Data tamper-proof transmission method of network information security system

Abstract

The present application relates to the technical field of data transmission, and particularly relates to a data tamper-proof transmission method of a network information security system, which comprises the following steps: collecting a transmission message sequence corresponding to a current session when a source end device responds to a specific protocol, and obtaining message attribute information of each transmission message in the transmission message sequence, which can reflect the data sending characteristics of the source end; based on the message attribute information, performing multi-dimensional condition verification on each transmission message in the transmission message sequence, and screening out artificial abnormal segmented messages in the transmission message sequence, wherein the multi-dimensional condition verification comprises at least two of spatial dimension verification, logical dimension verification and time sequence dimension verification; and based on the proportion of the number of the artificial abnormal segmented messages in the transmission message sequence, determining an abnormal monitoring result corresponding to the current session. The present application effectively improves the abnormal monitoring accuracy in the data transmission process.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and specifically to a data anti-tampering transmission method for a network information security system. Background Technology

[0002] In Industrial Control Systems (ICS), protocols such as IEC 60870-5-104 are widely used for data exchange between the master station and Remote Terminal Units (RTUs). As a typical embedded device, the RTU, constrained by hardware resources and the scheduling mechanism of the Real-Time Operating System (RTOS), exhibits a significant "interrupt aggregation" characteristic in its network protocol stack when sending large amounts of data (such as responding to "general call" commands). That is, to reduce CPU interrupt overhead, the RTU tends to fill the Maximum Transmission Unit (MTU) with data or wait for the hardware buffer to be ready before sending it all at once.

[0003] However, as cyberattacks targeting critical infrastructure evolve, attackers often utilize software emulators running on general-purpose computer platforms (such as tools written in Python / Scapy or C#) to inject fake telemetry data conforming to protocol specifications into the master station after obtaining legitimate communication keys. These software emulators, limited by the sequential execution logic of application-layer code, typically lack the physical aggregation characteristics of embedded hardware. They often exhibit the behavior of repeatedly sending small data packets at a high frequency, even when logical addresses are contiguous and physical bandwidth is sufficient.

[0004] Existing defense methods primarily rely on identity authentication (such as Virtual Private Networks, VPNs) or content compliance checks (such as Deep Packet Inspection, DPI). However, once keys are leaked or attackers completely emulate the protocol format, these methods struggle to distinguish between genuine embedded hardware and fake software emulators, resulting in inaccurate identification results. While some traffic analysis techniques attempt to use Inter-Arrival Time (IAT) for fingerprinting, in complex industrial network environments, this single time dimension is highly susceptible to network jitter, also leading to inaccurate identification results and false alarms. Summary of the Invention

[0005] To address the technical problem of false alarms caused by inaccurate identification results in existing defense methods, the present invention aims to provide a data anti-tampering transmission method for a network information security system. The specific technical solution adopted is as follows:

[0006] In a first aspect, the present invention provides a data anti-tampering transmission method for a network information security system, comprising the following steps:

[0007] Collect the transmission message sequence corresponding to the current session when the source device responds to a specific protocol, and obtain the message attribute information of each transmission message in the transmission message sequence that can reflect the data sending characteristics of the source end;

[0008] Based on the message attribute information, multi-dimensional condition verification is performed on each transmitted message in the transmitted message sequence to filter out manually abnormal segmented messages in the transmitted message sequence; the multi-dimensional condition verification includes at least two of spatial dimension verification, logical dimension verification, and temporal dimension verification.

[0009] Based on the proportion of manually anomaly segmented messages in the transmitted message sequence, the anomaly monitoring result corresponding to the current session is determined.

[0010] In conjunction with the first aspect above, among some possible implementations, collecting the transmission message sequence corresponding to the current session when the source device responds to a specific protocol includes:

[0011] When the gateway detects that the source device has received the master station's general call command, it stores the response messages sent by the source device in sequence.

[0012] When the collection termination condition is detected, the gateway stops storing the response messages sent by the source device, thereby obtaining the transmission message sequence corresponding to the current session when the source device responds to a specific protocol.

[0013] In conjunction with the first aspect above, in some possible implementations, multi-dimensional conditional verification is performed on each transmitted message in the transmitted message sequence to filter out manually anomalous segmented messages in the transmitted message sequence, including:

[0014] Based on the payload length in the message attribute information, spatial dimension verification is performed on the transmitted messages in the transmitted message sequence to determine whether the spatial merging condition is met.

[0015] Based on the protocol type identifier and logical address index in the message attribute information, the transmitted messages in the transmitted message sequence are logically verified to determine whether the logical merging condition is met.

[0016] Based on the gateway receiving timestamp in the message attribute information, the time sequence dimension verification of the transmitted messages in the transmitted message sequence is performed to determine whether the fast transmission condition is met.

[0017] Transmission messages that simultaneously satisfy the spatial merging condition, the logical merging condition, and the fast transmission condition in the transmission message sequence are designated as artificially abnormal segmented messages in the transmission message sequence.

[0018] In conjunction with the first aspect above, in some possible implementations, spatial dimension verification is performed on the transmitted messages in the transmitted message sequence to determine whether the spatial merging condition is met, including:

[0019] Based on the payload length in the message attribute information of all transmitted messages in the transmitted message sequence, determine the baseline value of the payload length corresponding to the transmitted message sequence.

[0020] The sum of the payload lengths in the message attribute information of any transmitted message in the transmitted message sequence and its adjacent transmitted messages is determined. If the sum is greater than the payload length reference value, the corresponding transmitted message is determined not to meet the spatial merging condition, and other dimension verifications are stopped; otherwise, the corresponding transmitted message is determined to meet the spatial merging condition.

