Asset information management method and device, electronic equipment and storage medium

Abstract

The invention provides an asset information management method and device, electronic equipment and a storage medium. The asset information management method comprises the following steps: acquiring first asset information of current operation technical equipment in an industrial network; determining key attribute information from the first asset information, wherein the key attribute information comprises a value of a key attribute of the current operation technical equipment; obtaining second asset information from an asset information database, wherein the second asset information comprises asset information of operation technical equipment in the industrial network; determining the asset type of the current operation technical equipment according to the key attribute information and the second asset information; and processing the first asset information according to the asset type of the current operation technical equipment. According to the scheme, the cost of managing the asset information of the OT equipment can be reduced.

Description

Asset information management method, device, electronic device and storage medium Technical Field

[0001] The present application relates to the field of industrial automation technology, and in particular to an asset information management method, device, electronic device and storage medium. Background Art

[0002] Operational Technology (OT) is a specialized technology that provides technical support for factory automation control systems and ensures the normal operation of production. OT equipment provides technical support for automated control systems and includes host computers, engineering stations, operator stations, servers, and programmable logic controllers (PLCs). Various types of OT devices exist in industrial networks. To ensure the security and reliability of industrial network operations, OT devices within these networks must be monitored for security. When monitoring OT devices, the acquired security data must be correlated with the OT device's asset information to enable security analysis of the OT devices based on this security data.

[0003] When the properties of an OT device change, the asset information of the OT device needs to be updated. When a new OT device is added to the industrial network, new asset information needs to be generated. Currently, the asset information of OT devices is managed manually.

[0004] However, industrial networks include a large number of OT devices, and the types of OT devices are diverse. Adding, deleting, and changing the properties of OT devices occur frequently. Managing the asset information of OT devices manually will consume a lot of manpower, resulting in high costs for asset information management.

[0005] Summary of the Invention

[0006] In view of this, the asset information management method, device, electronic device and storage medium provided in this application can reduce the cost of managing the asset information of OT equipment.

[0007] According to a first aspect of an embodiment of the present application, an asset information management method is provided, including: obtaining first asset information of a currently operating technical device in an industrial network; determining key attribute information from the first asset information, the key attribute information including the value of the key attribute of the currently operating technical device; obtaining second asset information from an asset information database, the second asset information including the asset information of the currently operating technical device in the industrial network; determining the asset type of the currently operating technical device based on the key attribute information and the second asset information; and processing the first asset information based on the asset type of the currently operating technical device.

[0008] According to the second aspect of an embodiment of the present application, an asset information management device is provided, including: a first acquisition unit for acquiring first asset information of a current operational technical device in an industrial network; an extraction unit for determining key attribute information from the first asset information, wherein the key attribute information includes the value of the key attribute of the current operational technical device; a second acquisition unit for acquiring second asset information from an asset information database, wherein the second asset information includes asset information of at least one operational technical device in the industrial network; an analysis unit for determining the asset type of the current operational technical device based on the key attribute information and the second asset information; and a processing unit for processing the first asset information based on the asset type of the current operational technical device.

[0009] According to the third aspect of an embodiment of the present application, an electronic device is provided, comprising: a processor, a memory, a communication interface and a bus, wherein the processor, the memory and the communication interface communicate with each other through the bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the asset information management method described in the first aspect above.

[0010] According to the fourth aspect of the embodiment of the present application, a computer-readable storage medium is provided, on which computer instructions are stored. When the computer instructions are executed by a processor, the processor executes the asset information management method as described in the first aspect above.

[0011] According to the fifth aspect of an embodiment of the present application, a computer program product is provided, which is tangibly stored on a computer-readable medium and includes computer-executable instructions, which, when executed, enable at least one processor to execute the asset information management method as described in the first aspect above.

[0012] As can be seen from the above technical solution, after obtaining the first asset information of the currently operating technical equipment, key attribute information is extracted from the first asset information, and the asset type of the currently operating technical equipment is determined based on the key attribute information and the second asset information obtained from the asset information database. The first asset information is then processed accordingly based on the asset type of the currently operating technical equipment. The asset type of the currently operating technical equipment can be an existing asset or a new asset. Processing the first asset information based on the asset type of the currently operating technical equipment achieves automated management of asset information, eliminating the need for human intervention in the asset information management process, reducing labor costs in the asset information management process, and thus reducing the cost of asset information management. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] FIG1 is a flow chart of an asset information management method according to an embodiment of the present application;

[0014] FIG2 is a schematic diagram of an industrial network according to an embodiment of the present application;

[0015] FIG3 is a flow chart of an asset type identification method according to an embodiment of the present application;

[0016] FIG4 is a schematic diagram of an asset information management device according to an embodiment of the present application;

[0017] FIG5 is a schematic diagram of an electronic device according to an embodiment of the present application.

[0018] List of reference numerals:

[0019] 101: Get first-hand asset information on current operational technology devices in your industrial network

[0020] 102: Extract key attribute information from the first asset information

[0021] 103: Obtain the second asset information from the asset information database

[0022] 104: Determine the asset type of the current operational technical equipment based on the key attribute information and the second asset information

[0023] 105: Process the first asset information according to the asset type of the current operating technical equipment

[0024] 301: Divide multiple attributes corresponding to key attribute information into multiple attribute groups based on attribute type configuration information

[0025] 302: Determine the attributes with different values ​​in the key attribute information and the second asset information as difference attributes

[0026] 303: Determine an attribute group including at least one difference attribute as a difference attribute group

[0027] 304: Determine the asset type of the current operational technology equipment based on the difference attribute and difference attribute group

[0028] 100: Asset Information Management Method 200: Industrial Network 300: Asset Type Identification Method

[0029] 400: Asset information management device 500: Electronic equipment 201: Operational technology equipment

