Script program detection method and device for industrial control system

Abstract

The invention discloses a script program detection method and device for an industrial control system. The method comprises the following steps: acquiring a script feature library of the industrial control system, wherein each script in the script feature library comprises a core feature layer, an auxiliary feature layer and a behavior feature layer; for the target script to be detected in the current cycle, determining the target script as a high-frequency script or a low-frequency script based on the number of execution times of the target script in an adjacent historical preset time period; when the target script is a low-frequency script, adopting a first strategy; when the target script is a high-frequency script, if the target script is executed for the first time in the current period, adopting a first strategy, and if not, adopting a second strategy; the first strategy is to perform comprehensive static detection and dynamic detection on the target script in sequence; the second strategy is to sequentially perform partial static detection and dynamic detection on the target script; the comprehensive static detection comprises core feature layer matching, auxiliary feature layer matching and script feature fuzzy matching; the partial static detection comprises core feature layer matching; the dynamic detection comprises script blood relationship detection and behavior feature layer matching. The malicious script can be effectively identified, and the detection precision is improved.

Description

Technical Field

[0001] This invention relates to the field of system security technology, and in particular to a method and apparatus for detecting script programs in industrial control systems. Background Technology

[0002] Scripting programs (such as Shell scripts, Python scripts, and industrial control system configuration scripts) are lightweight and flexible, enabling rapid implementation of functions such as industrial control equipment configuration and system maintenance automation. This convenience makes scripts a common tool for data interaction and equipment management in industrial control scenarios. However, it is precisely this flexibility and ease of writing that allows malicious scripts (such as malicious configuration scripts that tamper with equipment parameters or maintenance scripts that steal data) to infiltrate terminals by disguising themselves as legitimate scripts, becoming a potential carrier for the spread of security risks in industrial control systems.

[0003] Therefore, if scripts in the terminal cannot be effectively identified and controlled, the easy execution of uncertified script files can easily lead to problems such as abnormal parameters of industrial control equipment and data leakage, and may even affect the stable operation of the entire industrial control system, causing serious consequences such as production interruption. However, existing script detection methods cannot effectively identify malicious scripts, and their detection accuracy is poor.

[0004] Therefore, there is an urgent need for a script program detection method and device for industrial control systems to solve the above problems. Summary of the Invention

[0005] This invention provides a method and apparatus for detecting script programs in industrial control systems, which can effectively identify malicious scripts, improve detection accuracy, and protect system security. The technical solution is as follows: On the one hand, a method for detecting script programs in industrial control systems is provided, the method comprising: Obtain the script feature library of the industrial control system. Each script in the script feature library includes a core feature layer, an auxiliary feature layer, and a behavior feature layer. For the target script to be detected in the current week, it is determined as a high-frequency script or a low-frequency script based on the number of times it is executed in the nearby historical preset time period; When the target script is a low-frequency script, the first strategy is used for risk detection. When the target script is a high-frequency script, if it is the first execution of the current cycle, the first strategy is used for risk detection; otherwise, the second strategy is used for risk detection. The first strategy involves performing comprehensive static detection and dynamic detection on the target script's execution data in sequence. The second strategy involves performing partial static detection and dynamic detection on the target script's execution data in sequence. The comprehensive static detection includes core feature layer matching, auxiliary feature layer matching, and script feature fuzzy matching. The partial static detection includes core feature layer matching. The dynamic detection includes script lineage detection and behavioral feature layer matching.

[0006] On the other hand, a script program detection device for industrial control systems is provided, the device comprising: The acquisition unit is used to acquire the script feature library of the industrial control system. Each script in the script feature library includes a core feature layer, an auxiliary feature layer, and a behavior feature layer. The determination unit is used to determine whether a target script to be detected in the current week is a high-frequency script or a low-frequency script based on the number of times it is executed in the nearby historical preset time period. The first detection unit is used to perform risk detection using the first strategy when the target script is a low-frequency script; The second detection unit is used to perform risk detection using the first strategy when the target script is a high-frequency script and is the first execution of the current cycle; otherwise, it performs risk detection using the second strategy. The first strategy involves performing comprehensive static detection and dynamic detection on the running data of the target script in sequence. The second strategy involves performing partial static detection and dynamic detection on the running data of the target script in sequence. The comprehensive static detection includes core feature layer matching, auxiliary feature layer matching, and script feature fuzzy matching. The partial static detection includes core feature layer matching. The dynamic detection includes script lineage detection and behavioral feature layer matching.

