A method and system for monitoring and tracing problems of PLC data and configuration

Abstract

The application discloses a PLC data and configuration monitoring and problem tracing method and system, and belongs to the technical field of industrial control system network security. The technical problem to be solved is that the existing PLC monitoring means cannot distinguish between normal operation and maintenance and malicious attacks, the monitoring dimension is single and cannot adapt to multi-configuration switching scenes, and the technical solution points are as follows: a PLC configuration project is acquired, the configuration project is compared with a record saved last time, after change is detected, the configuration project is matched with an operation and maintenance configuration set, a potential risk configuration set and a high risk configuration set in sequence, and corresponding risk levels and prompt information are output; meanwhile, PLC operation data are collected in a timing mode, an initial data set is constructed according to classification, a random forest method is used to train an abnormality detection model, real-time data are continuously scored, and when the score exceeds an abnormal score threshold, an alarm prompt is output.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology for industrial control systems, specifically to a method and system for PLC data and configuration monitoring and problem tracing. Background Technology

[0002] Programmable Logic Controllers (PLCs) are the core execution units of industrial control systems, widely used in mainstream industrial scenarios by companies such as Siemens, Omron, and Rockwell. PLCs drive field devices to complete production operations by storing logic operation instructions and using digital or analog signals. As industrial control systems gradually move from closed systems to network interconnection, PLCs are commonly equipped with Ethernet communication modules. This allows attackers to tamper with PLC operating parameters, modify I / O pin configurations, or maliciously alter configuration files via network means, leading to incorrect instruction output from field devices and severely disrupting normal industrial production. Simultaneously, PLC configuration and point table data can also be illegally modified by simulating communication messages with a host computer. Once such situations occur, troubleshooting often relies on manual inspection or specialized software, which is time-consuming and labor-intensive, severely impacting production efficiency and safety levels in industrial settings.

[0003] To address the aforementioned security risks, existing technologies typically employ two types of protection methods. One is a monitoring method based on network packet mirroring. This involves capturing PLC network communication packets via a bypass, extracting configuration file tags and the complete configuration file, and comparing them with the version obtained during the last download to determine if tampering has occurred. However, this method can only monitor the single operation of configuration download, failing to cover other operations such as data acquisition, configuration upload, network configuration, and forced configuration of I / O port memory. Furthermore, it cannot detect modifications made to the PLC's internal program via serial port, resulting in a significant blind spot in the monitoring scope. The other method involves adding a physical lock to the PLC itself, achieving security by locking internal code and configuration data. However, this severely restricts the core characteristic of PLCs—dynamically adjusting their operating logic through programmable logic—sacrificing the flexibility and ease of use of the equipment, and failing to meet the actual needs of frequent PLC maintenance and changes in industrial settings.

[0004] Both of the above solutions share a common drawback: neither can distinguish between normal maintenance operations and malicious attacks. When configurations or data change, the system cannot determine whether it is a legitimate operation by maintenance personnel or a malicious intrusion by an attacker, significantly reducing the accuracy and usability of alarms. Furthermore, existing methods lack effective problem tracing capabilities after an anomaly occurs; maintenance personnel still need to use PLC configuration programming tools to troubleshoot item by item, resulting in low maintenance efficiency.

[0005] Chinese patent document CN106502234B discloses an anomaly detection method for industrial control systems based on a dual-profile model. It discloses a technical solution that uses a mapping table between Modbus TCP protocol feature vectors and PLC register values ​​to construct k-means clustering optimized SVM and TCM-KNN dual-model collaborative detection. This method improves the anomaly detection rate from both protocol behavior and register value dimensions. However, it still has problems such as relying on network bypass monitoring, being unable to detect configuration modifications in serial port mode, not involving monitoring changes in configuration engineering content, and lacking a mechanism to distinguish between operation and maintenance operations and attack behaviors.

[0006] Chinese patent application CN114647233A discloses a method, device, storage medium, and electronic device for monitoring PLC operation configuration. It discloses a technical solution that obtains configuration unit function control data by actively sending instructions to the PLC, generates a benchmark verification value using hash encoding, and periodically compares the values ​​during runtime to detect tampering. This solution achieves the technical effect of monitoring configuration integrity without limiting the programmability of the PLC. However, it still has some problems, such as the monitoring scope being limited to the configuration engineering and not covering the dimension of operation data, lacking the ability to classify change risks and recognize operation and maintenance semantics, being unable to adaptively match the detection model in multi-configuration switching scenarios, and lacking the function of tracing the source of problems after an anomaly occurs. Summary of the Invention

[0007] The purpose of this invention is to provide: A method and system for PLC data and configuration monitoring and problem tracing, and related technologies, to solve the technical problems of existing PLC monitoring methods, such as the inability to distinguish between normal operation and maintenance and malicious attacks, the single monitoring dimension and the inability to adapt to multi-configuration switching scenarios, or a combination thereof.

[0008] Terminology Explanation: Unless otherwise defined, all technical terms in this document have the same meanings as commonly understood by one of ordinary skill in the art to which the subject matter of the claims pertains. Unless otherwise stated, all patents, patent inventions, and publications cited in this document are incorporated herein by reference in their entirety. If multiple definitions exist for terms in this document, the definitions in this chapter shall prevail.