[0030] 202: Switch 203: Data Collector 204: Asset Information Management Module

[0031] 205: Agent program 401: First acquisition unit 402: Extraction unit

[0032] 403: Second acquisition unit 404: Analysis unit 405: Processing unit

[0033] 502: Processor 504: Communication interface 506: Memory

[0034] 508: Bus 510: Program DETAILED DESCRIPTION

[0035] As mentioned earlier, industrial networks include various types of OT devices. To ensure the reliability and security of OT device operations, security monitoring of these devices is necessary. The security data obtained during security monitoring should be correlated with the OT device's asset information, allowing for security analysis of the corresponding OT devices based on this data. OT device asset information indicates the device's attributes. When these attributes change, asset information must be updated. Significant changes in OT device attributes require identifying the changed attributes as a new asset, necessitating a determination of whether the asset information update represents a new asset or an update to an existing asset. Currently, OT device asset information is managed manually to distinguish between new asset information and updates to existing asset information. However, due to the large number and variety of OT devices, the frequency of new and updated asset information increases. Manual asset information management consumes significant manpower, resulting in high asset information management costs.

[0036] In an embodiment of the present application, first asset information of the OT device is extracted from traffic data and / or data collected by the agent program, key attribute information of the OT device is extracted from the first asset information, the key attribute information is compared with the second asset information stored in the asset information database, and the asset type of the OT device is determined, that is, whether the OT device is a new asset or an existing asset is determined, and then the first asset information is processed according to the asset type. If the OT device is a new asset, an asset identifier is assigned to the first asset information. If the OT device is an existing asset, the asset information of the OT device in the asset information database is updated according to the first asset information. The asset information management process does not require manual participation, which reduces the labor cost in the asset information management process, thereby reducing the cost of asset information management.

[0037] The asset information management method, device, electronic device, and storage medium provided in the embodiments of the present application are described in detail below with reference to the accompanying drawings. It should be noted that in the following embodiments, the operational technology equipment is the above-mentioned OT equipment.

[0038] Asset Information Management Methods

[0039] FIG1 is a flow chart of an asset information management method according to an embodiment of the present application. As shown in FIG1 , the asset information management method includes the following steps:

[0040] Step 101: Obtain first asset information of currently operating technical equipment in the industrial network.

[0041] Current operational technology equipment refers to equipment in an industrial network. An industrial network includes one or more operational technology equipment, such as host computers, engineering stations, operator stations, servers, and PLCs. Current operational technology equipment can be existing or newly added to the industrial network.

[0042] The asset information includes the attribute values ​​of at least some attributes of the operational technology equipment, such as the asset IP address, asset MAC address, asset port, asset name, asset operating system information, asset key application information, asset device certificate, asset application certificate, etc. The first asset information includes at least some asset information of the current operational technology equipment, for example, the first asset information includes the IP address, MAC address, port information, name, operating system information, key application information, device certificate, application certificate, etc. of the current operational technology equipment.

[0043] Step 102: Extract key attribute information from the first asset information.

[0044] Key attribute information includes the values ​​of key attributes of the current operational technical equipment. Key attributes are more important attributes among the multiple attributes of the operational technical equipment. Changes in the values ​​of key attributes may cause existing assets to become new assets. That is, when an operational technical equipment is changed from an existing asset to a new asset, the values ​​of at least some of the key attributes of the operational technical equipment will change. However, it should be noted that changes in the values ​​of key attributes do not necessarily cause the operational technical equipment to change from an existing asset to a new asset.

[0045] After obtaining the first asset information, key attribute information of the current operational technology device is extracted from the first asset information. The key attribute information may include the asset IP address, the asset MAC address, the asset key application information, and the asset device certificate. It should be understood that the key attribute information of different operational technology devices may correspond to the same or different key attributes. For example, the key attribute information of a first type of operational technology device may include values ​​for attribute 1, attribute 2, and attribute 3, while the key attribute information of a second type of operational technology device may include values ​​for attribute 2, attribute 3, and attribute 4.

[0046] Step 103: Obtain second asset information from the asset information database.

[0047] The asset information database is used to store asset information for operational technology equipment in the industrial network. The asset information of existing operational technology equipment in the industrial network is stored in the asset information database. Specifically, the asset information database contains asset information for existing assets. The asset information stored in the asset information database is retrieved as the second asset information. Because the asset information in the asset information database is dynamically updated, the second asset information retrieved at different times may vary.

[0048] Step 104: Determine the asset type of the currently operating technical equipment based on the key attribute information and the second asset information.

[0049] After obtaining the key attribute information of the current operational technical equipment and the second asset information, the obtained key attribute information is compared with the second asset information, and the asset type of the current operational technical equipment is determined based on the matching relationship between the key attribute information and the second asset information, such as determining whether the current operational technical equipment is an existing asset or a new asset.

[0050] Since the key attribute information of the operational technology equipment newly added to the industrial network is significantly different from the key attribute information of the operational technology equipment originally in the industrial network, that is, the key attribute information of the operational technology equipment newly added to the industrial network is significantly different from the second asset information. When the operational technology equipment originally in the industrial network changes from an existing asset to a new asset, the key attribute information of the operational technology equipment changes significantly. That is, the key attribute information of the operational technology equipment that changes from an existing asset to a new asset due to a significant change in attribute information is significantly different from the second asset information. Therefore, for the operational technology equipment newly added to the industrial network, and the operational technology equipment that changes from an existing asset to a new asset due to a significant change in attribute information, there are significant differences between their key attribute information and the second asset information. Therefore, the asset type of the current operational technology equipment can be determined based on the difference between the key attribute information and the second asset information.

[0051] Step 105: Process the first asset information according to the asset type of the current operating technical equipment.

[0052] For new assets in an industrial network, their asset information needs to be stored so that they can be used for security monitoring and security analysis. For existing assets in an industrial network, their asset information needs to be updated to ensure the correct association between asset information and security data, thereby ensuring the accuracy of security analysis for existing assets.

[0053] After determining the asset type of the current operational technical equipment, the asset information (first asset information) of the current operational technical equipment is processed accordingly according to the asset type of the current operational technical equipment, thereby realizing automated management of the asset information of the operational technical equipment in the industrial network.