[0007] On the other hand, a computer device is provided, the computer device including a memory and a processor, the memory for storing computer programs, and the processor for executing the computer programs stored in the memory to implement the steps of the script program detection method for industrial control systems described above.

[0008] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the steps of the script program detection method for industrial control systems described above.

[0009] On the other hand, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the script program detection method for industrial control systems described above.

[0010] This invention provides a method and apparatus for detecting script programs in industrial control systems. First, during static detection, the detection results are comprehensively considered, taking into account core feature layer matching, auxiliary feature layer matching, and fuzzy script feature matching, resulting in more comprehensive detection and effectively preventing malicious script execution. Second, during dynamic detection, the results of script lineage detection and behavioral feature layer matching are comprehensively considered, enabling real-time dynamic detection during script execution. This allows for the identification of disguised malicious scripts and timely implementation of defensive measures, improving risk handling efficiency. Therefore, this application can reduce false positives and false negatives in script detection, improve the accuracy of script detection, reduce script maintenance costs, and is applicable to more flexible scenarios. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart of a script program detection method for industrial control systems provided by an embodiment of the present invention; Figure 2 This is a structural diagram of a script program detection device for industrial control systems provided in an embodiment of the present invention; Figure 3 This is a hardware architecture diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0014] The specific implementation of the method in this application is described in detail below.

[0015] Please refer to Figure 1 The present invention provides a method for detecting script programs in industrial control systems, the method comprising: Step 100: Obtain the script feature library of the industrial control system. Each script in the script feature library includes a core feature layer, an auxiliary feature layer, and a behavior feature layer. Step 102: For the target script to be detected in the current week, determine it as a high-frequency script or a low-frequency script based on the number of times it was executed in the nearby historical preset time period. Step 104: When the target script is a low-frequency script, the first strategy is used for risk detection; Step 106: When the target script is a high-frequency script, if it is the first execution of the current cycle, the first strategy is used for risk detection; otherwise, the second strategy is used for risk detection. The first strategy is to perform comprehensive static detection and dynamic detection on the running data of the target script in sequence. The second strategy is to perform partial static detection and dynamic detection on the running data of the target script in sequence. Comprehensive static detection includes core feature layer matching, auxiliary feature layer matching, and script feature fuzzy matching. Partial static detection includes core feature layer matching. Dynamic detection includes script lineage detection and behavioral feature layer matching.

[0016] In this embodiment, firstly, during static detection, the detection results are comprehensively considered from core feature layer matching, auxiliary feature layer matching, and fuzzy script feature matching, resulting in more comprehensive detection and effectively preventing malicious script execution. Secondly, during dynamic detection, the results of script lineage detection and behavioral feature layer matching are comprehensively considered, enabling real-time dynamic detection during script execution to identify disguised malicious scripts and promptly implement defensive measures, improving risk handling efficiency. Therefore, this application can reduce false positives and false negatives in script detection, improve the accuracy of script detection, and is applicable to more flexible scenarios.

[0017] The following description Figure 1 The execution method for each step is shown.

[0018] First, regarding step 100: The core feature layer includes the hash values ​​of the script file and the hash values ​​of key code segments; The auxiliary feature layer includes script function identifiers and version number rules; The behavioral characteristics layer includes resource call baseline, interface access baseline, and behavioral timing baseline.

[0019] For step 102, for the target script to be detected in the current week, based on its frequency of occurrence in the nearby historical preset time period, it is divided into high-frequency scripts or low-frequency scripts, including: If the number of times a target script appears in a nearby historical preset time period is less than a preset number, then the target script is identified as a low-frequency script. If the number of times a target script appears in a nearby historical preset time period is not less than a preset number, then the target script is identified as a high-frequency script.

[0020] In this step, the preset time period for adjacent history is determined according to the user's actual requirements. For example, the preset time period can be one hour, one day, or from power-on to power-off, etc., and this application does not make specific limitations. In addition, the preset number of times is also determined according to the user's requirements. For example, when the preset time period is one hour and the preset number of times is 3, then if the target script appears less than 3 times in the adjacent hour, it is identified as a low-frequency script, and vice versa.

[0021] For high-frequency scripts, a full static check is performed only on the first execution, and only partial static checks are performed on subsequent executions. This can greatly reduce the resource consumption of repeated checks and improve detection efficiency while ensuring detection accuracy.