[0009] It should be understood that the above brief description and the following detailed description are exemplary and for illustrative purposes only, and do not limit the subject matter of the invention in any way. In this invention, the singular is used in conjunction with the plural unless otherwise specifically stated. It should also be noted that, unless otherwise stated, the use of “or” or “or” means “and / or”. Furthermore, the use of the term “comprising” and other forms such as “including,” “containing,” and “contains” are not limiting.

[0010] Unless specifically defined herein, the use of various commercially available products herein employs standard techniques, or is carried out in accordance with methods known in the art or the description of this invention. The techniques and methods described herein can generally be implemented according to conventional methods well known in the art, based on the descriptions in the various summary and more specific documents cited and discussed in this specification.

[0011] The term "configuration engineering" used in this article refers to the complete program configuration file stored in the PLC, which contains all the information describing the PLC's operating logic and hardware configuration, such as program blocks, data blocks, and hardware information blocks. It is the core basis for the PLC to perform industrial control tasks.

[0012] The term "classification block" used in this article refers to the smallest structural unit obtained after decomposing the configuration project according to its functional type, including program blocks, data blocks, and hardware information blocks, etc. Each classification block carries the configuration content of a specific category in the configuration project.

[0013] The term "unique tag value" used in this article refers to a fixed-length string obtained by performing an MD5 hash calculation on the content of a category block. This string is used to uniquely identify the content state of the category block at a certain moment. Any change in the content will cause the unique tag value to change accordingly.

[0014] The term "zChecksum" used in this article refers to the total checksum generated by summarizing and calculating the names and unique label values ​​of all classified blocks in the configuration project. It is used to quickly determine whether the entire configuration project has been changed, and global comparison can be completed without reading the complete content of each block.

[0015] In a first aspect, the present invention provides: a method for PLC data and configuration monitoring and problem tracing, comprising: S1: Obtain the asset information of the PLC to be monitored and enter it into the monitoring equipment; S2: Through protocol interaction with the PLC, periodically obtain the PLC's configuration project, parse the configuration project into several category blocks, calculate a unique label value for the content of each category block, and save the name, unique label value and configuration project file of each category block to the local machine. S3: Compare the current configuration block with the previously saved configuration. If they match, discard the current data and wait for the next timer cycle. If there are differences, extract the changed area content and save the change record containing the classification block information, unique label value, changed area content and risk level to the local machine. S4: Match the change record with the operation and maintenance configuration set. If the match is successful, mark the change as a low-risk operation and maintenance change. If the match is not successful, proceed to S5. S5: Match the change record with the potential risk configuration set. If the match is successful, mark the change as a medium-risk change and output a prompt message. If the match is not successful, proceed to S6. S6: Match the change record with the high-risk configuration set. If the match is successful, mark the change as a high-risk change and output a prompt message. If the match is not successful, add the change information to the high-risk configuration set. S7: Through protocol interaction with the PLC, it periodically acquires PLC operation data, classifies and parses the acquired data according to number, and constructs the initial dataset corresponding to each number; S8: Based on the initial dataset, an anomaly detection model is constructed using the random forest method. An anomaly score threshold is set, and the real-time collected PLC operation data is scored. When the anomaly score exceeds the threshold, the corresponding data number and an alarm message for the anomaly data are output. Furthermore, in S2, the unique tag value is obtained by performing an MD5 hash on the category block content, and the calculation formula is as follows:

[0016] Where T represents the content of the category block. The unique label value corresponding to the nth classification block; the classification block includes at least one of program block, data block and hardware information block; The storage format for configuration projects is:

[0017] in, A total unique label value is generated for all category blocks and their label values. The name of the nth category block. The unique label value for the nth category block. Save the path for the configuration project. To change the content of the area, Risk level, The number of times it appears. This represents the time of each occurrence.

[0018] Furthermore, in S4, the operation and maintenance configuration set is manually confirmed and written by the operation and maintenance personnel, and its format is as follows:

[0019] in, For the detailed information of the i-th operation and maintenance configuration change; extract the total unique tag value from the change record. With each item in the operation and maintenance configuration set A matching process is performed, and if a match is successful, it is considered an operational change.

[0020] Furthermore, in S5, the potential risk configuration set is automatically included by changes that meet one of the following conditions: the number of occurrences is greater than 7 times in a week, or the number of occurrences is greater than 7 times in a week with regular time intervals, and the changes have not been confirmed by maintenance personnel. In S6, the high-risk configuration set includes occasional changes that occur more than 0 times and less than 7 times within a week; when the number of entries in the high-risk configuration set exceeds 50, entries that have not appeared within a month or have appeared 1 time are automatically removed; when an entry is confirmed by the operation and maintenance personnel or appears more than 7 times within a week, the entry is automatically moved to the operation and maintenance configuration set or the potential risk configuration set.

[0021] Furthermore, in S3, the risk level is set with ten levels from 0 to 9, where 0 is no risk, 1 to 3 are low risk, 4 to 6 are medium risk, and 7 to 9 are high risk.