[0054] In an embodiment of the present application, after obtaining first asset information of the currently operating technical equipment, key attribute information is extracted from the first asset information, and the asset type of the currently operating technical equipment is determined based on the key attribute information and second asset information obtained from the asset information database. The first asset information is then processed accordingly based on the asset type of the currently operating technical equipment. The asset type of the currently operating technical equipment can be an existing asset or a new asset. Processing the first asset information based on the asset type of the currently operating technical equipment enables automated management of asset information. This eliminates the need for manual intervention in the asset information management process, reduces labor costs in the asset information management process, and thus can reduce the cost of asset information management.

[0055] In one possible implementation, when obtaining the first asset information of the current operational technology device, traffic data of the current operational technology device can be collected from a mirrored port of a switch connected to the current operational technology device, and attribute information of the current operational technology device can be extracted from the collected traffic data as the first asset information. In addition to extracting the attribute information of the current operational technology device from the traffic data as the first asset information, the attribute information of the current operational technology device can also be collected as the first asset information via an agent program installed in the current operational technology device.

[0056] FIG2 is a schematic diagram of an industrial network according to an embodiment of the present application. As shown in FIG2 , the operation technology equipment 201 in the industrial network is connected to the switch 202, and the measuring equipment, driving equipment, etc. in the industrial network are directly or indirectly connected to the switch 202. The operation technology equipment 201 is connected to other operation technology equipment 201 or measuring equipment, driving equipment, etc. through the switch 202. The data collector 203 is connected to the mirror port on at least one switch 202. Different data collectors 203 can be connected to the mirror port on the same switch 202. The data collector 203 can collect traffic data of the operation technology equipment 201 through the mirror port on the switch 202. The industrial network shown in FIG2 includes three switches 202. Those skilled in the art should understand that the industrial network may also include other numbers of switches 202.

[0057] After collecting traffic data from the operational technology device 201, the data collector 203 can send the traffic data to the asset information management module 204. The asset information management module 204 can then extract attribute information of the current operational technology device from the traffic data as the first asset information. Traffic data is the communication data between the operational technology device and other devices in the industrial network. This traffic data can be used to determine the device information and network behavior information of the operational technology device.

[0058] The operational technology device 201 is provided with an agent program 205. The agent program 205 can collect attribute information of the operational technology device 201. The agent program 205 can push the collected attribute information to the asset information management module 204, or the asset information management module 204 can pull the attribute information from the agent program 205. The asset information management module 204 can determine the attribute information obtained from the agent program 205 as the first asset information of the current operational technology device.

[0059] In one example, the asset information management module 204 and the agent program 205 can communicate with each other via the switch 202 and the data collector 203. That is, after the agent program 205 collects the attribute information, the attribute information is first transmitted from the agent program 205 to the switch 202, then from the switch 202 to the data collector 203, and then from the data collector 203 to the asset information management module 204. The asset information management module 204 and the agent program 205 can communicate via protocols such as SNMP, syslog, RDP, or SSH to obtain the attribute information collected by the agent program 205 in a push or pull manner.

[0060] In another example, the asset information management module 204 and the agent program 205 can communicate through a separate data acquisition network, that is, the asset information management module 204 and the agent program communicate directly through the data acquisition network without forwarding data through the switch 202 and the data collector 203.

[0061] The agent program 205 installed in the operational technology device 201 can analyze how many network interfaces are installed in the operational technology device 201 and which of the network interfaces are active, and then obtain IP address and MAC address information from the operational technology device 201. In one example, the agent program 205 can run the command "ipconfig / all" on the operational technology device 201 installed with the Windows operating system to obtain the IP address and MAC address information of the network interface card.

[0062] The attribute information extracted from the traffic data and the attribute information collected by the agent program 205 may include one or more of the asset IP address, asset MAC address, asset port information, asset name, operating system information, key application information, asset device certificate, and asset application certificate.

[0063] It should be noted that the attribute information included in the first asset information can be extracted entirely from the traffic data, or collected entirely by the agent program, or partially extracted from the traffic data and the rest collected by the agent program. This embodiment of the present application does not limit this.

[0064] In an embodiment of the present application, an operational technology device communicates with other devices in an industrial network via a switch. Traffic data from the operational technology device is collected via a mirrored port on the switch. The traffic data includes communication data between the operational technology device and other devices, and attribute information of the operational technology device can be extracted from the traffic data. An agent program is installed on the operational technology device, and the agent program can collect attribute information of the operational technology device. The first asset information can include attribute information extracted from the traffic data and / or attribute information collected by the agent program, ensuring that the obtained first asset information comprehensively includes the attribute information of the operational technology device, thereby ensuring the accuracy of the asset type determined based on the first asset information, thereby ensuring the accuracy of the asset information.

[0065] In one possible implementation, when determining key attribute information from the first asset information, the key attributes of the current operating technical equipment can be determined based on the key attribute configuration information, and then the values ​​of the key attributes of the current operating technical equipment can be extracted from the first asset information, and the extracted key attribute values ​​can be determined as the key attribute information.

[0066] The key attributes of different operational technology devices may vary depending on their device type, purpose, security level, and other factors. Key attribute configuration information defines the key attributes of the current operational technology device. For example, the key attribute configuration information defines the key attributes of the current operational technology device to include the asset IP address, asset MAC address, asset key application information, and asset device certificate.

[0067] After determining the key attributes of the current operational technical equipment, the values ​​of the key attributes of the current operational technical equipment can be extracted from the first asset information, and the extracted key attribute values ​​can be used as the first asset information of the current operational technical equipment. It should be understood that the first asset information may only include the values ​​of some of the key attributes of the current operational technical equipment. Therefore, corresponding attribute values ​​for some of the key attributes of the current operational technical equipment cannot be extracted from the first asset information. In other words, the number of key attributes corresponding to the key attribute information is less than or equal to the number of key attributes specified in the key attribute configuration information.