[0022] In addition, for high-frequency scripts, a script feature preloading mechanism is adopted to preload the features of high-frequency scripts (such as daily scheduled maintenance scripts) into the local cache of the terminal. During detection, the cached data is directly read for feature matching. This reduces the response time from "seconds" to "milliseconds", adapting to the low latency requirements of industrial control scenarios.

[0023] Regarding steps 104 and 106: In some implementations, the process of performing a comprehensive static analysis of the target script's runtime data is as follows: A1 determines whether the script hash value and key code segment hash value in the target script's runtime data match the script hash value and key code segment hash value in the corresponding core feature layer; if they match, dynamic detection is performed on the target script; if they do not match, A2 is executed. A2 determines whether the script function identifier and version number rules in the target script's runtime data match the script function identifier and version number rules in the corresponding auxiliary feature layer; if they match, dynamic detection is performed on the target script; if they do not match, A3 is executed. A3, based on the preset fuzzy matching rules for script features, calculates the fuzzy difference rate of the target script and determines whether its fuzzy difference rate is not greater than the preset fuzzy difference rate threshold; if so, dynamic detection is performed on the target script; if not, the target script is not allowed to be executed.

[0024] In this embodiment, the fuzzy difference rate threshold is preferably <= 5%. Of course, this threshold can be modified manually and can be determined according to user requirements. No specific limitation is made here.

[0025] In some implementations, the process of performing partial static analysis on the runtime data of the target script is as follows: Determine whether the script hash value and key code segment hash value in the target script's runtime data match the script hash value and key code segment hash value in the corresponding core feature layer; if they match, perform dynamic detection on the target script; if they do not match, do not allow the target script to execute.

[0026] In some implementations, the process of dynamically detecting the target script is as follows: B1 determines whether the target script calls an unfamiliar script; if so, it determines whether there is a lineage relationship between the target script and the unfamiliar script. If there is, it executes B2; if not, it performs a comprehensive static check on the unfamiliar script. If the check passes, it executes B2; if it fails, it does not allow the target script to execute. B2, perform behavioral feature layer matching on the target script, calculate the credibility score of the target script based on the matching results, and determine the detection result based on the credibility score.

[0027] In step B1, lineage detection can defend against attack scenarios where the target script is hijacked or abused. For example, an attacker might use a target script (i.e., a legitimate script) as a springboard: first, they might use a legitimate script trusted by the system (such as a commonly used operations and maintenance script), and then insert code into the script's execution logic to download, call, or generate a malicious script. Another example is a "white-on-black" attack: the malicious code itself doesn't appear directly, but is loaded and executed as a "submodule" of a legitimate script. In summary, this embodiment, through lineage detection, extends protection from the static trust of a single script file to the dynamic trust of the script execution chain, effectively preventing attackers from exploiting vulnerabilities in the trust chain. Static detection prevents "black files," while dynamic lineage detection prevents "black chains."

[0028] Furthermore, the process of performing comprehensive static analysis on unfamiliar scripts is the same as steps A1-A3, and will not be repeated here.

[0029] For step B2, the specific process is as follows: Step C1: Perform resource call baseline detection on the target script to determine whether the CPU and memory usage of the target script exceeds the preset range of the resource call baseline record. If yes, it is recorded as failing; otherwise, it is recorded as passing. Step C2: Perform interface access baseline detection on the target script to determine whether the target script attempts to access an interface outside the list of device interfaces / IPs allowed by the interface access baseline; if yes, it is marked as failed; if no, it is marked as passed. Step C3: Perform behavioral timing baseline detection on the target script to determine whether the behavior sequence of the target script conforms to the order specified by the behavioral timing baseline; if yes, it is recorded as passed; otherwise, it is recorded as failed. Step C4: Based on the resource call baseline detection results, interface access baseline detection results, behavior time sequence baseline detection results, and the total number of times the target script was executed in the adjacent historical preset time period, determine its credibility score, and determine the detection result based on the credibility score.

[0030] In step C4, the credibility score is calculated using the following formula: In the formula, Assess credibility. , The first The trust level weight and result value corresponding to each test result; This is a constant, preferably 0.05, and can be adjusted according to user requirements; This represents the total number of times the target script was executed within a nearby historical preset time period.

[0031] In the above formula, =1~3, , , These are the trust level weights for resource call baseline detection results, interface access baseline detection results, and behavioral time-series baseline detection results, respectively. The specific trust level weights are determined according to user requirements, for example... , , etc., without specific limitations here. , , These are the result values ​​for the resource call baseline detection result, the interface access baseline detection result, and the behavior timing baseline detection result, respectively. The specific result values ​​are determined according to user requirements. For example, a result of 1 is used when the test passes and a result of 2 is used when the test fails. No specific restrictions are imposed here.

