A method for extracting a fingerprint of an industrial control system device and related apparatuses

Abstract

The application provides an industrial control system device fingerprint extraction method and related device, and belongs to the technical field of device fingerprint extraction. The application adopts an active detection mode to obtain hardware features and software features of an industrial control system device; adopts a passive detection mode to obtain network situation features of the industrial control system device; encodes the hardware features, the software features and the network situation features of the industrial control system device to obtain an industrial control system device feature vector; and obtains a fingerprint of the industrial control system device based on the industrial control system device feature vector. The application solves the problem of low extraction precision of the industrial control system device fingerprint.

Description

Technical Field

[0001] This invention belongs to the field of equipment fingerprint extraction technology, specifically relating to a method and related apparatus for extracting fingerprints from industrial control system equipment. Background Technology

[0002] Power generation control systems are core infrastructure for energy and electricity production, widely used in various power plants. With the advancement of the power Internet of Things and smart power plant construction, the boundaries of power generation control systems are becoming blurred, and their exposure is expanding, leading to security risks such as unauthorized equipment access, unauthorized replacement, firmware tampering, and spoofed terminal intrusion. Traditional device authentication relies on static identifiers such as IP (Internet Protocol) addresses, MAC (Media Access Control) addresses, and account passwords, which are easily tampered with and forged, resulting in extremely low security levels.

[0003] Existing fingerprint technology for devices has the following significant shortcomings: 1. Most of them only use a single network traffic feature or a single electrical feature, without combining the inherent physical identifier of the hardware, the fixed features of the software version, and the network service behavior features. The feature dimensions are one-sided, and it is almost impossible to distinguish between industrial control equipment of the same model and batch.

[0004] 2. Most of them use simple hash concatenation to generate static fingerprints, which do not have anti-tampering capabilities. Attackers can forge device fingerprints by modifying a few parameters.

[0005] 3. Traditional solutions cannot be adapted to the numerous multi-port and multi-protocol industrial control devices present at power generation sites. Problems such as incomplete MAC acquisition, missing protocol recognition leading to fingerprint failure, and false alarms occur frequently.

[0006] In summary, existing fingerprint technologies for power generation industrial control systems suffer from limitations such as single features, low distinguishability, susceptibility to forgery, and poor scenario adaptability. These limitations fail to meet the trusted identity management requirements of high-security power generation industrial control systems. Therefore, there is an urgent need to propose a multi-dimensional fusion, deep learning encoding, and highly stable fingerprint extraction method for power generation industrial control systems. Summary of the Invention

[0007] The purpose of this invention is to provide a method and related apparatus for fingerprint extraction of industrial control system equipment, which solves the problem of low fingerprint extraction accuracy in the prior art.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a method for fingerprint extraction of industrial control system equipment, comprising the following steps: Active detection methods are used to acquire the hardware and software characteristics of industrial control system equipment; The network situation characteristics of industrial control system equipment are obtained using passive detection methods. The hardware characteristics, software characteristics, and network status characteristics of industrial control system equipment are encoded to obtain the feature vector of industrial control system equipment. Based on the feature vectors of industrial control system equipment, the fingerprints of industrial control system equipment are obtained.

[0009] A further improvement of the present invention is that the active detection method is a soft probe, and the passive detection method includes optical mirroring or flow mirroring.

[0010] A further improvement of the present invention is that the hardware features include the device hardware model, the industrial control communication protocols supported by the device, the MAC physical address corresponding to a single or multiple network ports, the original communication message frame structure and interaction timing features of the device, the software features include the device firmware version number, the embedded operating system version number, the industrial control application software version number and the software's inherent fixed encoding, and the network situation features include the device IP address, the list of communication addresses across the entire network, the service information flow between devices, real-time data interaction behavior, the application software deployment path and deployment architecture, and the port open status features.