[0021] In conjunction with the first aspect above, in some possible implementations, determining the payload length reference value corresponding to the transmitted message sequence includes:

[0022] For the message attribute information of all transmitted messages in the transmitted message sequence, the maximum effective payload length among the effective payload lengths of all message attribute information is determined as the payload peak value of the current session;

[0023] Obtain the historical maximum load reference associated with the source device;

[0024] Determine the maximum value between the current session's peak load and the historical maximum load benchmark, and use the maximum value as the effective payload length benchmark value corresponding to the transmitted message sequence.

[0025] In conjunction with the first aspect above, in some possible implementations, logical dimension verification is performed on the transmitted messages in the transmitted message sequence to determine whether the logical merging condition is met, including:

[0026] Determine whether the protocol type identifier in the message attribute information of any transmission message in the transmission message sequence is the same as that in the subsequent transmission message;

[0027] If the protocol type identifiers are different, and the end logical address index in the message attribute information of any message in the transmission message sequence is adjacent to the start logical address index in the message attribute information of its successor message, then the corresponding transmission message is determined not to meet the logical merging condition; otherwise, the corresponding transmission message is determined to meet the logical merging condition.

[0028] In conjunction with the first aspect above, in some possible implementations, time-series verification is performed on the transmitted messages in the transmitted message sequence to determine whether the fast transmission condition is met, including:

[0029] The message arrival time interval is determined based on the gateway receiving timestamp in the message attribute information of any message in the message sequence and its subsequent message.

[0030] If the message arrival time interval is greater than the preset fast transmission judgment threshold, the corresponding transmission message is determined not to meet the fast transmission condition; otherwise, the corresponding transmission message is determined to meet the fast transmission condition.

[0031] In conjunction with the first aspect mentioned above, among some possible implementation methods, the anomaly monitoring result corresponding to the current session is determined, including:

[0032] If the proportion of artificially abnormal segmented messages in the transmission message sequence is less than or equal to the low sensitivity threshold, the segmentation behavior of the current session is determined to be legal, and the control mesh forwards the transmission messages in the transmission message sequence to the destination master station in order.

[0033] If the proportion of artificially abnormal segmented messages in the transmitted message sequence is greater than the low sensitivity threshold and less than or equal to the high sensitivity threshold, the segmentation behavior of the current session is judged to be suspicious, and the gateway is controlled to allow the transmitted message sequence to pass, and a security audit log is generated.

[0034] If the proportion of artificially generated abnormal segmented messages in the transmitted message sequence is greater than the high sensitivity threshold, the segmentation behavior of the current session is determined to be abnormal, and the gateway is controlled to perform defensive actions.

[0035] In conjunction with the first aspect described above, in some possible implementations, the method further includes:

[0036] If the segmentation behavior of the current session is determined to be legal, the historical maximum load benchmark associated with the source device is updated using the load peak value of the current session determined based on the transmitted message sequence.

[0037] In conjunction with the first aspect above, in some possible implementations, before obtaining the message attribute information of each transmitted message in the transmitted message sequence that reflects the data transmission characteristics of the source end, the method further includes:

[0038] The number of messages in the transmitted message sequence is counted;

[0039] Only when the number of messages is greater than or equal to a set threshold, message attribute information that reflects the data sending characteristics of the source end is obtained for each transmitted message in the transmitted message sequence.

[0040] Secondly, the present invention also provides a data anti-tampering transmission system for a network information security system, the system comprising a memory and a processor. The memory stores executable computer program code, and the processor retrieves and runs the executable computer program code from the memory, causing the system to perform the methods described in the first aspect or any possible implementation thereof.

[0041] Thirdly, the present invention also provides a computer program product comprising: computer program code, which, when run on a computer, causes the computer to perform the method described in the first aspect or any possible implementation thereof.

[0042] Fourthly, the present invention also provides a computer-readable storage medium storing computer program code that, when executed on a computer, causes the computer to perform the method described in the first aspect or any possible implementation thereof.

[0043] This invention has the following beneficial effects: By collecting the transmission message sequence when the source device responds to the general call command, and utilizing the message attribute information of each transmission message in the transmission message sequence that can reflect the data sending characteristics of the source, a joint verification of at least two of the following dimensions—spatial dimension verification, logical dimension verification, and temporal dimension verification—is performed on each transmission message in the transmission message sequence. This constructs a stringent judgment model that is "physically compatible, logically compatible, but extremely fast segmentation," effectively avoiding false alarms due to network jitter and the problem of attackers using small packets to evade detection. Combined with statistical decision-making based on the proportion of abnormal segments, it achieves highly robust identification of simulator attacks, ensuring the communication security and business continuity of the industrial control system. Attached Figure Description

[0044] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart illustrating the steps of a data anti-tampering transmission method for a network information security system according to an embodiment of the present invention.

[0046] Figure 2 This is a flowchart illustrating the steps of performing multi-dimensional conditional verification on each transmitted message in the transmitted message sequence according to an embodiment of the present invention. Detailed Implementation

[0047] To clearly illustrate the technical features of this solution, the invention will be described in detail below through specific embodiments and in conjunction with the accompanying drawings.

[0048] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the invention. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the invention.

[0049] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0050] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0051] It should be noted that the concepts of "first" and "second" mentioned in this invention are only used to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0052] Although operations or steps are described in a specific order in the accompanying drawings in the embodiments of the present invention, this should not be construed as requiring these operations or steps to be performed in the specific order or serial order shown, or requiring all of the shown operations or steps to be performed to obtain the desired result. In the embodiments of the present invention, these operations or steps may be performed serially; they may be performed in parallel; or a portion of these operations or steps may be performed.

[0053] Furthermore, it is understood that the data involved in the technical solutions of this invention (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations, and provisions. Unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0054] To address the problem of false alarms caused by inaccurate identification results in existing defense methods, this invention provides a data anti-tampering transmission method for network information security systems. This method collects the transmission message sequence corresponding to the current session when the source device responds to a specific protocol, and obtains message attribute information for each transmission message in the sequence that reflects the data transmission characteristics of the source device. Based on this message attribute information, multi-dimensional conditional verification is performed on each transmission message in the sequence to filter out manually anomaly segmented messages. Finally, based on the proportion of manually anomaly segmented messages in the transmission message sequence, the anomaly monitoring result corresponding to the current session is determined. This invention effectively improves the accuracy of anomaly monitoring during data transmission by performing multi-dimensional conditional verification on the transmission message sequence corresponding to the current session when the source device responds to a specific protocol, ultimately determining the anomaly monitoring result for the current session.