[0032] Understandably, the higher the credibility score, the higher the credibility of the target script, and the lower the probability that it is a malicious script.

[0033] Therefore, when determining the detection result based on the credibility score, the credibility score can be divided into multiple levels in descending order of credibility score; among them, the first level is normal, which allows the execution of the target script and updates it to the whitelist library.

[0034] The second level is low risk, which allows the execution of the target script, logs it, and pops up a reminder. The third level is medium risk; the execution of the target script will be suspended and manually reviewed. Level 4 is high risk; the process will be terminated, the target script will be locked, and a system alert will be issued.

[0035] In addition, a scoring threshold can be set. The credibility score of the first level is higher than the scoring threshold. The scoring threshold is determined according to user requirements. For example, when using a full score of 10, the scoring threshold can be 8. Furthermore, when updating the target script, it also includes synchronizing it to the whitelist library of all associated industrial control terminals, achieving "one-time detection, full terminal update" and avoiding duplicate operations.

[0036] In summary, this step can be combined with script-based tiered processing and automatic whitelist updates to form a closed-loop process and improve the efficiency of risk management.

[0037] like Figure 2 , Figure 3 As shown, this embodiment of the invention provides a script program detection device for industrial control systems. The device embodiment can be implemented through software, hardware, or a combination of both. From a hardware perspective, such as... Figure 2 The diagram shown is a hardware architecture diagram of a computing device for detecting script programs in an industrial control system, provided by an embodiment of the present invention. (Except for...) Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the computing device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing packets. Taking software implementation as an example, such as... Figure 3 As shown, a device in a logical sense is formed by the CPU of the computing device in which it is located reading the corresponding computer program from the non-volatile memory into the memory for execution.

[0038] Please refer to Figure 3 This invention provides a script program detection device for industrial control systems, the device comprising: The acquisition unit 300 is used to acquire the script feature library of the industrial control system. Each script in the script feature library includes a core feature layer, an auxiliary feature layer, and a behavior feature layer. The determining unit 302 is used to determine whether a target script to be detected in the current week is a high-frequency script or a low-frequency script based on the number of times it is executed in a nearby historical preset time period. The first detection unit 304 is used to perform risk detection using a first strategy when the target script is a low-frequency script; The second detection unit 306 is used to perform risk detection using a first strategy when the target script is a high-frequency script and is the first execution of the current cycle; otherwise, it performs risk detection using a second strategy. The first strategy is to perform comprehensive static detection and dynamic detection on the running data of the target script in sequence. The second strategy is to perform partial static detection and dynamic detection on the running data of the target script in sequence. Comprehensive static detection includes core feature layer matching, auxiliary feature layer matching, and script feature fuzzy matching. Partial static detection includes core feature layer matching. Dynamic detection includes script lineage detection and behavioral feature layer matching.

[0039] In some implementations, the determining unit 302 is used to perform the following operations: If the number of times a target script appears in a nearby historical preset time period is less than a preset number, then the target script is identified as a low-frequency script. If the number of times a target script appears in a nearby historical preset time period is not less than a preset number, then the target script is identified as a high-frequency script.

[0040] In some implementations, the core feature layer includes the hash value of the script file and the hash value of the key code segment; The auxiliary feature layer includes script function identifiers and version number rules; The behavioral characteristics layer includes resource call baseline, interface access baseline, and behavioral timing baseline.

[0041] In some implementations, the process of performing a comprehensive static analysis of the target script's runtime data is as follows: A1 determines whether the script hash value and key code segment hash value in the target script's runtime data match the script hash value and key code segment hash value in the corresponding core feature layer; if they match, dynamic detection is performed on the target script; if they do not match, A2 is executed. A2 determines whether the script function identifier and version number rules in the target script's runtime data match the script function identifier and version number rules in the corresponding auxiliary feature layer; if they match, dynamic detection is performed on the target script; if they do not match, A3 is executed. A3, based on the preset fuzzy matching rules for script features, calculates the fuzzy difference rate of the target script and determines whether its fuzzy difference rate is not greater than the preset fuzzy difference rate threshold; if so, dynamic detection is performed on the target script; if not, the target script is not allowed to be executed.

