of adjacent target industrial control network message groups within a preset time period) is determined. Figure 3 The hit change rate is used to determine the abnormal data changes that are not within the preset change rate range from multiple data change rates, so as to obtain the number of abnormal change rates (i.e., Figure 3 The number of hits in the data). When the number of abnormal change rates is greater than the preset number of change rates (i.e., ... Figure 3 If the threshold value is met, the industrial control network (ICS) is considered to have some abnormal packets within a preset time period, requiring a data anomaly alarm to be triggered and the transmission of abnormal data to be intercepted in a timely manner, thereby improving the security of the ICS system. Conversely, if the number of abnormal change rates is less than or equal to a preset change rate, the ICS packets within the preset time period are considered to be within the normal range, and no data anomaly alarm is required; packets can be forwarded normally. This ensures the security of the ICS system while maintaining its high efficiency and low-interference operation.

[0068] The processor can display alarm information in real time on the management interface of industrial control network devices. Alarm information may include industrial control network data characteristics, alarm timestamps, and relevant industrial control network devices, and an alarm bell will sound. Simultaneously, the processor can push alarm information to the device management terminal via SMS or email, promptly alerting the terminal holder to abnormal data and enabling immediate one-click blocking of abnormal industrial control network packets, thus improving the security of the industrial control network system. Furthermore, by determining the alarm timestamps of data anomaly alarms and storing the alarm information in chronological order, it facilitates subsequent source tracing and analysis of abnormal industrial control network packets, allowing for targeted blocking of such packets.

[0069] The technical effects of this application's embodiments are mainly reflected in two aspects. Firstly, it automates rule learning. By automatically learning the normal traffic characteristics of industrial control networks through the SVM algorithm, it generates refined whitelist rules without manual configuration. While accurately generating whitelist rules, it can significantly reduce operation and maintenance costs. Secondly, after removing abnormal industrial control network packets through the SVM identification model, the target industrial control network packets can be obtained. Furthermore, by identifying attacks of "single packet legal, combined illegal" through data change rate, dual anomaly identification can significantly improve the accuracy of anomaly detection. It can identify and alert on abnormal behaviors in the industrial environment, and detect and discover network misoperations and attacks in advance.

[0070] This application also provides an anomaly alarm device for an industrial control network system. The industrial control network system includes an industrial control network device, which may include: a memory configured to store instructions; and a processor configured to retrieve the instructions from the memory and, when executing the instructions, to implement the anomaly alarm method for the industrial control network system described above.

[0071] This application also provides a machine-readable storage medium storing instructions for causing a machine to execute the above-described abnormal alarm method for an industrial control network system.

[0072] This application also provides a computer program product, which may include a computer program that, when executed by a processor, implements the above-described abnormal alarm method for an industrial control network system.

[0073] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0074] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0075] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0076] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0077] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0078] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0079] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0080] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0081] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An anomaly alarm method for an industrial control network system, characterized in that, The industrial control network system includes industrial control network devices, and the anomaly alarm method includes: Acquire multiple industrial control network packets from industrial control network devices within a preset time period, and multiple industrial control network data features corresponding to each industrial control network packet; Based on pre-built whitelist rules, abnormal industrial control network packets are removed from each industrial control network packet according to multiple industrial control network data characteristics corresponding to each industrial control network packet, so as to obtain the target industrial control network packet. Determine the data change rate corresponding to a preset number of adjacent target industrial control network message groups within the preset time period; Identify the abnormal data change rates that are not within the preset change rate range from among the multiple data change rates to obtain the number of abnormal change rates; Based on the number of abnormal change rates, determine whether to trigger a data anomaly alarm.

2. The method according to claim 1, characterized in that, The industrial control network data characteristics include register values, and determining the data change rate corresponding to a preset number of adjacent target industrial control network message groups within the preset time period includes: Obtain the data write time intervals corresponding to a preset number of adjacent target industrial control network message groups within the preset time period; Determine the difference between the register values ​​corresponding to a preset number of adjacent target industrial control network message groups within the preset time period to obtain the register difference; Determine the arctangent function value corresponding to the ratio of the data write time interval to the difference in the register, so as to obtain the data change rate corresponding to a preset number of adjacent target industrial control network message groups within the preset time period.

3. The method according to claim 1, characterized in that, Based on pre-built whitelist rules, and according to multiple industrial control network data characteristics corresponding to each industrial control network packet, abnormal industrial control network packets are removed from each industrial control network packet to obtain the target industrial control network packet, including: Match multiple industrial control network data features corresponding to each of the aforementioned industrial control network messages with the whitelist rules; If at least one of the multiple industrial control network data features corresponding to the industrial control network packet does not match the whitelist rule, the industrial control network packet is removed to obtain the target industrial control network packet.

4. The method according to claim 1, characterized in that, The acquisition of industrial control network messages includes: Obtain the initial industrial control network packets corresponding to the industrial control network devices within a preset time period; According to the preset industrial protocol distortion rules, abnormal initial industrial control network packets are removed from the multiple initial industrial control network packets to obtain multiple industrial control network packets.

5. The method according to claim 1, characterized in that, The step of determining whether to trigger a data anomaly alarm based on the number of abnormal change rates includes: If the number of abnormal change rates exceeds the preset number of change rates, a data anomaly alarm will be triggered. If the number of abnormal change rates is less than or equal to the preset number of change rates, no data anomaly alarm will be triggered.

6. The method according to claim 5, characterized in that, The anomaly alarm method also includes: Alarm information is displayed on the management display interface of the industrial control network device to realize data anomaly alarm, and the alarm information includes the characteristics of the industrial control network data; Determine the alarm timestamp of the data anomaly alarm; The alarm information is stored according to the alarm timestamp.

7. The method according to claim 1, characterized in that, The industrial control network data characteristics include: transport layer characteristics, application layer characteristics, and device association characteristics; The transport layer features include source IP, destination IP, source port, destination port, and protocol type; The application layer features include industrial protocol function codes, register addresses, and message interaction cycles; The device association features include the sending device type and the receiving device number.

8. An anomaly alarm device for an industrial control network system, characterized in that, The industrial control network system includes industrial control network equipment, including: The memory is configured to store instructions; and A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the abnormal alarm method for an industrial control network system according to any one of claims 1 to 7.

9. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to execute an anomaly alarm method for an industrial control network system according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the abnormal alarm method for an industrial control network system according to any one of claims 1 to 7.

Images