[0055] The following will describe in detail, with reference to the accompanying drawings, a data anti-tampering transmission method for a network information security system provided by an embodiment of the present invention.

[0056] Figure 1 This invention illustrates a basic flowchart of a data anti-tampering transmission method for a network information security system according to an embodiment of the present invention. Figure 1 As shown, the method specifically includes the following steps:

[0057] Step S100: Collect the transmission message sequence corresponding to the current session when the source device responds to a specific protocol, and obtain the message attribute information of each transmission message in the transmission message sequence that can reflect the data sending characteristics of the source.

[0058] In the process of tamper-proof data transmission, network information security systems sample during the high-load phase when the source device responds to a specific protocol (such as a master station general call) to capture samples that best reflect the device's extreme physical performance, obtaining the transmission message sequence of the current session. Simultaneously, to analyze the transmission messages in the transmission message sequence and obtain message attribute information for each message that reflects the data transmission characteristics of the source end, the system ultimately achieves anomaly monitoring results for the current session.

[0059] In one possible implementation, the process of acquiring the transmission message sequence corresponding to the current session when the source device responds to the master station's general call includes:

[0060] Step S101: When the gateway detects that the source device has received the master station's general call command, it stores the response messages sent by the source device in sequence.

[0061] Specifically, the gateway of the network information security system establishes an observation window at the kernel driver layer to monitor the uplink traffic of the network interface in real time and parse the Application Layer Protocol Data Unit (APDU). When the gateway detects that the TypeID field value in the APDU is 100 (C_IC_NA_1, global call command) and the Cause of Transmission (COT) field value is 6 (active), it determines that the master station has initiated a full data request and the source device is about to enter a high-throughput transmission state. At this time, the gateway allocates a buffer in memory and initializes it as a global call response message sequence cache. and the message counter count. Reset to 0. Subsequently, the gateway initiates a mirroring mechanism, sequentially copying and storing in the cache all subsequent I-format (Message Transmission Format) response messages belonging to the general call response. middle.

[0062] Step S102: When the acquisition termination condition is met, the gateway stops storing the response messages sent by the source device, thereby obtaining the transmission message sequence corresponding to the current session when the source device responds to a specific protocol.

[0063] Specifically, while the gateway is storing the response messages, it will continuously monitor the data stream status. When any of the following collection termination conditions are met, sampling will be stopped immediately and the gateway will be closed. :

[0064] 1. A message with a Transmission Reason (COT) field value of 10 (Activation End) is captured, indicating that the current general call process has ended normally; 2. Message counter The preset sampling limit (set to 50 in this embodiment) is reached to prevent buffer overflow.

[0065] cache After being closed, the cache All the message data stored in the middle is the sequence of transmission messages corresponding to the current session when the source device responds to the master station's general call.

[0066] In one possible implementation, before obtaining the message attribute information of each transmitted message in the transmitted message sequence that reflects the data transmission characteristics of the source end, the method further includes: counting the number of messages in the transmitted message sequence; and obtaining the message attribute information of each transmitted message in the transmitted message sequence that reflects the data transmission characteristics of the source end only when the number of messages is greater than or equal to a set number threshold.

[0067] Specifically, regarding caching The number of messages stored in the message data, i.e., the number of messages in the transmitted message sequence, is analyzed. If the final count of the message counter... If the number of samples is less than the set threshold, it indicates that the number of samples is insufficient to build a differential analysis environment, and the gateway will release the cache and terminate the current detection. Conversely, if the final count of the packet counter is... If the quantity is greater than or equal to the set threshold, then it is based on the cache. The system stores message attribute information for each transmitted message in the sequence of transmitted messages, reflecting the characteristics of data transmission from the source end, and continues the subsequent detection process. The threshold value can be set reasonably as needed and is not limited here; for example, the threshold value can be set to 2.

[0068] In one possible implementation, the process of obtaining message attribute information that reflects the data transmission characteristics of the source end for each transmitted message in the transmitted message sequence includes:

[0069] Gateway for closed cache The system iterates through the transmitted message sequence stored in the cache and extracts key fields from each message to construct message attribute information. For caching... The Middle A transmission message, , This indicates the number of transmitted messages in the transmitted message sequence and generates their corresponding message attribute information, which consists of an attribute vector. To characterize the attribute vector It contains five components, at which point there is an attribute vector. ;in, Indicates the first The gateway receive timestamp of each transmitted message records the hardware timestamp of the moment when the gateway network interface controller (NIC) hardware captured the first byte of the message, in microseconds. This timestamp only reflects the time when the message arrives at the gateway's physical interface and does not include the subsequent processing delays of the gateway's operating system kernel protocol stack and application layer. Indicates the first The payload length of each transmitted message is obtained by subtracting the application protocol control information (APCI) header length from the total number of bytes in the APDU, and is used to characterize the amount of application data actually carried by the message. Indicates the first The protocol type identifier of a transmission message is obtained by reading and parsing the TypeID field value in the Application Layer Protocol Data Unit (ASDU); Indicates the first The starting logical address index of a transmission message is obtained by reading the address (IOA) of the first information object in the ASDU; Indicates the first The end logical address index of each transmitted message is calculated based on the structure qualifier (SQ) bits in the ASDU. (arranged in order), then , Indicates the number of information objects; if (Discrete arrangement), then This is the address of the last information object.