[0042] In some implementations, the process of dynamically detecting the target script is as follows: B1 determines whether the target script calls an unfamiliar script; if so, it determines whether there is a lineage relationship between the target script and the unfamiliar script. If there is, it executes B2; if not, it performs a comprehensive static check on the unfamiliar script. If the check passes, it executes B2; if it fails, it does not allow the target script to execute. B2, perform behavioral feature layer matching on the target script, calculate the credibility score of the target script based on the matching results, and determine the detection result based on the credibility score.

[0043] In some implementations, the process of performing partial static analysis on the runtime data of the target script is as follows: Determine whether the script hash value and key code segment hash value in the target script's runtime data match the script hash value and key code segment hash value in the corresponding core feature layer; if they match, perform dynamic detection on the target script; if they do not match, do not allow the target script to execute.

[0044] In some implementations, behavioral feature layer matching is performed on the target script, and a credibility score is calculated based on the matching results. The detection result is then determined based on this credibility score, including: Perform resource call baseline detection on the target script to determine whether the CPU and memory usage of the target script exceeds the preset range of the resource call baseline record. If yes, it is recorded as failing; otherwise, it is recorded as passing. Perform interface access baseline detection on the target script to determine whether the target script attempts to access an interface outside the list of device interfaces / IPs allowed by the interface access baseline; if yes, record it as failed, otherwise record it as passed. Perform a behavior timing baseline check on the target script to determine whether the behavior sequence of the target script conforms to the order specified by the behavior timing baseline; if yes, it is recorded as passed; otherwise, it is recorded as failed. Based on the baseline detection results of resource call, interface access, and behavior time series, as well as the total number of times the target script was executed in the nearby historical preset time period, its credibility score was determined, and the detection result was determined based on the credibility score.

[0045] In some implementations, the detection result is determined based on a confidence score, including: The credibility scores are divided into multiple levels according to their order from high to low; the first level is normal, which allows the execution of the target script and updates it to the whitelist. The second level is low risk, which allows the execution of the target script, logs it, and pops up a reminder. The third level is medium risk; the execution of the target script will be suspended and manually reviewed. Level 4 is high risk; the process will be terminated, the target script will be locked, and a system alert will be issued.

[0046] It should be noted that the script program detection device for industrial control systems provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the script program detection device for industrial control systems provided in the above embodiments and the script program detection method embodiments for industrial control systems belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0047] Embodiments of this application also provide a computer device, please refer to... Figure 3 The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, code set, or instruction set, the at least one instruction, at least one program, code set, or instruction set being loaded and executed by the processor to implement the script program detection method for industrial control systems provided in the above-described method embodiments.

[0048] Embodiments of this application also provide a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the script program detection method for industrial control systems provided in the above-described method embodiments.

[0049] Embodiments of this application also provide a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium and executes the computer program, causing the computer device to perform any of the script program detection methods for industrial control systems described in the above embodiments.

[0050] For ease of description, the above systems or devices are described separately as various modules or units based on their functions. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware components.

[0051] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0052] Finally, it should be noted that in this document, relational terms such as first, second, third, and fourth are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0053] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting script programs in industrial control systems, characterized in that, The method includes: Obtain the script feature library of the industrial control system, wherein each script in the script feature library includes a core feature layer, an auxiliary feature layer, and a behavior feature layer; For the target script to be detected in the current week, it is determined as a high-frequency script or a low-frequency script based on the number of times it is executed in the nearby historical preset time period; When the target script is a low-frequency script, the first strategy is used for risk detection; When the target script is a high-frequency script, if it is the first execution of the current cycle, the first strategy is used for risk detection; otherwise, the second strategy is used for risk detection. The first strategy involves performing comprehensive static detection and dynamic detection on the target script's execution data in sequence. The second strategy involves performing partial static detection and dynamic detection on the target script's execution data in sequence. The comprehensive static detection includes core feature layer matching, auxiliary feature layer matching, and script feature fuzzy matching. The partial static detection includes core feature layer matching. The dynamic detection includes script lineage detection and behavioral feature layer matching.

2. The method according to claim 1, characterized in that, The target script to be detected in the current week is divided into high-frequency scripts or low-frequency scripts based on its frequency of occurrence in a nearby historical preset time period, including: If the number of times a target script appears in a nearby historical preset time period is less than a preset number, then the target script is identified as a low-frequency script. If the number of times a target script appears in a nearby historical preset time period is not less than a preset number, then the target script is identified as a high-frequency script.