[0011] A further improvement of the present invention is that, before performing feature encoding on the hardware features, software features, and network situation features of the industrial control system equipment to obtain the feature vector of the industrial control system equipment, the hardware features, software features, and network situation features of the industrial control system equipment are preprocessed to obtain a standardized time-series feature sequence. The preprocessing includes data cleaning, discrete feature digitization encoding, time-series alignment, and numerical normalization processing.

[0012] A further improvement of this invention lies in that the feature encoding of the hardware characteristics, software characteristics, and network situational characteristics of the industrial control system equipment to obtain the feature vector of the industrial control system equipment is specifically as follows: The hardware characteristics, software characteristics, and network situational characteristics of the industrial control system equipment are input into a GRU (Gated Recurrent Unit) recurrent neural network for feature encoding to obtain the feature vector of the industrial control system equipment.

[0013] A further improvement of the present invention is that, after obtaining the fingerprint of the industrial control system equipment, the basic information of the industrial control system equipment is obtained, and the fingerprint of the industrial control system equipment and the basic information of the industrial control system equipment are bound and stored in the fingerprint benchmark database of the industrial control system equipment.

[0014] A further improvement of the present invention is that the basic information includes the device number, installation location, and hardware information.

[0015] Secondly, the present invention provides a fingerprint extraction system for industrial control system equipment, comprising: The first data acquisition module is used to acquire the hardware and software characteristics of industrial control system equipment using an active detection method; The second data acquisition module is used to acquire the network status characteristics of industrial control system equipment using a passive detection method. The feature encoding module is used to encode the hardware features, software features, and network status features of industrial control system equipment to obtain the feature vector of industrial control system equipment. The fingerprint generation module is used to obtain the fingerprint of industrial control system equipment based on the feature vector of the equipment.

[0016] Thirdly, the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described industrial control system device fingerprint extraction method.

[0017] Fourthly, the present invention provides a storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described industrial control system equipment fingerprint extraction method.

[0018] Compared with the prior art, the present invention has the following beneficial effects: The fingerprint extraction method for industrial control system (ICS) equipment proposed in this invention employs two approaches. First, it uses an active detection method to acquire the hardware and software characteristics of the ICS equipment, enabling rapid acquisition. Second, it uses a passive detection method to acquire the network situational characteristics of the ICS equipment, minimizing the impact on the ICS operation. This combined active and passive approach improves the acquisition speed of hardware and software characteristics while minimizing the impact on the ICS. Furthermore, this invention considers three heterogeneous characteristics—hardware, software, and network—covering the inherent physical attributes, software-defined attributes, and network interaction behavior attributes of the ICS equipment. This allows for accurate differentiation of ICS equipment of the same model, batch, and operating conditions. Third, it performs feature encoding on the hardware, software, and network situational characteristics of the ICS equipment. This operation makes the hardware, software, and network situational characteristics more targeted and effective, thereby improving the accuracy of fingerprint extraction. Attached Figure Description

[0019] Figure 1 This is a flowchart of the fingerprint extraction method for industrial control system equipment according to the present invention; Figure 2 This is a schematic diagram of the fingerprint extraction system for industrial control system equipment of the present invention; Figure 3This is a flowchart of the fingerprint extraction method for industrial control system equipment in Embodiment 5 of the present invention; Figure 4 This is a diagram of the architecture for multi-dimensional feature acquisition in Embodiment 5 of the present invention; Figure 5 This is a schematic diagram of the GRU recurrent neural network in Embodiment 5 of the present invention; Figure 6 This is a schematic diagram of the structure of the electronic device of the present invention. Detailed Implementation

[0020] To further understand the content of this invention, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments are merely illustrative and not limiting of the invention.

[0021] Example 1: The flowchart of the fingerprint extraction method for industrial control system equipment of the present invention is as follows: Figure 1 As shown, the fingerprint extraction method for industrial control system equipment of the present invention includes the following steps: S1. Use active detection methods to acquire the hardware and software characteristics of industrial control system equipment; S2. Obtain the network status characteristics of industrial control system equipment using passive detection methods; S3. Encode the hardware characteristics, software characteristics, and network status characteristics of the industrial control system equipment to obtain the feature vector of the industrial control system equipment; S4. Based on the feature vectors of industrial control system equipment, obtain the fingerprints of industrial control system equipment.