[0070] It should be understood that the above-mentioned acquisition of the first Attribute vector of a transmitted message This assumes that the Information Object Address (IOA) of the source device has been mapped to a linear, continuous index space. For devices using discrete addressing, an IOA mapping table needs to be pre-configured through the gateway or established through self-learning to map the physical IOAs to logical indices. and This is to ensure the validity of subsequent difference calculations.

[0071] Step S200: Based on the message attribute information, perform multi-dimensional condition verification on each transmitted message in the transmitted message sequence to filter out manually abnormal segmented messages in the transmitted message sequence.

[0072] Among them, multidimensional conditional verification includes at least two of the following: spatial dimension verification, logical dimension verification, and temporal dimension verification.

[0073] To determine whether the segmentation of the current session's packets is an unnecessary manual segmentation, i.e., whether it conforms to simulator characteristics, this embodiment does not rely on a single-dimensional feature. Instead, it analyzes the packet attribute information of each transmitted packet in the transmitted packet sequence and performs multi-dimensional condition verification on each transmitted packet, such as spatial dimension verification, logical dimension verification, and temporal dimension verification. This filters out manually abnormal segmented packets in the transmitted packet sequence and ultimately reduces the false alarm rate caused by network jitter or service fragmentation.

[0074] Data transmission typically cannot exceed the physical capacity of a device; when it does, it will be forcibly segmented. Therefore, spatial dimension verification is performed on the transmitted message sequence to identify whether the segmentation is caused by physical constraints (such as MTU limitations or insufficient memory).

[0075] If two data segments correspond to non-contiguous memory addresses or different service types at the source, then packet segmentation is a necessary requirement of the business logic and a logically compliant behavior. Conversely, if they do not, it indicates that the packet segmentation behavior is neither physically enforced nor logically necessary, and has suspicious characteristics of human intervention. Therefore, logical dimension verification is performed on the transmitted packets in the transmission packet sequence to verify whether adjacent packets belong to the same data block in terms of business logic, thereby identifying whether there are logical coupling anomalies in packet segmentation.

[0076] Real embedded devices inevitably experience physical hardware latency during data acquisition, analog-to-digital conversion, context switching, and interrupt response. Software simulators, on the other hand, typically pre-generate data and store it in arrays; their transmission intervals are limited only by the speed of the CPU's loop instructions, often exhibiting extremely high time density. Although network transmission introduces jitter, this "machine speed" and "physical rhythm" still show significant differences in statistical distribution. Therefore, timing-based verification of transmitted messages in the transmission sequence is necessary to verify the temporal coupling of the messages, thereby distinguishing whether message segmentation stems from the natural waiting time of hardware acquisition and processing (embedded characteristic) or from the extremely rapid transmission of software loops (simulator characteristic).

[0077] In one possible implementation, such as Figure 2 As shown, multi-dimensional conditional verification is performed on each transmitted message in the transmitted message sequence to filter out manually anomalous segmented messages in the transmitted message sequence, including:

[0078] Step S201: Based on the payload length in the message attribute information, perform spatial dimension verification on the transmitted messages in the transmitted message sequence to determine whether the spatial merging condition is met.

[0079] The payload length in the message attribute information refers to the application layer data unit length of the message. This payload length can be used to assess whether message transmission exceeds the device's physical capacity, thereby identifying whether message segmentation is caused by physical constraints. For example, if the sum of the payload lengths in the message attribute information of two adjacent transmitted messages exceeds a preset length benchmark, it indicates that the message segmentation is due to physical constraints. Therefore, spatial dimension verification is performed on the transmitted messages in the transmission message sequence based on the payload length in the message attribute information.

[0080] In one possible implementation, spatial dimension verification is performed on the transmitted messages in the transmitted message sequence to determine whether the spatial merging condition is met, including:

[0081] Step S2011: Based on the payload length in the message attribute information of all transmitted messages in the transmitted message sequence, determine the baseline value of the payload length corresponding to the transmitted message sequence.

[0082] An objective physical baseline value, namely the payload length baseline value, is determined to determine whether the segmentation of a packet is caused by "physical constraints" (such as MTU limitations or insufficient memory). To prevent attackers from deliberately sending small packets to lower the system's judgment threshold, a historical baseline correction mechanism can be introduced to determine this payload length baseline value.

[0083] In one possible implementation, determining the payload length reference value corresponding to the transmitted message sequence includes:

[0084] First, based on the message attribute information of all transmitted messages in the transmission message sequence, the maximum payload length among all payload lengths in the message attribute information is determined as the peak payload of the current session. Specifically, the gateway first iterates through the cache. The payload length component of the message attribute vector of all transmitted messages present in the data. The effective payload length components of all transmitted messages are determined using a maximum value search algorithm. The maximum effective payload length in the current session is recorded as the peak payload length of the current session. At this time there is .in, This represents the function that takes the maximum value. The peak load of the current session. This reflects the maximum packet assembly capability actually demonstrated by the source in this session.

[0085] Secondly, the gateway retrieves the historical maximum load baseline associated with the source device. Specifically, the gateway searches its local non-volatile storage (such as Flash or a database) to query the historical maximum load baseline associated with the source device's Internet Protocol IP address. It should be understood that if a valid record exists locally, the historical maximum load benchmark will be read directly. If no record exists locally (e.g., during a system cold start or the first connection of a new device), the preset default load baseline will be read. As a temporary historical maximum load benchmark .in, Set to 240 bytes (based on the typical minimum APDU length specified in the IEC60870-5-104 protocol).

[0086] Finally, the maximum value between the current session's peak load and the historical maximum load benchmark is determined, and this maximum value is used as the benchmark value for the effective payload length corresponding to the transmitted message sequence. Specifically, to eliminate logical vulnerabilities caused by a single observation source, the gateway uses the current observed peak load, i.e., the current session's peak load, as the benchmark value. Compared with historical benchmarks, i.e., historical maximum load benchmarks The larger value is selected as the final physical benchmark for this testing process. At this time there is .