[0022] Furthermore, in S8, the random forest method constructs the anomaly detection model through the following steps: S81: For each numbered dataset, a training set is constructed using a dual random sampling method (row sampling and column sampling). The training set format is as follows:

[0023] in:

[0024] Number the data. For the corresponding data value; S82: Using Gini impurity as the node splitting criterion, the formula for calculating Gini impurity is as follows:

[0025] Where S is the dataset and C is the number of categories. Let i be the proportion of class i in dataset S; the formula for calculating the weighted Gini impurity after node splitting is:

[0026] Where |S| is the total number of samples in the current node, | | and | | represents the number of samples in the left and right child nodes after the split; for each candidate feature, enumerate all split points and select the one that makes the split point the most suitable for the left and right child nodes. The smallest feature and the split point are used as the optimal splitting scheme, and a single decision tree is recursively constructed until the preset stopping condition is met; S83: Repeat S82 to build 100 to 300 decision trees. For the anomaly detection results of the new input data, take the mode of the output results of all decision trees:

[0027] in, , , For the output of T decision trees, The mode function; S84: Records high-resolution segments in the training data to set an outlier threshold. When the real-time data has an abnormal score If an error is detected, an alarm message with the corresponding number and data will be output.

[0028] Furthermore, the method also includes: S9: For each operation and maintenance configuration, maintain an independent dataset and corresponding anomaly detection model; when an operation and maintenance change occurs in the PLC configuration, suspend the current operation and maintenance model and switch to the dataset and detection model corresponding to the new operation and maintenance configuration to continue data monitoring; when the PLC configuration change does not belong to any operation and maintenance configuration, mark the change as a high-risk configuration engineering change.

[0029] Furthermore, when operations and maintenance personnel confirm that a certain high-deviation data is reasonable operations and maintenance data, the data after the confirmation time point is added to the dataset of the corresponding operations and maintenance configuration, and the anomaly detection model of the operations and maintenance configuration is retrained based on the updated dataset.

[0030] Furthermore, in S7, the PLC operating data includes at least one of input IO data, output IO data, and PLC operating temporary variable data. Each data is categorized and stored in the database according to its number, and an initial dataset for each number is constructed after multiple data collections.

[0031] in, Number the data. This represents the data value collected in the j-th time for the corresponding number.

[0032] Secondly, a PLC data and configuration monitoring and problem tracing device includes: The asset configuration module is used to input asset information for the PLCs to be monitored. The configuration acquisition module is used to periodically acquire the PLC's configuration project through protocol interaction, parse the configuration project into several classification blocks, calculate a unique label value for the content of each classification block, and save the classification block information and configuration project file to the local machine. The configuration comparison module is used to compare the configuration project acquired at the current time with the configuration project saved at the previous time, extract the content of the changed area, and generate a change record including the risk level. The risk classification module is used to match change records sequentially with the operation and maintenance configuration set, the potential risk configuration set, and the high risk configuration set, output the corresponding risk level and prompt information, and maintain the dynamic update of each configuration set. The data acquisition module is used to periodically acquire PLC operating data through protocol interaction, categorize and parse it by number, and store it in the database; The model training module is used to build an anomaly detection model based on each numbered dataset using the random forest method and to set anomaly score thresholds. The data monitoring module is used to score the real-time collected PLC operating data for anomalies, and outputs an alarm prompt when the anomaly score exceeds the threshold. The model switching module is used to maintain independent datasets and detection models for each operation and maintenance configuration, and automatically switch to the corresponding datasets and detection models when the operation and maintenance of the PLC configuration changes.

[0033] The present invention has at least the following beneficial effects: 1. This invention utilizes block-level MD5 hash comparisons of configuration projects, combined with a three-level dynamic matching mechanism encompassing maintenance configuration sets, potential risk configuration sets, and high-risk configuration sets, to automatically assign a corresponding risk level to each configuration change. Compared to existing technologies that only provide binary outputs indicating "whether a change has occurred," this invention can directly distinguish between legitimate maintenance operations and potential attacks upon detecting a change, significantly reducing false alarm rates and enhancing the practical value of alerts.

[0034] 2. This invention continuously monitors the configuration process while independently constructing a random forest-based operational data anomaly detection model to score anomalies in real-time operational data such as input I / O and output I / O. The two monitoring paths operate in parallel, independent of each other, enabling the detection of malicious tampering at the configuration level and the capture of abnormal offsets at the data level. This covers all possible anomalies that may occur after a PLC is attacked, overcoming the blind spots of existing technologies that only focus on a single dimension.

[0035] 3. This invention maintains an independent dataset and detection model for each operation and maintenance configuration. When a PLC undergoes a legitimate configuration switch, the current model is automatically suspended and the dataset and detection model for the corresponding configuration are loaded. After operation and maintenance personnel confirm high-deviation data, the system incorporates the new data into the training set and triggers model retraining. This mechanism enables the monitoring system to continuously adapt to complex scenarios involving changes in on-site operating conditions and frequent switching between multiple configurations. Simultaneously, it continuously optimizes detection accuracy through continuous learning, avoiding missed and false alarms caused by changes in operating conditions. Attached Figure Description

[0036] Figure 1 The flowchart illustrates a method for monitoring PLC data and configuration and tracing problems, as provided by this invention.

[0037] Figure 2 This is a schematic diagram of the structure of a PLC data and configuration monitoring and problem tracing system provided by the present invention.

[0038] Figure 3 This is a flowchart of the learning and monitoring of configuration engineering information in an embodiment of the present invention.

[0039] Figure 4 This is a flowchart illustrating the process of training a data model for a single operation and maintenance configuration data in an embodiment of the present invention.

[0040] Figure 5 This is a flowchart illustrating the switching of training models for the current configuration within the PLC in an embodiment of the present invention.