[0022] Example 2: A schematic diagram of the fingerprint extraction system for industrial control system equipment of the present invention is shown below. Figure 2 As shown, the fingerprint extraction system for industrial control system equipment of the present invention includes: The first data acquisition module is used to acquire the hardware and software characteristics of industrial control system equipment using an active detection method; The active detection method in the first data acquisition module is a soft probe.

[0023] The second data acquisition module is used to acquire the network status characteristics of industrial control system equipment using a passive detection method. The feature encoding module is used to encode the hardware features, software features, and network status features of industrial control system equipment to obtain the feature vector of industrial control system equipment. The fingerprint generation module is used to obtain the fingerprint of industrial control system equipment based on the feature vector of the equipment.

[0024] Example 3: The fingerprint extraction system for industrial control system equipment of the present invention includes: The first data acquisition module is used to acquire the hardware and software characteristics of industrial control system equipment using an active detection method; The active detection method in the first data acquisition module is a soft probe.

[0025] Hardware characteristics include the device hardware model, the industrial control communication protocols supported by the device, the MAC physical address corresponding to a single or multiple network ports, the original communication message frame structure of the device, and the interaction timing characteristics.

[0026] Software characteristics include device firmware version number, embedded operating system version number, industrial control application software version number, and inherent fixed coding of the software.

[0027] The second data acquisition module is used to acquire the network status characteristics of industrial control system equipment using a passive detection method. Network situation characteristics include device IP addresses, a list of all network communication addresses, inter-device business information flow, real-time data interaction behavior, application software deployment paths and architectures, and port open status characteristics.

[0028] The passive detection methods in the second data acquisition module include optical mirroring or flow mirroring.

[0029] The feature encoding module is used to encode the hardware features, software features, and network status features of industrial control system equipment to obtain the feature vector of industrial control system equipment. Before obtaining the feature vector of the industrial control system equipment by encoding the hardware features, software features, and network situation features of the industrial control system equipment, the feature encoding module performs preprocessing on the hardware features, software features, and network situation features of the industrial control system equipment to obtain a standardized time-series feature sequence. The preprocessing includes data cleaning, discrete feature digitization encoding, time-series alignment, and numerical normalization.

[0030] The feature encoding module encodes the hardware features, software features, and network status features of the industrial control system equipment to obtain the feature vector of the industrial control system equipment, specifically: The hardware characteristics, software characteristics, and network situational characteristics of the industrial control system equipment are input into the GRU recurrent neural network for feature encoding to obtain the feature vector of the industrial control system equipment.

[0031] The fingerprint generation module is used to obtain the fingerprint of industrial control system equipment based on the feature vector of the equipment.

[0032] After obtaining the fingerprint of the industrial control system device, the fingerprint generation module acquires the basic information of the industrial control system device, binds the fingerprint of the industrial control system device with the basic information of the industrial control system device, and stores it in the fingerprint baseline database of the industrial control system device.

[0033] Basic information includes device number, installation location, and hardware information.

[0034] Example 4: The fingerprint extraction method for industrial control system equipment of the present invention includes the following steps: S1. Active detection methods are used to acquire the hardware and software characteristics of industrial control system equipment.

[0035] The active detection method in this step is a soft probe.

[0036] Active detection methods can quickly acquire the hardware and software characteristics of industrial control system equipment.

[0037] S2. Use passive detection methods to obtain network status characteristics of industrial control system equipment.

[0038] The passive detection methods in this step include optical mirroring or flow mirroring.

[0039] Passive detection methods can reduce the impact on the operation of industrial control systems.

[0040] The hardware characteristics in this step include the device hardware model, the industrial control communication protocols supported by the device, the MAC physical address corresponding to a single or multiple network ports, the original communication message frame structure, and the interaction timing characteristics. Software characteristics include the device firmware version number, the embedded operating system version number, the industrial control application software version number, and the software's inherent fixed encoding. Network situational characteristics include the device IP address, the entire network communication address list, the inter-device service information flow, real-time data interaction behavior, the application software deployment path and architecture, and the port open status characteristics.