[0087] Furthermore, to prevent historical benchmark overshoot lock-in (deadlock) caused by equipment replacement or network environment changes, this embodiment introduces a benchmark aging mechanism. Specifically, the gateway stores the historical maximum load benchmark. Set an aging period (e.g., N sessions (e.g., 100 sessions) or T hours (e.g., 24 hours)). If all continuously monitored data within the aging period... All are less than the historical maximum load benchmark. The preset percentage (e.g., 80%) is used to determine the current historical maximum load benchmark. It has become invalid; the gateway has reset it to the default load baseline. Or the maximum within the current period This allows for dynamic adaptive downward adjustment of the judgment benchmark.

[0088] In the process of determining the payload length baseline value, a historical baseline is introduced. When the current observed peak value of the current session is less than this historical baseline, the final physical baseline is corrected to this historical baseline to determine that the device has the ability to send the historical baseline bytes. The segmentation of the current observed peak value is not physically forced, but manually divided. This mechanism ensures the objectivity and anti-circumvention properties of the baseline, and ensures the accuracy of the final physical baseline as a global constant for spatial dimension verification of the message.

[0089] Step S2012: Determine the sum of the payload lengths in the message attribute information of any transmission message in the transmission message sequence and its adjacent transmission messages. If the sum is greater than the payload length benchmark value, it is determined that the corresponding transmission message does not meet the spatial merging condition, and other dimension verifications are stopped; otherwise, it is determined that the corresponding transmission message meets the spatial merging condition.

[0090] Verify whether adjacent transmitted messages in the transmitted message sequence are physically feasible to be merged. If the length of the merged two adjacent transmitted messages exceeds the physical carrying capacity of the device (i.e., the effective payload length baseline value), then the segmentation of the two adjacent transmitted messages is considered a forced segmentation limited by MTU or memory, which is a physically compliant behavior.

[0091] In one possible implementation, the gateway reads the first segment of the transmitted message sequence. The first transmission message and the first Message attribute vector of a transmitted message and The effective load length component and The gateway calculates the total virtual load after merging the two. Subsequently, the total virtual payload was... Compared with the effective payload length reference value Compare: If the total virtual load This indicates that even if the source intentionally merges the first... The first transmission message and the first The transmitted message will also be forcibly segmented if it exceeds the physical capacity of the current session. The first transmission message and the first If the segmentation behavior corresponding to the transmitted message is determined to be a suspected physically restricted segmentation, then the corresponding segmentation behavior is determined to be... The first transmitted message does not meet the spatial merging condition, so the gateway terminates the transmission of the current message. Each transmitted message undergoes further review before proceeding directly to the next iteration (i.e., ...). If the total virtual load is This indicates that in sending the first When transmitting a message, the physical buffer at the source end (with) (For reference only) There is still enough space to accommodate the first The first transmitted message. At this time, the first... The first transmission message and the first If the transmitted message has a physical basis for merging, then the corresponding message is determined to be... If a transmitted message meets the spatial merging condition, the gateway will pass it to the next level dimension for verification.

[0092] It should be understood that, due to the first If the first transmission message does not have a subsequent transmission message, then directly transmit the first transmission message. The spatial dimension verification result of the transmitted message is used as the first... Verification results of the spatial dimension of each transmitted message.

[0093] Step S202: Based on the protocol type identifier and logical address index in the message attribute information, perform logical dimension verification on the transmitted messages in the transmitted message sequence to determine whether the logical merging condition is met.

[0094] The protocol type identifier in the message attribute information reflects the protocol type corresponding to the transmitted message, and the logical address index reflects the logical address corresponding to the transmitted message. Based on the protocol type identifier and logical address index in the message attribute information, it is verified whether adjacent transmitted messages in the transmitted message sequence belong to the same data block in terms of business logic. If adjacent transmitted messages correspond to non-contiguous memory addresses or different service types at the source end, then packet segmentation is a necessary requirement of business logic and is a logically compliant behavior. Otherwise, it indicates that the current message segmentation behavior is not logically necessary and has suspicious characteristics of manual intervention.

[0095] In one possible implementation, logical dimension verification is performed on the transmitted messages in the transmitted message sequence to determine whether the logical merging condition is met. This includes: determining whether the protocol type identifier in the message attribute information of any transmitted message in the transmitted message sequence is the same as that in the subsequent transmitted message; if the protocol type identifiers are different, and the end logical address index in the message attribute information of any transmitted message in the transmitted message sequence is adjacent to the start logical address index in the message attribute information of the subsequent transmitted message, then the logical merging condition is not met; otherwise, the logical merging condition is met.

[0096] Specifically, for continuous transmission scenarios of a single type of data, the gateway reads the first segment of the transmission message sequence. The first transmission message and the first Message attribute vector of a transmitted message and Protocol type identifier and judge and Are they equal? ​​If This indicates the first The first transmission message and the first If the transmitted messages belong to different telecommunication or telemetry types and must be transmitted in packets, then the first packet is determined to be... The transmitted message does not meet the logical merging condition, and the process for merging the first message is terminated. Each transmitted message is examined; otherwise, further logical dimension verification based on the logical address index is required.

[0097] If the first in the transmission message sequence The first transmission message and the first The protocol type in the message attribute vector of each transmitted message is consistent, that is... Based on the first Message attribute vector of a transmitted message End logical address index in and the The start logical address index in the message attribute vector of a transmitted message Gateway calculation The transmitted message and the first Logical address gap between each transmitted message .like This indicates that the data carried by these two messages corresponds to a non-contiguous logical address space at the source (e.g., a jump from address 100 to address 200). Readdressing and packet resegmentation at the source are normal business operations, and in this case, the first message is determined to be... The gateway terminates processing of the current transmitted message because the logical merging condition is not met. Each transmitted message undergoes further review before proceeding directly to the next iteration (i.e., ...). ).like This indicates the first The first data point of the transmitted message is logically adjacent to the first... The last data point of the transmitted message, these two data segments are strictly continuous in the source's service memory mapping. Combined with the spatial verification results, this indicates that the current message is in a state of "sufficient physical space" and "contiguous logical addresses" yet it is being cut off and sent. This suggests that this segmentation behavior is neither physically enforced nor logically necessary, exhibiting suspicious characteristics of human intervention. Therefore, the gateway determines that the corresponding data point of the transmitted message is... Each transmitted message that meets the logical merging condition should be passed to the next level of dimension for verification.