3. The method according to claim 1, characterized in that, The core feature layer includes the hash value of the script file and the hash value of the key code segment; The auxiliary feature layer includes script function identifiers and version number rules; The behavioral feature layer includes resource call baseline, interface access baseline, and behavioral timing baseline.

4. The method according to claim 3, characterized in that, The process of performing comprehensive static analysis on the runtime data of the target script is as follows: A1 determines whether the script hash value and key code segment hash value in the target script's runtime data match the script hash value and key code segment hash value in the corresponding core feature layer; if they match, dynamic detection is performed on the target script; if they do not match, A2 is executed. A2 determines whether the script function identifier and version number rules in the target script's runtime data match the script function identifier and version number rules in the corresponding auxiliary feature layer; if they match, dynamic detection is performed on the target script; if they do not match, A3 is executed. A3, based on the preset fuzzy matching rules for script features, calculates the fuzzy difference rate of the target script and determines whether its fuzzy difference rate is not greater than the preset fuzzy difference rate threshold; if so, dynamic detection is performed on the target script; if not, the target script is not allowed to be executed.

5. The method according to claim 4, characterized in that, The process of dynamically detecting the target script is as follows: B1. Determine whether the target script calls an unfamiliar script. If so, determine whether there is a lineage relationship between the target script and the unfamiliar script. If there is, execute B2. If not, perform the aforementioned comprehensive static detection on the unfamiliar script. If the detection result is successful, execute B2. If it fails, the target script is not allowed to execute. B2, perform behavioral feature layer matching on the target script, calculate the credibility score of the target script based on the matching results, and determine the detection result based on the credibility score.

6. The method according to claim 3, characterized in that, The process of performing partial static analysis on the runtime data of the target script is as follows: Determine whether the script hash value and key code segment hash value in the target script's runtime data match the script hash value and key code segment hash value in the corresponding core feature layer; if they match, perform dynamic detection on the target script; if they do not match, do not allow the target script to execute.

7. The method according to claim 3, characterized in that, The process of performing behavioral feature layer matching on the target script, calculating a credibility score for the target script based on the matching results, and determining the detection result based on the credibility score includes: Perform resource call baseline detection on the target script to determine whether the CPU and memory usage of the target script exceeds the preset range of the resource call baseline record. If yes, it is recorded as failing; if no, it is recorded as passing. Perform interface access baseline detection on the target script to determine whether the target script attempts to access an interface outside the list of device interfaces / IPs allowed by the interface access baseline; if yes, it is marked as failed, otherwise it is marked as passed. Perform a behavior timing baseline detection on the target script to determine whether the behavior sequence of the target script conforms to the order specified by the behavior timing baseline; if yes, it is recorded as passed, otherwise it is recorded as failed. Based on the resource call baseline detection results, interface access baseline detection results, behavior time sequence baseline detection results, and the total number of times the target script is executed within the nearby historical preset time period, its credibility score is determined, and the detection result is determined based on the credibility score.

8. The method according to claim 7, characterized in that, The determination of detection results based on credibility scoring includes: The credibility scores are divided into multiple levels according to their order from high to low; the first level is normal, which allows the execution of the target script and updates it to the whitelist. The second level is low risk, which allows the execution of the target script, logs it, and pops up a reminder. The third level is medium risk; the execution of the target script will be suspended and manually reviewed. Level 4 is high risk; the process will be terminated, the target script will be locked, and a system alert will be issued.

9. A script program detection device for industrial control systems, characterized in that, The device includes: The acquisition unit is used to acquire the script feature library of the industrial control system. Each script in the script feature library includes a core feature layer, an auxiliary feature layer, and a behavior feature layer. The determination unit is used to determine whether a target script to be detected in the current week is a high-frequency script or a low-frequency script based on the number of times it is executed in the nearby historical preset time period. The first detection unit is used to perform risk detection using the first strategy when the target script is a low-frequency script; The second detection unit is used to perform risk detection using the first strategy when the target script is a high-frequency script and is the first execution of the current cycle; otherwise, it performs risk detection using the second strategy. The first strategy involves performing comprehensive static detection and dynamic detection on the running data of the target script in sequence. The second strategy involves performing partial static detection and dynamic detection on the running data of the target script in sequence. The comprehensive static detection includes core feature layer matching, auxiliary feature layer matching, and script feature fuzzy matching. The partial static detection includes core feature layer matching. The dynamic detection includes script lineage detection and behavioral feature layer matching.

10. A computer device, characterized in that, The computer device includes a memory and a processor. The memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the steps of the method according to any one of claims 1-8.

Images