[0041] Figure 6 This is a flowchart illustrating the process of determining the status after obtaining the configuration project in an embodiment of the present invention. Detailed Implementation

[0042] The following non-limiting embodiments are intended to enable those skilled in the art to gain a more comprehensive understanding of the present invention, but do not limit the invention in any way. The following content is merely an exemplary description of the scope of protection claimed by the present invention, and those skilled in the art can make various changes and modifications to the present invention based on the disclosed content, and such changes should also fall within the scope of protection claimed by the present invention.

[0043] The present invention will be further described below by way of specific embodiments. Unless otherwise specified, all instruments, devices, equipment, reagents, products, etc., used in the embodiments of the present invention are obtained through conventional commercial means.

[0044] Example 1 like Figure 1 As shown, this invention provides a method for PLC data and configuration monitoring and problem tracing. The main body executing this method is a monitoring device with protocol interaction capabilities, and the execution process is as follows.

[0045] First, maintenance personnel enter the asset information, such as the IP address of the PLC to be monitored, into the device through the monitoring device's web page, thus completing the initial configuration of the asset.

[0046] After asset entry is completed, the monitoring equipment periodically and proactively acquires the PLC's configuration file through protocol interaction with the PLC. Specifically, the equipment acquires all protocol packets of the configuration file through protocol packetization, parses them into several categories such as program blocks, data blocks, and hardware information blocks, calculates a unique tag value for the content of each category block, and then saves the name of each category block, the unique tag value, and the configuration file locally.

[0047] After each configuration project is acquired, the monitoring device compares the quantity and unique tag value of each category block with the previously saved record. If they are completely consistent, the data for that time is discarded and the system waits for the next timed cycle; if there are differences, the content of the specific changed area is extracted, and the change record containing the category block information, unique tag value, changed area content, and risk level is saved locally, and then proceeds to the subsequent risk matching process.

[0048] Risk matching employs a three-level, layered judgment mechanism. At the first level, the change record is matched against the maintenance configuration set. If a match is found, the change is marked as a low-risk maintenance change, and the process ends. If no match is found, the process proceeds to the second level, comparing the change record against a potential risk configuration set. If a match is found, the change is marked as a medium-risk change, and a prompt message is output. If no match is found at any of the three levels, the change information is written to the high-risk configuration set.

[0049] In parallel with configuration monitoring, the monitoring equipment periodically acquires PLC operating data such as input I / O and output I / O through protocol interaction. This data is categorized, parsed, and stored in a database. After multiple acquisitions, an initial dataset is constructed for each number. Based on these initial datasets, a random forest method is used to train an anomaly detection model, and an anomaly score threshold is set. After model training, subsequent real-time acquired PLC operating data is continuously scored. When the anomaly score of a certain data number exceeds the threshold, an alarm message for that number and the corresponding anomaly data is output to assist maintenance personnel in quickly locating the problematic data point.

[0050] The above process advances the two paths of configuration engineering monitoring and operation data monitoring in parallel, covering both tamper detection at the configuration level and anomaly detection at the data level, and distinguishing normal operation and maintenance from potential attack behavior through a three-level risk classification.

[0051] In one specific implementation of this embodiment, the unique tag value is obtained by performing an MD5 hash on the category block content, i.e. Where T represents the content of the category block. This is the unique label value for the nth category block. The MD5 calculation result is unique; any change in content will result in a change in the label value, thus ensuring the accuracy of block-level integrity verification. The complete storage format of the configuration project is:

[0052] in, The total unique label value generated by summing all category block label values ​​can be used for fast global comparison; Record the save path of the configuration project; Record the specific changes made to the area; , , Each risk level, cumulative occurrence count, and time of occurrence are recorded separately. This storage structure supports the tracing and analysis of change history.

[0053] In one specific implementation of this embodiment, the operation and maintenance configuration set is manually written by the operation and maintenance personnel after confirming on-site that a certain change is a legitimate operation and maintenance operation. The set format is as follows: , This provides detailed information for the i-th maintenance configuration change. During matching, the total unique tag value is extracted from the change record. , and each entry in the set Each change is compared individually; a successful match is considered a legitimate operational change. As a matching key, it can complete a fast comparison without reading the complete configuration content, reducing matching overhead.

[0054] In one specific implementation of this embodiment, the inclusion criteria for the potential risk configuration set are: occurrences greater than 7 times within a week, or occurrences greater than 7 times within a week exhibiting regular time intervals, and not confirmed by maintenance personnel; the high-risk configuration set includes occasional changes occurring more than 0 times and less than 7 times within a week. When the high-risk configuration set exceeds 50 entries, inactive entries that have not appeared within a month or have appeared 1 time are automatically removed; when an entry is confirmed by maintenance personnel or occurs more than 7 times within a week, it is automatically migrated to the maintenance configuration set or the potential risk configuration set. This dynamic maintenance mechanism ensures that each configuration set always reflects the current on-site situation, reducing false alarms.

[0055] In one specific implementation of this embodiment, the risk level is set into ten levels from 0 to 9, where 0 represents no risk, 1 to 3 represent low risk, 4 to 6 represent medium risk, and 7 to 9 represent high risk. This detailed level design allows alarm outputs to carry quantified risk level information, facilitating priority-based responses by maintenance personnel.