[0041] S3. Perform feature encoding on the hardware characteristics, software characteristics, and network status characteristics of the industrial control system equipment to obtain the feature vector of the industrial control system equipment.

[0042] Before the feature vector of the industrial control system equipment is obtained by feature encoding of the hardware features, software features and network situation features of the industrial control system equipment in this step, the hardware features, software features and network situation features of the industrial control system equipment are preprocessed to obtain a standardized time series feature sequence. The preprocessing includes data cleaning, discrete feature digitization encoding, time series alignment and numerical normalization.

[0043] This step involves feature encoding of the hardware characteristics, software characteristics, and network situational characteristics of the industrial control system equipment to obtain the feature vector of the industrial control system equipment, specifically: The hardware characteristics, software characteristics, and network situation characteristics of the industrial control system equipment are input into the GRU recurrent neural network for feature encoding to obtain the feature vector of the industrial control system equipment. S4. Based on the feature vectors of industrial control system equipment, obtain the fingerprints of industrial control system equipment.

[0044] After obtaining the fingerprint of the industrial control system device in this step, the basic information of the industrial control system device is obtained, and the fingerprint of the industrial control system device and the basic information of the industrial control system device are bound and stored in the fingerprint benchmark database of the industrial control system device.

[0045] The basic information in this step includes the device number, installation location, and hardware information.

[0046] Example 5: The following describes the method of the present invention in detail using fingerprint extraction of equipment in a power generation industrial control system as an example. The flowchart of the fingerprint extraction method for equipment in a power generation industrial control system of the present invention is as follows: Figure 3 As shown in the diagram, the architecture for multi-dimensional feature acquisition is as follows: Figure 4 As shown in the diagram, the structure of the GRU recurrent neural network is as follows: Figure 5 As shown, the fingerprint extraction method for power generation industrial control system equipment of the present invention includes the following steps: Step 1: Multi-dimensional feature acquisition Step 1 specifically includes: The hardware, software, and network characteristics of industrial control system equipment are collected to form a multi-source raw feature dataset.

[0047] Specifically, in the hardware feature acquisition layer and the software feature acquisition layer, an active detection method (soft probe) is used to acquire the hardware and software features of the industrial control system equipment.

[0048] In the network situational awareness acquisition layer, passive detection methods (optical mirroring or traffic mirroring) are used to acquire the network situational awareness characteristics of industrial control system devices.

[0049] Hardware characteristics include the device hardware model, the industrial control communication protocols supported by the device, the MAC physical address corresponding to a single or multiple network ports, the original communication message frame structure of the device, and the interaction timing characteristics.

[0050] Specifically, the hardware model is obtained by reading local parameters of the power generation industrial control system equipment. Modbus, Profinet, IEC104, and DNP3 power generation industrial control proprietary protocols are identified through power generation industrial control system protocol detection. All MAC addresses corresponding to multiple network ports of the device are collected in batches using ARP (Address Resolution Protocol) broadcast probe commands. The inherent packet format characteristics of the device are extracted through port packet capture and parsing.

[0051] Software characteristics include device firmware version number, embedded operating system version number, industrial control application software version number, and inherent fixed coding of the software.

[0052] Specifically, by remotely detecting the operation and maintenance interface of the power generation industrial control system equipment, reading the version of the power generation industrial control system, and cross-verifying it in conjunction with the official user manual of the power generation industrial control system equipment, the full-level software version characteristics and solidified coding characteristics of the equipment's underlying system, firmware, and upper-level applications are completely collected.

[0053] Network situation characteristics include device IP addresses, a list of all network communication addresses, inter-device business information flow, real-time data interaction behavior, application software deployment paths and architectures, and port open status characteristics.