[0098] It should be understood that, due to the first If the first transmission message does not have a subsequent transmission message, then directly transmit the first transmission message. The above logical dimension verification results of the transmitted message are used as the first... The logical dimension verification result of each transmitted message.

[0099] Step S203: Based on the gateway receiving timestamp in the message attribute information, perform time-series verification on the transmitted messages in the transmitted message sequence to determine whether the fast transmission condition is met.

[0100] If the source device sends a message and then waits a considerable amount of time before sending the next message, it indicates that the next message was not ready when the previous message was sent, which is generally compliant with regulations. Conversely, if the next message arrives at the mesh immediately after the previous one, it means the next message was already ready, which is consistent with the "looping" characteristic of software simulators. Since the gateway reception timestamp in the message attribute information reflects the system time when the gateway network interface card received the message, the transmission message sequence is verified based on the gateway reception timestamp in the message attribute information.

[0101] In one possible implementation, the transmission messages in the transmission message sequence are verified in terms of timing to determine whether the fast transmission condition is met. This includes: determining the message arrival time interval based on the gateway reception timestamp in the message attribute information of any transmission message in the transmission message sequence and its subsequent transmission message; if the message arrival time interval is greater than a preset fast transmission judgment threshold, it is determined that the fast transmission condition is not met, otherwise it is determined that the fast transmission condition is met.

[0102] Specifically, the gateway reads the first segment of the transmitted message sequence. The first transmission message and the first Message attribute vector of a transmitted message and Gateway Receive Timestamp And calculate the message arrival time interval. Subsequently, the gateway introduces a preset fast transmission determination threshold. The threshold Defined as the sum of the minimum hardware transmission interval of the source device, the physical transmission latency of the network path, and the lower limit of network jitter, its specific value needs to be determined through benchmark testing during the network deployment phase. In this embodiment, it is set as follows: The range of values ​​is (i.e., 2ms to 5ms).

[0103] The gateway will calculate the message arrival time interval. With this fast sending determination threshold Compare and execute the following decision: If This indicates that the source has completed sending the first... After transmitting the first message, a significant waiting time ensued before the second message was sent. The first transmitted message, which usually means that subsequent messages are transmitted in the second transmission. If a transmission message is sent before it is ready (e.g., during AD conversion), it falls under the category of generation waiting for truncation, which is a compliant behavior. Therefore, the first transmission message is judged to be... The transmitted message does not meet the conditions for fast transmission. If This indicates that the message length is small, and the first... The first transmission message almost immediately followed the second The first transmission message arrives at the gateway at an interval lower than the natural latency limit of the physical hardware and network, indicating that the message data was already ready and the transmission process was not constrained by the hardware acquisition rhythm. At this point, considering the previous verification results, it is confirmed that the current message segmentation behavior simultaneously satisfies three conditions: "buffer not full (space can be combined)," "address contiguous (logically valid)," and "extremely fast transmission (data already ready)," yet the source still performs segmentation. This behavior violates the physical characteristics of "interrupt aggregation" in embedded systems and conforms to the characteristics of "looping transmission" in software simulators. Therefore, the first... Each transmitted message meets the conditions for fast transmission.

[0104] It should be understood that, due to the first If the first transmission message does not have a subsequent transmission message, then directly transmit the first transmission message. The aforementioned time-series verification result of the transmitted message is used as the first... The time-series verification results of each transmitted message.

[0105] Step S204: The transmission messages in the transmission message sequence that simultaneously satisfy the spatial merging condition, the logical merging condition, and the fast transmission condition are designated as artificially abnormal segmented messages in the transmission message sequence.

[0106] In any transmitted message sequence corresponding to the current session, if the above three-dimensional conditions (spatial, logical, and temporal) are simultaneously satisfied, the gateway determines that the corresponding transmitted message is a manually abnormally segmented message, that is, the segmentation behavior of the message has a high degree of human intervention characteristics, and the gateway indexes the manually abnormally segmented message. Add to the manual segmentation message index set This serves as a direct basis for subsequent auditing and defense.

[0107] Gateway for caching All adjacent transmitted messages in the middle ( to By performing a traversal verification, all manually aberrant segmented messages in the transmission message sequence corresponding to the current session can be identified, and a set of manually segmented message indexes can be obtained. Index corresponding to all manually anomaly segmented messages.

[0108] Step S300: Based on the proportion of manually anomaly segmented messages in the transmitted message sequence, determine the anomaly monitoring result corresponding to the current session.

[0109] The percentage of manually segmented packets in the transmitted packet sequence is obtained. This percentage serves as a quantitative indicator reflecting the degree of anomaly at the source, accurately characterizing the probability density of unnecessary manual segmentation in the current session's data stream. A higher probability density indicates a higher likelihood of anomalies in the current session. Therefore, based on this percentage, the anomaly monitoring result for the current session is determined.

[0110] Specifically, the gateway calculates the manually segmented message index set. The number of indexes corresponding to all manually anomaly segmented messages in the middle ) and cache Total number of all messages stored in ratio and the ratio As a percentage of manually segmented messages Compared to judging from a single frame, this statistical indicator based on the entire sequence can further smooth out the interference caused by occasional network jitter, providing robust quantitative support for subsequent tiered defense decisions.

[0111] To balance the security and availability of industrial control systems, based on the determined proportion of manually segmented messages... A tiered response mechanism is used to monitor anomalies in the current session. This mechanism can block high-confidence simulated attacks and audit suspicious traffic without easily interrupting business operations.