[0056] In one specific implementation of this embodiment, the construction of the random forest anomaly detection model consists of four steps. First, a training set is constructed for each numbered dataset using a dual random sampling method of row sampling and column sampling. ,in , Number the data. The corresponding data values ​​are used. Next, a single decision tree is recursively constructed using Gini impurity as the node splitting criterion. The formula for calculating Gini impurity is:

[0057] The weighted Gini impurity after node splitting is:

[0058] For each candidate feature, enumerate all segmentation points and select the one that makes the segmentation point the most suitable for the candidate feature. The smallest possible split is selected as the optimal split, and the process is recursively repeated until the stopping condition is met, at which point leaf nodes are generated. This process is then repeated to construct 100 to 300 decision trees, and the final prediction is the mode of all tree outputs.

[0059] Finally, an anomaly score threshold was set based on the high quantiles of the training data. When the real-time data has an abnormal score An anomaly is identified and an alarm is output. The multi-tree ensemble voting mechanism reduces the risk of overfitting from a single tree and improves the accuracy of anomaly detection.

[0060] In one specific implementation of this embodiment, the monitoring device maintains an independent dataset and anomaly detection model for each maintenance configuration. When a maintenance change occurs in the PLC configuration, the device suspends the current model and switches to the dataset and detection model corresponding to the new maintenance configuration to continue data monitoring; if the configuration change does not belong to any existing maintenance configuration, it is marked as a high-risk configuration engineering change. This "one configuration, one model" mechanism enables the monitoring device to adapt to the complex situation of multiple configuration switching on site.

[0061] In one specific implementation of this embodiment, when maintenance personnel confirm that a high-deviation data point belongs to reasonable maintenance data, the system appends the relevant data after the confirmation time point to the dataset of the corresponding maintenance configuration, and retrains the anomaly detection model of that maintenance configuration based on the updated dataset. This continuous learning mechanism enables the model to dynamically optimize as on-site conditions evolve, avoiding an increase in false alarms due to changes in operating conditions.

[0062] In one specific implementation of this embodiment, the PLC operating data collected periodically in S7 includes at least one of input IO data, output IO data, and PLC operating temporary variable data. Each data is stored in a database according to its number, and an initial dataset is constructed for each number after multiple collections.

[0063] in, Number the data. This represents the data value obtained from the j-th collection. Independent datasets are established according to the data type number to ensure that anomaly detection models for different data types are independent and do not interfere with each other.

[0064] Example 2 like Figure 2 As shown, the present invention also provides a PLC data and configuration monitoring and problem tracing device, which includes the following functional modules.

[0065] The asset configuration module is responsible for inputting the asset information of the PLC to be monitored. The configuration acquisition module periodically obtains the PLC's configuration file through protocol interaction, parses the configuration file into several category blocks, calculates the unique label value of each category block, and saves the category block information and configuration file locally.

[0066] The configuration comparison module compares the currently acquired configuration project with the previously saved version, extracts the changed areas, and generates change records containing risk levels. The risk grading module sequentially matches the change records with the operation and maintenance configuration set, the potential risk configuration set, and the high-risk configuration set, outputs the corresponding risk level and prompt information, and maintains the dynamic updates of each configuration set.

[0067] The data acquisition module periodically acquires PLC operating data via protocol interaction, categorizes and parses it by number, and then stores it in the database. The model training module constructs anomaly detection models based on the datasets with each number using the random forest method and sets anomaly score threshold.

[0068] The data monitoring module scores real-time PLC operating data for anomalies, and outputs an alarm when the score exceeds a threshold. The model switching module maintains an independent dataset and detection model for each operation and maintenance configuration, automatically switching to the corresponding dataset and detection model when the PLC configuration undergoes operational changes. These modules work together to achieve continuous safety monitoring and problem tracing of PLC configurations and data.

[0069] Example 3 like Figures 3-6 As shown, the following practical implementation will provide further explanation.

[0070] This invention provides a method for monitoring PLC data configuration and predicting error sources. The specific process of the system is shown below: S1. The implementer needs to add the IP address and other information of the relevant assets to the device through the device's web page.

[0071] The specific process for learning and monitoring configuration engineering information is as follows: Figure 3 As shown.

[0072] S2. After the necessary assets are added to the equipment, the equipment will periodically obtain the PLC configuration project through protocol interaction between PLCs for storage, learning, and monitoring. The operation process is as follows: All protocol packets of the configuration project are obtained through protocol packet assembly. Then, the protocol packets of the configuration project are decomposed into various categories of blocks under the configuration project, such as program blocks, data blocks, and hardware information blocks. Finally, the unique standard value of each block is obtained through MD5 calculation. =T(MD5), where T is the content of the block. Then, the configuration project and its corresponding block, along with the unique tag value, are stored in the device, as follows.

[0073] +.....+

[0074] in, This represents the first configuration information obtained.

[0075] This represents the name of the block that was analyzed.

[0076] This represents the unique label value after analysis and calculation.

[0077] The initial configuration obtained is the default configuration 1.

[0078] S3. Monitor the configuration project. Periodically acquire the configured blocks and their unique tag values ​​via S2. Compare the acquired configuration information with the number of blocks and unique tag values ​​to analyze whether there have been any changes to the configuration project during this activity. If no changes are found, discard the currently acquired information and proceed to the next periodic acquisition of configuration information. If changes are found, acquire the specific changed area content and save the change information (configuration, block information, unique tag values, content of the changed area) and the configuration project locally. The saving method is as follows: +.....+ +projectPath+changeArea+riskLevel+number+time.