[0068] In an embodiment of the present application, the key attributes of the current operational technical equipment are determined based on the key attribute configuration, and then the values ​​of the key attributes are extracted from the first asset information as the key attribute information. The user can define the key attribute configuration information according to needs to set the key attributes of the operational technical equipment and adjust the attributes used for judging the asset type of the operational technical equipment to meet the personalized needs of different users and different application scenarios, thereby improving the applicability and user satisfaction of the asset information management method.

[0069] In one possible implementation, when determining the asset type of the current operational technical equipment based on the key attribute information and the second asset information, if the second asset information does not include the key attribute information, the current operational technical equipment is determined to be a new asset; if the second asset information includes at least part of the key attribute information, the asset type of the current operational technical equipment is determined based on the degree of matching between the key attribute information and the second asset information.

[0070] Key attribute information includes the values ​​of the key attributes of the current operational technology equipment, while the second asset information includes attribute information of existing operational technology equipment in the industrial network. If the second asset information does not include key attribute information, it indicates that the current operational technology equipment is not an existing operational technology equipment in the industrial network, meaning that the current operational technology equipment is newly added to the industrial network, thus identifying the current operational technology equipment as a new asset. It should be noted that the second asset information does not include key attribute information, which means that the second asset information does not include any asset whose asset information is identical to the key attribute information.

[0071] If the second asset information includes at least part of the key attribute information, it means that the current operational technology equipment is an existing operational technology equipment in the industrial network, but a significant change in the attributes of the operational technology equipment will make it a new asset. The greater the change in the attributes of the current operational technology equipment, the greater the difference between the key attribute information and the asset information of the current operational technology equipment in the second asset information. Therefore, the asset type of the current operational technology equipment can be determined based on the matching degree between the key attribute information and the second asset information to determine whether the current operational technology equipment has become a new asset or is still an existing asset.

[0072] In an embodiment of the present application, the asset type of the current operating technical equipment is determined based on the matching degree between the key attribute information and the second asset information. If the second asset information does not include the key attribute information (the matching degree between the key attribute information and the second asset information is zero), the current operating technical equipment is determined to be a new asset. If the second asset information includes at least part of the key attribute information, the asset type of the current operating technical equipment is determined based on the matching degree between the key attribute information and the second asset information, thereby ensuring the accuracy of the judgment of the asset type and thus ensuring the accuracy of the management of the asset information.

[0073] FIG3 is a flow chart of an asset type identification method according to an embodiment of the present application. As shown in FIG3 , when determining the asset type of the current operational technical equipment based on the matching degree between the key attribute information and the second asset information, the asset type of the current operational technical equipment can be identified by the following asset type identification method 300:

[0074] Step 301: Divide multiple attributes corresponding to key attribute information into multiple attribute groups according to attribute type configuration information.

[0075] The attribute type configuration information defines attribute grouping rules. According to the attribute type configuration information, multiple attributes corresponding to the key attribute information can be divided into multiple attribute groups. Each attribute group includes at least one attribute, and different attribute groups include different attributes.

[0076] In one example, based on the attribute type configuration information, the attributes corresponding to the key attribute information are divided into multiple attribute groups, resulting in {attribute group 1 (attribute 1, attribute 2, attribute 3, ...), attribute group 2 (attribute 1, attribute 2, attribute 3, ...), attribute group 3 (attribute 1, attribute 2, attribute 3, ...), ...}. In this example, the number of attribute groups is at least three, and each attribute group includes at least three attributes. Those skilled in the art should understand that the number of attribute groups and the number of attributes included in each attribute group may also be other values.

[0077] The same attribute group includes attributes of the same type. For example, the attributes corresponding to key attribute information include the asset IP address, asset MAC address, asset key application, and asset device certificate. The asset IP address includes IP address 1, IP address 2, IP address 3, etc., and the asset MAC address includes MAC address 1, MAC address 2, MAC address 3, etc. The IP address 1, IP address 2, IP address 3, etc. included in the asset IP address are divided into one attribute group, and the attributes included in this attribute group are IP address 1, IP address 2, IP address 3, etc. The MAC address 1, MAC address 2, MAC address 3, etc. included in the asset MAC address are divided into one attribute group, and the attributes included in this attribute group are MAC address 1, MAC address 2, MAC address 3, etc.

[0078] The number of attributes included in an attribute group can be one or more. For example, the IP address attribute group includes multiple attributes such as IP address 1, IP address 2, and IP address 3, and the asset device certificate attribute group includes one attribute, asset device integer.

[0079] Step 302: Determine attributes with different corresponding values ​​in the key attribute information and the second asset information as differential attributes.

[0080] By comparing the key attribute information with the second asset information, the existing asset information of the currently operating technical equipment in the second asset information is determined based on the key attributes whose corresponding attribute values ​​have not changed. Attributes with different values ​​between the key attribute information and the existing asset information are determined as differential attributes. For example, if the attribute IP address 1 has different attribute values ​​in the key attribute information and the existing asset information, then the attribute IP address 1 is determined as a differential attribute. However, if the attribute MAC address 1 has the same attribute value in the key attribute information and the existing asset information, then the attribute MAC address 1 is not determined as a differential attribute.

[0081] Step 303: Determine an attribute group including at least one difference attribute as a difference attribute group.

[0082] After determining the different attributes among the multiple attributes corresponding to the key attribute information, attribute groups including one or more different attributes are determined as different attribute groups based on the attribute groups to which the different attributes belong. For example, if attribute group 1 includes one different attribute among its attributes, attribute group 1 is determined as the different attribute group. If attribute group 2 includes multiple different attributes among its attributes, attribute group 2 is determined as the different attribute group. If attribute group 3 includes no different attributes among its attributes, attribute group 3 is not determined as the different attribute group.

[0083] Step 304: Determine the asset type of the current operational technical equipment based on the difference attribute and the difference attribute group.