[0112] In one possible implementation, determining the anomaly monitoring result corresponding to the current session includes: if the proportion of manually anomaly segmented packets in the transmission packet sequence is less than or equal to the low sensitivity threshold, then the segmentation behavior of the current session is deemed legal, and the transmission packets in the transmission packet sequence are forwarded to the destination master station in order; if the proportion of manually anomaly segmented packets in the transmission packet sequence is greater than the low sensitivity threshold but less than or equal to the high sensitivity threshold, then the segmentation behavior of the current session is deemed suspicious, and the gateway is controlled to allow the transmission packet sequence to proceed, and a security audit log is generated; if the proportion of manually anomaly segmented packets in the transmission packet sequence is greater than the high sensitivity threshold, then the segmentation behavior of the current session is deemed abnormal, and defensive actions are performed.

[0113] Specifically, the gateway introduces a preset low-sensitivity threshold. (For example, set to 5%) and a high sensitivity threshold (For example, set to 20%). Based on the calculated percentage of manually segmented messages. The gateway executes the following hierarchical strategy:

[0114] 1. The proportion of manually segmented messages in the transmitted message sequence is the percentage of manually segmented messages. Less than or equal to the low sensitivity threshold That is, When this occurs, it indicates that the segmentation behavior of the current session is mainly driven by physical and logical constraints. Occasional abnormal segmentation may originate from network retransmissions or driver jitter, which is within the normal range. The gateway determines that the source is a legitimate physical device and that the segmentation behavior of the current session is legitimate. At this point, the general call response message sequence buffer is released. The locked state, and the cached Each message is forwarded sequentially to the destination master station and enters the baseline update process. 2. The proportion of manually segmented messages in the transmitted message sequence is the proportion of manually segmented messages. Greater than the low sensitivity threshold And less than or equal to the high sensitivity threshold That is, This indicates that there is a certain proportion of unnecessary segmentation in the current session, but it has not yet reached the level of a confirmed attack. To ensure business continuity, the gateway determines that the source device is a legitimate physical device and considers the segmentation behavior of the current session suspicious. The gateway allows the data to pass, but at the same time generates a security audit log, recording the source IP and the percentage of abnormalities. The system generates an index of abnormal messages and uploads the generated logs to the network information security system's management center or local storage for subsequent investigation by operations and maintenance personnel. 3. The percentage of manually segmented abnormal messages in the transmitted message sequence is the percentage of manually segmented messages. Greater than the high sensitivity threshold That is, This indicates that there is significant and continuous unnecessary segmentation behavior in the current session, violating the interrupt aggregation characteristics of embedded devices, and is highly likely an attack launched by a software emulator. The gateway (which is a security gateway or industrial firewall with deep packet inspection (DPI) and proactive defense capabilities) determines that the segmentation behavior of the current session is abnormal, identifies the source device as a simulated attack source, and immediately performs the following defensive actions:

[0115] Cache cleaning: Immediately destroy the cache. All registration data is processed without any forwarding, cutting off the channel for injecting false data.

[0116] Session blocking: Inject Transmission Control Protocol (TCP) Reset (RST) messages into the network protocol stack to force a disconnection, and issue temporary blocking rules (such as blocking for 300 seconds) to the firewall module for the source IP.

[0117] Evidence collection records: Generate high-risk alarm logs and upload them to the network information security system management center or local storage for system-level situational awareness use. At the same time, permanently store the manually segmented packet index set. The details of the first abnormal message in the message serve as evidence.

[0118] In one possible implementation, the method further includes: if the segmentation behavior of the current session is determined to be legal, updating the historical maximum load reference associated with the source device using the load peak value of the current session determined based on the transmitted message sequence.

[0119] Specifically, when the source device is determined to be a legitimate physical device, meaning the segmentation behavior of the current session is legitimate, the gateway uses the actual observation data of this session to optimize its local detection model. This process includes: to prevent logical deadlock, the gateway uses the peak load of the current session. The historical data is updated using the maximum packet length actually observed in this instance; that is, the gateway reads the historical maximum load benchmark stored locally. And perform a "greedy update" operation on the historical maximum load benchmark. To update, the update method is as follows: and update the historical maximum load benchmark. Write back to non-volatile memory.

[0120] It should be understood that the peak load of the current session is only utilized if the anomaly detection result of the current session is "legitimate". Historical maximum load benchmark Updates will be performed, but if the baseline is deemed suspicious or abnormal, updates will be prohibited.

[0121] For example, if the current session load peak Original historical maximum load benchmark Updated historical maximum load benchmark The threshold has been raised to 250. This means the system has confirmed that the source device has the capability to send 250 bytes, and the next detection will use 250 bytes as a more stringent criterion. If the current session load peak... (The equipment was shipped in a small package), original historical maximum load benchmark. Updated historical maximum load benchmark The baseline will remain unchanged at 240, ensuring that it will not be "degraded" due to occasional small packets sent by the device.

[0122] Through the aforementioned historical maximum load benchmark update mechanism, when the source device upgrades its firmware to optimize memory management, or when the network path MTU value increases, resulting in enhanced transmission capacity, the defense system can automatically and synchronously raise the judgment benchmark, realizing the adaptive evolution of defense capabilities. This ensures that the detection model always fits the latest physical capability boundaries of the device, thereby improving monitoring accuracy.

[0123] Based on the same inventive concept, embodiments of the present invention also provide a data anti-tampering transmission system for a network information security system. The system includes: a memory, a processor, and computer program code stored in the memory and running on the processor. When the processor executes the computer program code, the system can execute any of the data anti-tampering transmission methods for a network information security system described above.

[0124] In this embodiment of the invention, the system can be divided into functional modules according to the above method example. For example, each module can correspond to a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware. It should be noted that the module division in this embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0125] Based on the same inventive concept, embodiments of the present invention also provide a computer program product, which includes: computer program code, which, when run on a computer, causes the computer to execute any of the data anti-tampering transmission methods of the network information security system described above.