[0079] Where zChecksum is the total unique label value generated for all blocks and their label values. Sn represents the block name number. An represents the unique label value of the block. projectPath is the path where the configuration project is saved. `changeArea` refers to changing the content of the area. riskLevel: The risk level of the changed content. number represents the number of times it appears. time is the time of each occurrence. Risk Levels: There are 10 risk levels in total: 0, 1, 2, 3, 4, 5, 6, 7, 8, and 9. Among them, 0 is no risk, 1, 2, and 3 are low risk, 4, 5, and 6 are medium risk, and 7, 8, and 9 are high risk.

[0080] S4. After confirming the changes in S3, compare them with the routine operation and maintenance configuration set. The routine operation and maintenance configuration set is manually confirmed by the operation and maintenance personnel to be an operation and maintenance configuration. The final routine operation and maintenance configuration set is as follows:

[0081] This contains detailed information about routine operation and maintenance configuration changes, indicating the first... The characteristics of routine operation and maintenance configuration changes (i.e., V as described in S3) n information) By extraction In Confirm if it is an operations and maintenance (O&M) configuration. If confirmed, indicate low risk and change to O&M configuration i. If it is not an O&M configuration set, proceed to the next step.

[0082] S5. After the quick comparison in S4, a comparison is made on the potential risk configuration set. The potential risk configuration set is defined as configurations that appear more than 7 times within a week, or configurations that appear more than 7 times with a certain time pattern, and which have not been confirmed by maintenance personnel. The final potential risk configuration set is as follows:

[0083] The quick comparison method is the same as S3. If it is confirmed to be a potential risk configuration set, a medium risk warning will be displayed, along with the number of times the current configuration has occurred within a certain time period and specific information related to the current change. If it is not a potential risk configuration set, proceed to the next step.

[0084] S6. After the rapid comparison above, a comparison is made on the risk configuration sets. The high-risk configuration sets are those that have undergone occasional changes, and the number of changes within this week is greater than 0 and less than 7. The final potential risk configuration sets are as follows:

[0085] The quick comparison method is the same as S3. If a high-risk configuration set is confirmed, a high-risk warning will be displayed, along with the number of times the current configuration has occurred within a certain timeframe and specific information related to the current change. If it is not a high-risk configuration set, the configuration information of this change will be added to the high-risk configuration set. When the number of high-risk configuration sets exceeds 50, processing will be performed, removing configuration information that has not appeared within a month or has appeared 1 time. When maintenance personnel confirm the change or the number of occurrences exceeds 7 times in a week, the corresponding configuration information will be automatically added to the maintenance configuration set and the potential risk configuration set.

[0086] Next, the PLC data information is analyzed and studied to monitor: The first step is data preparation and preprocessing: S7. After acquiring the asset's configuration engineering, the equipment obtains the configuration data protocol packets via a protocol. By parsing the data protocol packets, the equipment extracts data information such as input I / O numbers, data, and output I / O numbers, data, etc., including some temporary variable data from PLC operation. This data is then stored in the database.

[0087] S8. After running the S7 process multiple times, a certain number of input I / O and output I / O data with the same ID were obtained. These data were used to construct an initial dataset for each ID.

[0088]

[0089] in: A label is a number that represents a type of data, indicating a specific set of data names.

[0090] It is a feature vector, that is, the data corresponding to the data name, representing the data information corresponding to the data name in this instance.

[0091] Concatenate the data and labels into a new feature vector:

[0092] Finally, all the data were combined into a training set:

[0093] Constructing a single isolated tree: S9. The steps for constructing multiple decision trees using a random forest method are as follows: 1. Selecting a dataset. Random forests introduce double randomness into each tree—namely, row sampling from the training data (bootstrap) and column sampling from a subset of features—so that each tree is trained on only different subsets of data and features. This mechanism effectively enhances model diversity, thereby reducing the risk of overfitting and improving generalization ability.

[0094] 2. Constructing Individual Decision Trees. When constructing each decision tree in the random forest, to meet the requirement of "optimal" splitting, we choose the computationally efficient Gini impurity as the node splitting criterion. This criterion searches for the optimal split point t for feature f at each level of the tree, aiming to maximize the "purity" of sample classes within the split subset—its calculation does not involve complex logarithmic operations, but only requires the sum of squared class probabilities, expressed by the formula:

[0095] in It is a dataset. It refers to the number of supported tags. It is a category In the dataset The probability of it.

[0096] For each candidate feature, we enumerate all possible split points and evaluate their splitting effect one by one. Specifically, at each split point, the current node's dataset is divided into two subsets: the left child node DL (satisfying the splitting condition) and the right child node DR (not satisfying the splitting condition). Then, we calculate the Gini impurity gain (or other purity index) after splitting at that split point, and finally select the feature and split point that maximizes the purity improvement of the subset as the optimal splitting scheme for that node.

[0097]

[0098]

[0099] in, and Represent the categories in the left and right child nodes, respectively. The sample proportion.

[0100] Calculate the Gini impurity after splitting:

[0101] in, It is the total number of samples in the current node. and These are the number of samples in the left and right child nodes after the split, respectively.

[0102] This simplified Gini impurity has a nice property: the smaller the subset, the higher its impurity. This aligns perfectly with our goal—we hope to create smaller, "purer" subsets (i.e., isolated outliers) more quickly through partitioning.

[0103] By iterating through all possible combinations of features and thresholds using the above method, we can find the combination that minimizes... The way it splits.