[0054] Step 2: Multi-source feature preprocessing Step 2 specifically includes: The multi-source raw feature dataset is sequentially processed through data cleaning, discrete feature digitization encoding, temporal alignment, and numerical normalization to obtain a standardized temporal feature sequence. The following details the data cleaning, discrete feature digitization encoding, temporal alignment, and numerical normalization processes: Data cleaning: Remove network scanning noise, invalid ARP replies, duplicate packets, and transient network fluctuation interference data, while retaining the true inherent characteristics of the device.

[0055] Discrete feature digitization encoding: One-hot encoding is used for text features such as hardware model, protocol type, software version, and deployment type, and segmented numerical mapping is used for MAC address and IP address to achieve full digitization of heterogeneous features.

[0056] Timing alignment: Using a fixed acquisition period as the time reference, the inherent characteristics of static software and hardware are aligned with the timing characteristics of dynamic networks to construct a timing feature sequence of equal length and synchronization; Numerical normalization: All digitized features are uniformly mapped to the [0,1] numerical range to eliminate dimensional differences and adapt to the input requirements of the GRU recurrent neural network.

[0057] Step 3: GRU recurrent neural network performs feature encoding. Step 3 specifically includes: The standardized time-series feature sequence is input into the GRU recurrent neural network for feature encoding to obtain the feature vector of the power generation control system equipment.

[0058] The GRU recurrent neural network consists of an input layer, hidden layers, fully connected layers, and an output layer connected in series. The following is an explanation of the input layer, hidden layers, fully connected layers, and output layer: The input layer receives standardized temporal feature sequences. The hidden layer captures the temporal dependencies and subtle device-specific differences of multi-dimensional features through update and reset gates. The fully connected layer achieves high-dimensional feature fusion and dimensionality compression. The output layer outputs the feature vector of the power generation control system equipment (in this embodiment, the output feature vector of the power generation control system equipment is 128-dimensional).

[0059] Step 4: Fingerprint generation and storage (also known as fingerprint storage) Step 4 specifically includes: The feature vector of the power generation control system equipment output by the GRU recurrent neural network is used as the fingerprint of the power generation control system equipment. After being bound with the basic information of the power generation control system equipment, it is stored in the fingerprint benchmark database of the power generation control system equipment to complete the equipment fingerprint filing and registration.

[0060] Field tests show that the method of the present invention can achieve an accuracy rate of 99.9% in identifying multiple industrial control devices of the same model. It can effectively identify counterfeit, replaced, and tampered devices, and its stability and security meet the high safety operation requirements of the power generation industrial control system.

[0061] The method of this invention is aimed at the industrial control system of power plants that have been put into operation. It realizes a strong correlation between the inherent characteristics of the equipment at the factory, the characteristics of the operating network environment, and the characteristics of the system business traffic, which makes it difficult to forge.

[0062] The method of this invention is applicable to fingerprint extraction and trusted identity recognition of equipment such as DCS controllers, PLCs, RTUs, and remote monitoring and control terminals in thermal power, hydropower, wind power, photovoltaic, and energy storage power stations.

[0063] Compared with the prior art, the present invention has the following advantages: 1. Comprehensive feature dimensions, extremely high device differentiation Considering the heterogeneous characteristics of hardware, software, and network, and covering the inherent physical attributes, software-fixed attributes, and network interaction behavior attributes of power generation industrial control system equipment, it can accurately distinguish power generation industrial control system equipment of the same model, batch, and operating conditions.

[0064] 2. Adaptable to complex industrial control equipment scenarios It supports batch detection of MAC addresses of multiple network ports, identification of multiple industrial control protocols, and parsing of multiple service information flows, perfectly adapting to complex industrial control equipment with multiple protocols, multiple network ports, and multiple service interactions at power generation sites.

[0065] 3. Fingerprints are resistant to forgery and have high security. The feature vector fingerprint is generated by encoding a GRU recurrent neural network, rather than by simply concatenating parameters. Modifying only the IP, MAC, or software version cannot forge the device fingerprint, making its anti-attack capability far superior to traditional static fingerprints.