[0084] The difference attributes are the attributes of the current operational technical equipment that have changed, and the difference attribute group is the attribute group of the current operational technical equipment that has changed. The difference attributes and the difference attribute group can reflect the degree of attribute change of the current operational technical equipment as a whole, and then determine the asset type of the current operational technical equipment based on the degree of attribute change.

[0085] In an embodiment of the present application, a difference attribute is determined from the attributes of the current operational technical equipment, and a difference attribute group is determined from the attribute group of the current operational technical equipment. The difference attribute reflects the attribute change of the current operational technical equipment from the attribute dimension, and the difference attribute group reflects the attribute change of the current operational technical equipment from the attribute group dimension. Combining the difference attribute and the difference attribute group can more comprehensively reflect the attribute change of the current operational technical equipment, and then determine the asset type of the current operational technical equipment based on the difference attribute and the difference attribute group, which can ensure the accuracy and rationality of identifying the asset type of the current operational technical equipment.

[0086] In one possible implementation, after determining the difference attributes among the multiple attributes corresponding to the key attribute information, the number of the difference attributes is counted to obtain a first number of the difference attributes. After determining the difference attribute groups in each attribute group, the number of the difference attribute groups is counted to obtain a second number of the difference attribute groups. The first number and the second number can then be compared with a preset number threshold. Based on the relationship between the first number and the second number and the number threshold, the asset type of the current operational technical equipment can be determined. Specifically, the asset type of the current operational technical equipment can be determined according to the following rule:

[0087] (1) If the first quantity is greater than a first quantity threshold and the second quantity is greater than a second quantity threshold, then the current operational technology equipment is determined to be a new asset.

[0088] The first number is greater than the first number threshold, indicating that a large number of attributes of the current operational technical equipment have changed. The second number is greater than the second number threshold, indicating that a large number of attribute groups of the current operational technical equipment have changed. Since both the attribute groups and attributes of the current operational technical equipment have changed significantly, the current operational technical equipment is determined to be a new asset.

[0089] The first quantity threshold and the second quantity threshold are preset quantity thresholds. This embodiment of the application does not limit the magnitude relationship between the first quantity threshold and the second quantity threshold. For example, the first quantity threshold can be greater than or equal to the second quantity threshold, or the first quantity threshold can be less than the second quantity threshold. In one example, the first quantity threshold is 2 and the second quantity threshold is 8. In another example, the first quantity threshold and the second quantity threshold are both 3.

[0090] (2) If the first quantity is less than a first quantity threshold and the second quantity is less than a second quantity threshold, then the current operational technology equipment is determined to be an existing asset.

[0091] The first quantity is less than the first quantity threshold, indicating that the number of attributes that have changed in the current operational technical equipment is small. The second quantity is less than the second quantity threshold, indicating that the number of attribute groups that have changed in the current operational technical equipment is also small. Since the number of attributes and attribute groups that have changed in the current operational technical equipment is small, the current operational technical equipment is determined to be an existing asset.

[0092] (3) If the first quantity is greater than a first quantity threshold, the second quantity is less than a second quantity threshold, and the difference attribute includes a preset distinguishing attribute, then the current operational technical equipment is determined to be a new asset.

[0093] The first number is greater than the first number threshold and the second number is less than the second number threshold, indicating that the number of attributes that have changed in the current operational technical equipment is large, and the number of attribute groups that have changed in the current operational technical equipment is small, that is, the changed attributes are concentrated in a few attribute groups. On this basis, if the difference attributes include relatively important distinguishing attributes, that is, the relatively important distinguishing attributes have changed, the current operational technical equipment is determined as a new asset; if the difference attributes do not include distinguishing attributes, that is, the relatively important distinguishing attributes have not changed, the current operational technical equipment is determined as an existing asset.

[0094] The distinguishing attributes are relatively important attributes of the current operational technical equipment. The number of distinguishing attributes can be one or more. When there are multiple distinguishing attributes, under the premise that the first number is greater than the first number threshold and the second number is less than the second number threshold, if all the distinguishing attributes are distinguishing attributes, the current operational technical equipment is determined as a new asset. If only some of the distinguishing attributes are distinguishing attributes, the current operational technical equipment is determined as an existing asset.

[0095] In one example, each IP address and each key application are distinguishing attributes. On the premise that the first number is greater than a first number threshold and the second number is less than a second number threshold, if each IP address and each key application of the current operational technical equipment have changed, the current operational technical equipment is determined to be a new asset.

[0096] In an embodiment of the present application, the first quantity is compared with a first quantity threshold, and the second quantity is compared with a second quantity threshold. The asset type of the current operational technology equipment is determined based on the quantity comparison results. This allows for rapid and accurate determination of the asset type of the current operational technology equipment, ensuring the efficiency and accuracy of asset information management. When the first quantity is greater than the first quantity threshold and the second quantity is less than the second quantity threshold, the asset type of the current operational technology equipment is determined based on whether a relatively important distinguishing attribute has changed. While ensuring that the asset type of the current operational technology equipment can be identified, the asset type identification result meets the requirements for security monitoring of the operational technology equipment, thereby improving the applicability of the asset information management method.

[0097] The first number is the number of difference attributes, and the second number is the number of difference attribute groups. The first number reflects the degree of attribute change of the current operation technical equipment from a smaller-granularity attribute dimension, and the second number reflects the degree of attribute change of the current operation technical equipment from a larger-granularity attribute group dimension. Combining the first number and the second number can more comprehensively reflect the attribute change of the current operation technical equipment. Therefore, determining the asset type of the current operation technical equipment based on the first number and the second number can ensure the accuracy and rationality of identifying the asset type of the current operation technical equipment.

[0098] In one possible implementation, after determining the difference attributes and difference attribute groups, multiple attribute groups can be divided into multiple attribute types based on attribute type configuration information. Each attribute type includes at least one attribute group, and different attribute types include different attribute groups. A first reference value is calculated based on the number and type weights of the difference attributes included in each attribute type, and a second reference value is calculated based on the number and type weights of the difference attribute groups included in each attribute type.