[0104] Finally, based on the above principles, each child node is recursively processed, and this process is repeated until the preset stopping conditions are met (such as reaching the maximum tree depth, the number of node samples being lower than the splitting threshold, or the node purity reaching the standard). At this point, the node becomes a leaf node and its prediction category is determined by majority vote, ultimately generating a complete decision tree.

[0105] 3. Create isolated forests.

[0106] Based on the above method, 100 to 300 decision trees are generated and constructed. Each tree is independently trained based on randomly selected data and feature subsets. During classification prediction, each tree produces a prediction result as a vote. Finally, the final decision result of the model is formed by summing the votes (e.g., majority voting).

[0107] in yes The output of the tree, It is a function for finding the mode. After training, record the high quantiles obtained from the original data. Set a threshold based on these values. Then, for newly arrived data with specific identifiers and data points, the model will output the corresponding outlier score s(Z). new When this outlier occurs, if s(Z) new If the value exceeds the threshold, the combination is deemed "unreasonable". Otherwise, it is deemed "reasonable", and the unreasonable data is identified by its identifier and associated data, triggering an alert.

[0108] S10. For a single maintenance configuration data point, train a data model specific to that configuration using method S9. When maintenance personnel need to modify new data information with significant deviations in the field environment, they can reconfirm the high-deviation data as the maintenance data for that configuration. At this time, the training set for that maintenance configuration will be updated to include the data information after the maintenance personnel have confirmed the maintenance data. Then, based on the new dataset, a new model is trained using S9, as detailed in the following process. Figure 4 . Each operation and maintenance configuration has a corresponding dataset and a model trained on that dataset. The training model is switched for each configuration within the current PLC, specifically as follows: Figure 5 As shown.

[0109] S11. The overall process is roughly as follows, such as Figure 6 As shown, the process first acquires the configuration project. Without an existing operation and maintenance (O&M) configuration, the current configuration is set to O&M configuration 1. Based on this O&M configuration, training data for a period of time is acquired. Based on this data, a corresponding training dataset is generated to train the model. Then, data information is monitored based on the model. If an O&M configuration exists, it automatically identifies which O&M configuration it belongs to, then suspends the current O&M model and switches to the corresponding configuration's dataset and training model for data monitoring. If no changes are found within the O&M configuration, they are identified as high-risk configuration project changes.

[0110] Compared with existing security protection methods, the active communication method for monitoring provided by this invention has the following advantages: 1. Comprehensive monitoring content: It adopts multiple information data monitoring, and its monitoring content is comprehensive, including the results caused by all ways the PLC is attacked, including configuration engineering changes and various data changes.

[0111] 2. Configuration change identification is more closely aligned with the field environment. After confirming the operation and maintenance configuration set, changes to the configuration can be efficiently categorized by their severity level, including operation and maintenance configuration changes and high-risk configuration changes. 3. Improve equipment flexibility and adaptability. By adopting a set configuration-model mechanism, the monitoring model can be automatically switched in response to changes in the on-site PLC configuration and operation and maintenance, adapting to complex situations with multiple configurations and multiple sets of data.

[0112] 4. Improve the comprehensiveness and accuracy of equipment monitoring data. Utilize continuous learning of operation and maintenance data to optimize monitoring data and models, resulting in more comprehensive and accurate monitoring data.

[0113] 5. Provides valuable information on data tampering. By monitoring data and configuration projects, it identifies anomalies in medium- to high-risk situations, facilitating troubleshooting by maintenance personnel.

[0114] Finally, it should be noted that the above content is only used to illustrate the technical solution of the present invention, and is not intended to limit the scope of protection of the present invention. Simple modifications or equivalent substitutions made by those skilled in the art to the technical solution of the present invention do not depart from the essence and scope of the technical solution of the present invention.

Claims

1. A method for PLC data and configuration monitoring and problem tracing, characterized in that, include: S1: Obtain the asset information of the PLC to be monitored and enter it into the monitoring equipment; S2: Through protocol interaction with the PLC, periodically obtain the PLC's configuration project, parse the configuration project into several category blocks, calculate a unique label value for the content of each category block, and save the name, unique label value and configuration project file of each category block to the local machine. S3: Compare the current configuration block with the previously saved configuration. If they match, discard the current data and wait for the next timer cycle. If there are differences, extract the changed area content and save the change record containing the classification block information, unique label value, changed area content and risk level to the local machine. S4: Match the change record with the operation and maintenance configuration set. If the match is successful, mark the change as a low-risk operation and maintenance change. If the match is not successful, proceed to S5. S5: Match the change record with the potential risk configuration set. If the match is successful, mark the change as a medium-risk change and output a prompt message. If the match is not successful, proceed to S6. S6: Match the change record with the high-risk configuration set. If the match is successful, mark the change as a high-risk change and output a prompt message. If the match is not successful, add the change information to the high-risk configuration set. S7: Through protocol interaction with the PLC, it periodically acquires PLC operation data, classifies and parses the acquired data according to number, and constructs the initial dataset corresponding to each number; S8: Based on the initial dataset, an anomaly detection model is constructed using the random forest method. An anomaly score threshold is set, and the real-time collected PLC operation data is scored. When the anomaly score exceeds the threshold, the corresponding data number and an alarm prompt for the anomaly data are output.

2. The PLC data and configuration monitoring and problem tracing method according to claim 1, characterized in that: In S2, the unique tag value is obtained by performing an MD5 hash on the category block content. The calculation formula is as follows: Where T represents the content of the category block. The unique label value corresponding to the nth classification block; the classification block includes at least one of program block, data block and hardware information block; The storage format for configuration projects is: in, A total unique label value is generated for all category blocks and their label values. The name of the nth category block. The unique label value for the nth category block. Save the path for the configuration project. To change the content of the area, Risk level, The number of times it appears. This represents the time of each occurrence.