[0126] Based on the same inventive concept, embodiments of the present invention also provide a computer-readable storage medium storing computer program code, which, when executed on a computer, causes the computer to perform any of the data anti-tampering transmission methods of the network information security system described above.

[0127] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for preventing data tampering in a network information security system, characterized in that, Includes the following steps: Collect the transmission message sequence corresponding to the current session when the source device responds to a specific protocol, and obtain the message attribute information of each transmission message in the transmission message sequence that can reflect the data sending characteristics of the source end; Based on the message attribute information, multi-dimensional condition verification is performed on each transmitted message in the transmitted message sequence to filter out manually abnormal segmented messages in the transmitted message sequence. The multidimensional conditional verification includes at least two of the following: spatial dimension verification, logical dimension verification, and temporal dimension verification. Based on the proportion of manually anomaly segmented messages in the transmitted message sequence, the anomaly monitoring result corresponding to the current session is determined. Multi-dimensional conditional verification is performed on each transmitted message in the transmitted message sequence to filter out manually anomalous segmented messages in the transmitted message sequence, including: Based on the payload length in the message attribute information, spatial dimension verification is performed on the transmitted messages in the transmitted message sequence to determine whether the spatial merging condition is met. Based on the protocol type identifier and logical address index in the message attribute information, the transmitted messages in the transmitted message sequence are logically verified to determine whether the logical merging condition is met. Based on the gateway receiving timestamp in the message attribute information, the time sequence dimension verification is performed on the transmitted messages in the transmitted message sequence to determine whether the fast transmission condition is met. Transmission messages in the transmission message sequence that simultaneously satisfy the spatial merging condition, the logical merging condition, and the fast transmission condition are designated as artificially abnormal segmented messages in the transmission message sequence. Spatial dimension verification is performed on the transmitted messages in the transmitted message sequence to determine whether the spatial merging condition is met, including: Based on the payload length in the message attribute information of all transmitted messages in the transmitted message sequence, determine the baseline value of the payload length corresponding to the transmitted message sequence. The sum of the payload lengths in the message attribute information of any transmission message in the transmission message sequence and its adjacent transmission messages is determined. If the sum is greater than the payload length reference value, the corresponding transmission message is determined not to meet the spatial merging condition, and other dimension verification is stopped; otherwise, the corresponding transmission message is determined to meet the spatial merging condition. Logical dimension verification is performed on the transmitted messages in the transmitted message sequence to determine whether the logical merging conditions are met, including: Determine whether the protocol type identifier in the message attribute information of any transmission message in the transmission message sequence is the same as that in the subsequent transmission message; If the protocol type identifiers are different, and the end logical address index in the message attribute information of any message in the transmission message sequence is adjacent to the start logical address index in the message attribute information of its successor message, then the corresponding transmission message is determined not to meet the logical merging condition; otherwise, the corresponding transmission message is determined to meet the logical merging condition. Perform time-series verification on the transmitted messages in the transmitted message sequence to determine whether the fast transmission condition is met, including: The message arrival time interval is determined based on the gateway receiving timestamp in the message attribute information of any message in the message sequence and its subsequent message. If the message arrival time interval is greater than the preset fast transmission judgment threshold, the corresponding transmission message is determined not to meet the fast transmission condition; otherwise, the corresponding transmission message is determined to meet the fast transmission condition.

2. The data anti-tampering transmission method for a network information security system according to claim 1, characterized in that, Collect the sequence of transmitted messages corresponding to the current session when the source device responds to a specific protocol, including: When the gateway detects that the source device has received the master station's general call command, it stores the response messages sent by the source device in sequence. When the collection termination condition is detected, the gateway stops storing the response messages sent by the source device, thereby obtaining the transmission message sequence corresponding to the current session when the source device responds to a specific protocol.

3. The data anti-tampering transmission method for a network information security system according to claim 1, characterized in that, Determining the reference value of the payload length corresponding to the transmitted message sequence includes: For the message attribute information of all transmitted messages in the transmitted message sequence, the maximum effective payload length among the effective payload lengths of all message attribute information is determined as the payload peak value of the current session; Obtain the historical maximum load reference associated with the source device; Determine the maximum value between the current session's peak load and the historical maximum load benchmark, and use the maximum value as the effective payload length benchmark value corresponding to the transmitted message sequence.

4. The data anti-tampering transmission method for a network information security system according to claim 1, characterized in that, Determine the anomaly monitoring results corresponding to the current session, including: If the proportion of artificially abnormal segmented messages in the transmission message sequence is less than or equal to the low sensitivity threshold, the segmentation behavior of the current session is determined to be legal, and the control mesh forwards the transmission messages in the transmission message sequence to the destination master station in order. If the proportion of artificially abnormal segmented messages in the transmitted message sequence is greater than the low sensitivity threshold and less than or equal to the high sensitivity threshold, the segmentation behavior of the current session is judged to be suspicious, and the gateway is controlled to allow the transmitted message sequence to pass, and a security audit log is generated. If the proportion of artificially generated abnormal segmented messages in the transmitted message sequence is greater than the high sensitivity threshold, the segmentation behavior of the current session is determined to be abnormal, and the gateway is controlled to perform defensive actions.

5. The data anti-tampering transmission method for a network information security system according to claim 1, characterized in that, The method further includes: If the segmentation behavior of the current session is determined to be legal, the historical maximum load benchmark associated with the source device is updated using the load peak value of the current session determined based on the transmitted message sequence.

6. The data anti-tampering transmission method for a network information security system according to claim 1, characterized in that, Before obtaining the message attribute information of each transmitted message in the transmitted message sequence that reflects the data transmission characteristics of the source end, the method further includes: The number of messages in the transmitted message sequence is counted; Only when the number of messages is greater than or equal to a set threshold, message attribute information that reflects the data sending characteristics of the source end is obtained for each transmitted message in the transmitted message sequence.

Images