[0099] A corresponding type weight is pre-set for each attribute type, and the type weights corresponding to different attribute types can be the same or different. After the attribute group is divided into multiple attribute types, the number of different attribute groups and the number of different attributes included in each attribute type can be determined.

[0100] According to the number of difference attributes included in each attribute type and the corresponding type weight, the first reference value can be calculated by the following formula (1).

[0101] H1 is used to represent the first reference value, k i Used to represent the type weight corresponding to the i-th attribute type, M i It is used to represent the number of difference attributes included in the i-th attribute type, and N is used to represent the number of attribute types.

[0102] According to the number of difference random groups included in each attribute type and the corresponding type weight, the second reference value can be calculated by the following formula (2).

[0103] H2 is used to represent the second reference value, k i Used to represent the type weight corresponding to the i-th attribute type, O i It is used to represent the number of difference attribute groups included in the i-th attribute type, and N is used to represent the number of attribute types.

[0104] It should be noted that, in addition to calculating the first reference value using the above formula (1), the first reference value can also be calculated using other methods, such as calculating the product of the proportion of different attributes in each attribute type and the type weight corresponding to the attribute type to obtain the first intermediate value corresponding to the attribute type, and then summing the first intermediate values ​​corresponding to each attribute type to obtain the first reference value. In addition to calculating the second reference value using the above formula (2), the second reference value can also be calculated using other methods, such as calculating the product of the proportion of different attribute groups in each attribute type and the type weight corresponding to the attribute type to obtain the second intermediate value corresponding to the attribute type, and then summing the second intermediate values ​​corresponding to each attribute type to obtain the second reference value.

[0105] After calculating the first reference value and the second reference value, the asset type of the current operational technical equipment may be determined based on the magnitude relationship between the first reference value, the second reference value, and the reference threshold. Specifically, the asset type of the current operational technical equipment may be determined according to the following rules:

[0106] (1) If the first reference value is greater than a first reference threshold value, and the second reference value is greater than a second reference threshold value, the current operational technical equipment is determined to be a new asset.

[0107] The first reference threshold and the second reference threshold are preset thresholds. The embodiments of the present application do not limit the magnitude relationship between the first reference threshold and the second reference threshold. For example, the first reference threshold can be greater than or equal to the second reference threshold, or the first reference threshold can be less than the second reference threshold. In one example, the first reference threshold is 0.3 and the second reference threshold is 0.5. In another example, the first reference threshold and the second reference threshold are both 0.4.

[0108] (2) If the first reference value is less than the first reference threshold, and the second reference value is less than the second reference threshold, the currently operating technical equipment is determined to be an existing asset.

[0109] (3) If the first reference value is greater than the first reference threshold, the second reference value is less than the second reference threshold, and the difference attribute includes a preset distinguishing attribute, then the current operational technical equipment is determined to be a new asset.

[0110] The distinguishing attributes are relatively important attributes of the current operational technical equipment. The number of distinguishing attributes can be one or more. When there are multiple distinguishing attributes, under the premise that the first reference value is greater than the first reference threshold and the second reference value is less than the second reference threshold, if all the distinguishing attributes are distinguishing attributes, the current operational technical equipment is determined to be a new asset. If only some of the distinguishing attributes are distinguishing attributes, the current operational technical equipment is determined to be an existing asset.

[0111] In one example, each IP address and each key application are distinguishing attributes. Under the premise that the first reference value is greater than the first reference threshold and the second reference value is less than the second reference threshold, if the IP addresses and each key application of the current operational technical equipment have changed, the current operational technical equipment is determined to be a new asset.

[0112] It should be noted that, under the premise of dividing the attribute group into multiple attribute types, when determining key attribute information from the first asset information, all attribute information of the currently operating technical equipment in the first asset information can be determined as key attribute information. That is, each attribute type includes all attributes involved in the first asset information, and thus the asset type of the currently operating technical equipment can be determined based on all attribute information included in the first asset information. For example, if the first asset information includes the asset IP address, asset MAC address, asset port, asset name, asset operating system information, asset key application information, asset equipment certificate, and asset application certificate, then the set of attributes included in each attribute type includes the asset IP address, asset MAC address, asset port, asset name, asset operating system information, asset key application information, asset equipment certificate, and asset application certificate.

[0113] In an embodiment of the present application, multiple attribute groups corresponding to key attribute information are divided into multiple attribute types, and corresponding type weights are set for attribute types based on the importance of the attributes included in the attribute type to the current operation technology equipment. A first reference value is calculated based on the number and type weight of the difference attributes included in the attribute type, and a second reference value is calculated based on the number and type weight of the difference attribute groups included in the attribute type. The first reference value reflects the degree of attribute change of the current operation technology equipment from a smaller granularity attribute dimension, and the second reference value reflects the degree of attribute change of the current operation technology equipment from a larger granularity attribute group dimension. Combining the first reference value and the second reference value can more comprehensively reflect the attribute change of the current operation technology equipment. Therefore, determining the asset type of the current operation technology equipment based on the first reference value and the second reference value can ensure the accuracy and rationality of identifying the asset type of the current operation technology equipment.

[0114] The first reference value and the second reference value are calculated according to the type weight, so that the importance of the attributes included in the attribute type to the current operational technical equipment matches the contribution of the attribute type to the first reference value and the second reference value, so that the first reference value and the second reference value can not only reflect the number of changes in the attributes, but also reflect the importance of the changed attributes to the current operational technical equipment. Therefore, when determining the asset type of the current operational technical equipment based on the first reference value and the second reference value, the asset type identification result can be made more accurate.

[0115] In one possible implementation, after determining the asset type of the current operational technology device, the first asset information is processed based on the asset type of the current operational technology device. If the current operational technology device is a new asset, an asset identifier is assigned to the current operational technology device, the first asset information is stored in an asset information database, and the security-related data of the current operational technology device is associated with the asset identifier of the current operational technology device. If the current operational technology device is an existing asset, the asset information of the current operational technology device in the asset information database is updated based on the first asset information.