3. The method for PLC data and configuration monitoring and problem tracing according to claim 1, characterized in that: In S4, the operation and maintenance configuration set is manually confirmed and written by the operation and maintenance personnel, and its format is as follows: in, For the detailed information of the i-th operation and maintenance configuration change; extract the total unique tag value from the change record. With each item in the operation and maintenance configuration set A matching process is performed, and if a match is successful, it is considered an operational change.

4. The method for PLC data and configuration monitoring and problem tracing according to claim 1, characterized in that: In S5, the potential risk configuration set is automatically included by changes that meet one of the following conditions: the number of occurrences is greater than 7 times in a week, or the number of occurrences is greater than 7 times in a week with regular time intervals, and has not been confirmed by the operation and maintenance personnel. In S6, the high-risk configuration set includes occasional changes that occur more than 0 times and less than 7 times within a week; when the number of entries in the high-risk configuration set exceeds 50, entries that have not appeared within a month or have appeared 1 time are automatically removed; when an entry is confirmed by the operation and maintenance personnel or appears more than 7 times within a week, the entry is automatically moved to the operation and maintenance configuration set or the potential risk configuration set.

5. The PLC data and configuration monitoring and problem tracing method according to claim 1, characterized in that: In S3, the risk level is set at ten levels from 0 to 9, where 0 is no risk, 1 to 3 are low risk, 4 to 6 are medium risk, and 7 to 9 are high risk.

6. The PLC data and configuration monitoring and problem tracing method according to claim 1, characterized in that: In S8, the random forest method constructs the anomaly detection model through the following steps: S81: For each numbered dataset, a training set is constructed using a dual random sampling method (row sampling and column sampling). The training set format is as follows: in: Number the data. For the corresponding data value; S82: Using Gini impurity as the node splitting criterion, the formula for calculating Gini impurity is as follows: Where S is the dataset and C is the number of categories. Let i be the proportion of class i in dataset S; the formula for calculating the weighted Gini impurity after node splitting is: Where |S| is the total number of samples in the current node, | | and | | represents the number of samples in the left and right child nodes after the split; for each candidate feature, enumerate all split points and select the one that makes the split point the most suitable for the left and right child nodes. The smallest feature and the split point are used as the optimal splitting scheme, and a single decision tree is recursively constructed until the preset stopping condition is met; S83: Repeat S82 to build 100 to 300 decision trees. For the anomaly detection results of the new input data, take the mode of the output results of all decision trees: in, , , For the output of T decision trees, The mode function; S84: Records high-resolution segments in the training data to set an outlier threshold. When the real-time data has an abnormal score If an error is detected, an alarm message with the corresponding number and data will be output.

7. The method for PLC data and configuration monitoring and problem tracing according to claim 1, characterized in that: The method further includes: S9: For each operation and maintenance configuration, maintain an independent dataset and corresponding anomaly detection model; when an operation and maintenance change occurs in the PLC configuration, suspend the current operation and maintenance model and switch to the dataset and detection model corresponding to the new operation and maintenance configuration to continue data monitoring; when the PLC configuration change does not belong to any operation and maintenance configuration, mark the change as a high-risk configuration engineering change.

8. The PLC data and configuration monitoring and problem tracing method according to claim 7, characterized in that: When operations and maintenance personnel confirm that a certain high-deviation data is reasonable operations and maintenance data, the data after the confirmation time point is added to the dataset of the corresponding operations and maintenance configuration, and the anomaly detection model of the operations and maintenance configuration is retrained based on the updated dataset.

9. The PLC data and configuration monitoring and problem tracing method according to claim 1, characterized in that: In S7, the PLC operating data includes at least one of input IO data, output IO data, and PLC operating temporary variable data. Each data is classified and stored in the database according to its number, and an initial dataset for each number is constructed after multiple data collections. in, Number the data. This represents the data value collected in the j-th time for the corresponding number.

10. A PLC data and configuration monitoring and problem tracing device, characterized in that, include: The asset configuration module is used to input asset information for the PLCs to be monitored. The configuration acquisition module is used to periodically acquire the PLC's configuration project through protocol interaction, parse the configuration project into several classification blocks, calculate a unique label value for the content of each classification block, and save the classification block information and configuration project file to the local machine. The configuration comparison module is used to compare the configuration project acquired at the current time with the configuration project saved at the previous time, extract the content of the changed area, and generate a change record including the risk level. The risk classification module is used to match change records sequentially with the operation and maintenance configuration set, the potential risk configuration set, and the high risk configuration set, output the corresponding risk level and prompt information, and maintain the dynamic update of each configuration set. The data acquisition module is used to periodically acquire PLC operating data through protocol interaction, categorize and parse it by number, and store it in the database; The model training module is used to build an anomaly detection model based on each numbered dataset using the random forest method and to set anomaly score thresholds. The data monitoring module is used to score the real-time collected PLC operating data for anomalies, and outputs an alarm prompt when the anomaly score exceeds the threshold. The model switching module is used to maintain independent datasets and detection models for each operation and maintenance configuration, and automatically switch to the corresponding datasets and detection models when the operation and maintenance of the PLC configuration changes.

Images