[0116] If the current operational technology device is determined to be a new asset, a new asset ID is assigned to the current operational technology device to facilitate asset information management for the new asset. After the asset ID is assigned to the current operational technology device, the first asset information is stored in the asset information database, and security-related data of the current operational technology device is associated with the assigned asset ID to facilitate security monitoring and security analysis of the current operational technology device. Security-related data includes configuration information, log information, account information, process and service information, etc. Security analysis of the operational technology device can be performed based on this security-related data.

[0117] If the current operational technical equipment is determined to be an existing asset, the asset information of the current operational technical equipment in the asset information database is updated based on the key attributes that have not changed in the first asset information, so that the updated asset information matches the first asset information.

[0118] In an embodiment of the present application, the first asset information is processed accordingly according to the asset type of the currently operating technical equipment to realize the automatic creation and update of the asset information. The asset information management process does not require human participation, thereby improving the security, reliability and timeliness of asset information management.

[0119] Asset Information Management Device

[0120] FIG4 is a schematic diagram of an asset information management device according to an embodiment of the present application. As shown in FIG4 , the asset information management device 400 includes:

[0121] A first acquisition unit 401 is configured to acquire first asset information of a currently operating technical device in the industrial network;

[0122] An extraction unit 402 is configured to determine key attribute information from the first asset information, where the key attribute information includes values ​​of key attributes of the currently operating technical equipment;

[0123] A second acquiring unit 403 is configured to acquire second asset information from an asset information database, where the second asset information includes asset information of at least one operational technology device in the industrial network;

[0124] An analysis unit 404 is configured to determine the asset type of the currently operating technical equipment based on the key attribute information and the second asset information;

[0125] The processing unit 405 is configured to process the first asset information according to the asset type of the currently operating technical equipment.

[0126] In this embodiment of the present application, after the first acquisition unit 401 acquires the first asset information of the currently operating technical equipment, the extraction unit 402 extracts key attribute information from the first asset information. The analysis unit 404 determines the asset type of the currently operating technical equipment based on the key attribute information and the second asset information acquired from the asset information database. Then, the processing unit 405 processes the first asset information accordingly based on the asset type of the currently operating technical equipment. The asset type of the currently operating technical equipment can be an existing asset or a new asset. Processing the first asset information based on the asset type of the currently operating technical equipment enables automated management of asset information. This eliminates the need for manual intervention in the asset information management process, reduces labor costs during the asset information management process, and thus can reduce the cost of asset information management.

[0127] It should be noted that the interaction between the various parts in the above-mentioned asset information management device is based on the same concept as the above-mentioned asset information management method embodiment. The specific content and beneficial effects can be found in the description in the above-mentioned asset information management method embodiment, and will not be repeated here.

[0128] electronic devices

[0129] FIG5 is a schematic diagram of an electronic device provided in an embodiment of the present application. The specific embodiments of the present application do not limit the specific implementation of the electronic device. Referring to FIG5 , the electronic device 500 provided in an embodiment of the present application includes: a processor 502, a communications interface 504, a memory 506, and a bus 508. Among them:

[0130] The processor 502 , the communication interface 504 , and the memory 506 communicate with each other via a bus 508 .

[0131] The communication interface 504 is used to communicate with other electronic devices or servers.

[0132] The processor 502 is used to execute the program 510, and specifically can execute the relevant steps in the above-mentioned asset information management method embodiment.

[0133] Specifically, the program 510 may include program codes, which include computer operation instructions.

[0134] Processor 502 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs, or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0135] The memory 506 is used to store the program 510. The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0136] The program 510 can be specifically used to enable the processor 502 to execute the asset information management method in any of the aforementioned embodiments.

[0137] The specific implementation of each step in program 510 can be found in the corresponding descriptions of the corresponding steps and units in the above-mentioned asset information management method embodiment, and will not be repeated here. Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding process descriptions in the above-mentioned method embodiment, and will not be repeated here.

[0138] After obtaining first asset information of a currently operating technical device, the electronic device of this embodiment extracts key attribute information from the first asset information. Based on the key attribute information and second asset information obtained from an asset information database, the asset type of the currently operating technical device is determined. The first asset information is then processed accordingly based on the asset type of the currently operating technical device. The asset type of the currently operating technical device can be an existing asset or a new asset. Processing the first asset information based on the asset type of the currently operating technical device enables automated management of asset information, eliminating the need for human intervention during the asset information management process, reducing labor costs, and thus reducing the cost of asset information management.

[0139] Computer-readable storage medium

[0140] This application also provides a computer-readable storage medium storing instructions for causing a machine to execute the asset information management method described herein. Specifically, a system or device equipped with a storage medium storing software program code implementing the functions of any of the above-described embodiments can be provided, and a computer (or CPU or MPU) of the system or device can be configured to read and execute the program code stored in the storage medium.

[0141] In this case, the program code read from the storage medium itself can realize the function of any one of the above embodiments, so the program code and the storage medium storing the program code constitute part of this application.

[0142] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0143] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0144] In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0145] Computer program product

[0146] The present application also provides a computer program product tangibly stored on a computer-readable medium and comprising computer-executable instructions. When executed, the computer-executable instructions cause at least one processor to perform the device trust level analysis methods provided in the aforementioned embodiments. It should be understood that each solution in this embodiment has the corresponding technical effects of the aforementioned method embodiments and will not be further elaborated here.

[0147] It should be noted that not all steps and modules in the above-mentioned processes and device structure diagrams are required, and certain steps or modules can be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or may be implemented by certain components in multiple independent devices.

[0148] Nouns and pronouns referring to persons in this patent application are not limited to a specific gender.

[0149] In the above embodiments, the hardware module can be implemented mechanically or electrically. For example, a hardware module can include a permanent dedicated circuit or logic (such as a dedicated processor, FPGA or ASIC) to complete the corresponding operation. The hardware module can also include programmable logic or circuits (such as a general-purpose processor or other programmable processors), which can be temporarily set by software to complete the corresponding operation. The specific implementation method (mechanical method, or dedicated permanent circuit, or temporarily set circuit) can be determined based on cost and time considerations.

[0150] The present application has been presented and described in detail above through the accompanying drawings and preferred embodiments. However, the present application is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the code review methods in the above different embodiments can be combined to obtain more embodiments of the present application, and these embodiments are also within the scope of protection of the present application.

Claims

1. An asset information management method (100), comprising: Get first-hand asset information on currently operational technology devices in industrial networks; Determining key attribute information from the first asset information, the key attribute information including a value of a key attribute of the currently operating technical device; Acquire second asset information from an asset information database, the second asset information comprising asset information of operational technical equipment in the industrial network; Determining the asset type of the currently operating technical equipment according to the key attribute information and the second asset information; The first asset information is processed according to the asset type of the currently operating technical equipment.

2. The method according to claim 1, wherein: The obtaining of first asset information of currently operating technical equipment in the industrial network includes: Collecting flow data of the current operation technology device from a mirror port of a switch connected to the current operation technology device, and extracting attribute information of the current operation technology device from the flow data as the first asset information; and / or, The attribute information of the currently operating technical equipment is collected as the first asset information through an agent program set in the currently operating technical equipment.

3. The method according to claim 1, wherein: The determining key attribute information from the first asset information includes: Determine the key attributes of the current operational technical equipment according to the key attribute configuration information; The key attribute value of the current operating technical equipment is extracted from the first asset information, and the extracted key attribute value is determined as the key attribute information.

4. The method according to claim 1, wherein: The determining, according to the key attribute information and the second asset information, the asset type of the currently operating technical equipment includes: If the second asset information does not include the key attribute information, determining that the current operating technical equipment is a new asset; If the second asset information includes at least part of the key attribute information, the asset type of the currently operating technical equipment is determined based on the degree of matching between the key attribute information and the second asset information.

5. The method according to claim 4, wherein: The determining the asset type of the currently operating technical equipment according to the matching degree between the key attribute information and the second asset information includes: According to the attribute type configuration information, the multiple attributes corresponding to the key attribute information are divided into multiple attribute groups, each of the attribute groups includes at least one attribute, and different attribute groups include different attributes; Determine attributes corresponding to different values ​​in the key attribute information and the second asset information as difference attributes; determining the attribute group including at least one of the difference attributes as a difference attribute group; The asset type of the currently operating technical equipment is determined according to the difference attribute and the difference attribute group.

6. The method according to claim 5, wherein: The determining the asset type of the current operating technical equipment according to the difference attribute and the difference attribute group includes: determining a first number of the difference attributes and a second number of the difference attribute groups; If the first quantity is greater than a first quantity threshold, and the second quantity is greater than a second quantity threshold, determining that the current operational technology equipment is a new asset; If the first quantity is less than the first quantity threshold, and the second quantity is less than the second quantity threshold, determining that the current operational technology equipment is an existing asset; If the first quantity is greater than the first quantity threshold, the second quantity is less than the second quantity threshold, and the difference attribute includes a preset distinguishing attribute, then it is determined that the current operating technical equipment is a new asset.

7. The method according to claim 5, wherein: The determining the asset type of the current operating technical equipment according to the difference attribute and the difference attribute group includes: According to the attribute type configuration information, the multiple attribute groups are divided into multiple attribute types, each of the attribute types includes at least one of the attribute groups, and different attribute types include different attribute groups; Calculating a first reference value according to the quantity and type weight of the difference attributes included in each attribute type; Calculating a second reference value according to the number and type weight of the difference attribute groups included in each attribute type; If the first reference value is greater than a first reference value threshold, and the second reference value is greater than a second reference value threshold, determining that the currently operating technical equipment is a new asset; If the first reference value is less than the first reference value threshold, and the second reference value is less than the second reference value threshold, determining that the currently operating technical equipment is an existing asset; If the first reference value is greater than the first reference value threshold, the second reference value is less than the second reference value threshold, and the difference attribute includes a preset distinguishing attribute, then it is determined that the currently operating technical equipment is a new asset.

8. The method according to claim 6 or 7, wherein: The processing of the first asset information according to the asset type of the currently operating technical equipment includes: If the current operational technical equipment is a new asset, assigning an asset identifier to the current operational technical equipment, storing the first asset information in the asset information database, and associating the security-related data of the current operational technical equipment with the asset identifier of the current operational technical equipment; If the currently operating technical equipment is an existing equipment, the asset information of the currently operating technical equipment in the asset information database is updated according to the first asset information.

9. An asset information management device (400), comprising: A first acquisition unit (401) is used to acquire first asset information of a currently operating technical device in the industrial network; An extraction unit (402) is used to determine key attribute information from the first asset information, wherein the key attribute information includes a value of a key attribute of the currently operating technical equipment; A second acquisition unit (403) is used to acquire second asset information from an asset information database, wherein the second asset information includes asset information of at least one operational technical device in the industrial network; An analysis unit (404), configured to determine the asset type of the currently operating technical equipment according to the key attribute information and the second asset information; The processing unit (405) is used to process the first asset information according to the asset type of the currently operating technical equipment.

10. An electronic device (500), comprising: A processor (502), a communication interface (504), a memory (506) and a bus (508), wherein the processor (502), the communication interface (504) and the memory (506) communicate with each other via the bus (508); The memory (506) is used to store at least one executable instruction, and the executable instruction enables the processor (502) to perform operations corresponding to the asset information management method as described in any one of claims 1-8.

11. A computer-readable storage medium having computer instructions stored thereon, wherein when the computer instructions are executed by a processor, the processor is caused to execute the method according to any one of claims 1 to 8.

12. A computer program product tangibly stored on a computer readable medium and comprising computer executable instructions which, when executed, cause at least one processor to perform the method according to any one of claims 1-8.

Images