[0066] 4. Strong anti-interference ability and good stability Through data cleaning, time-series alignment, and normalization, network noise and instantaneous fluctuations are filtered out, resulting in long-term stable fingerprints with high matching accuracy and low false positive rate.

[0067] 5. Highly versatile and easy to implement in engineering projects It is compatible with power generation industrial control equipment in all scenarios, including thermal power, hydropower, wind power, photovoltaic power, and energy storage. The algorithm is lightweight and easy to deploy, making it suitable for large-scale power plant safety management and control applications.

[0068] Example 6: Please see Figure 6 As shown, the present invention also provides an electronic device 100 for fingerprint extraction method of industrial control system equipment; the electronic device 100 includes a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on the at least one processor 102, and at least one communication bus 104.

[0069] The memory 101 can be used to store the computer program 103. The processor 102 implements the steps of the fingerprint extraction method for industrial control system equipment described in Embodiment 1 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101. The memory 101 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device 100 (such as audio data), etc. In addition, the memory 101 may include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other non-volatile solid-state storage device.

[0070] The at least one processor 102 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor. The processor 102 is the control center of the electronic device 100, connecting various parts of the electronic device 100 via various interfaces and lines.

[0071] The memory 101 in the electronic device 100 stores multiple instructions to implement a fingerprint extraction method for industrial control system equipment, and the processor 102 can execute the multiple instructions to achieve the following: Active detection methods are used to acquire the hardware and software characteristics of industrial control system equipment; The network situation characteristics of industrial control system equipment are obtained using passive detection methods. The hardware characteristics, software characteristics, and network status characteristics of industrial control system equipment are encoded to obtain the feature vector of industrial control system equipment. Based on the feature vectors of industrial control system equipment, the fingerprints of industrial control system equipment are obtained.

[0072] Example 7: If the modules / units integrated in the electronic device 100 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0073] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0074] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0075] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0076] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for fingerprint extraction from industrial control system equipment, characterized in that, Includes the following steps: Active detection methods are used to acquire the hardware and software characteristics of industrial control system equipment; The network situation characteristics of industrial control system equipment are obtained using passive detection methods. The hardware characteristics, software characteristics, and network status characteristics of industrial control system equipment are encoded to obtain the feature vector of industrial control system equipment. Based on the feature vectors of industrial control system equipment, the fingerprints of industrial control system equipment are obtained.

2. The fingerprint extraction method for industrial control system equipment according to claim 1, characterized in that, The active detection method is a soft probe, and the passive detection method includes optical mirroring or flow mirroring.

3. The fingerprint extraction method for industrial control system equipment according to claim 1, characterized in that, The hardware features include the device hardware model, the industrial control communication protocols supported by the device, the MAC physical address corresponding to a single or multiple network ports, the original communication message frame structure and interaction timing features of the device, the software features include the device firmware version number, the embedded operating system version number, the industrial control application software version number and the software's inherent fixed encoding, and the network situation features include the device IP address, the list of communication addresses across the entire network, the service information flow between devices, real-time data interaction behavior, the application software deployment path and deployment architecture, and the port open status features.

4. The fingerprint extraction method for industrial control system equipment according to claim 1, characterized in that, Before performing feature encoding on the hardware, software, and network situation characteristics of industrial control system equipment to obtain the feature vector of the industrial control system equipment, the hardware, software, and network situation characteristics of the industrial control system equipment are preprocessed to obtain a standardized time-series feature sequence. The preprocessing includes data cleaning, discrete feature digitization encoding, time-series alignment, and numerical normalization.

5. The fingerprint extraction method for industrial control system equipment according to claim 1, characterized in that, The process of encoding the hardware characteristics, software characteristics, and network situational characteristics of the industrial control system equipment to obtain the feature vector of the industrial control system equipment is as follows: The hardware characteristics, software characteristics, and network situational characteristics of the industrial control system equipment are input into the GRU recurrent neural network for feature encoding to obtain the feature vector of the industrial control system equipment.

6. The fingerprint extraction method for industrial control system equipment according to claim 1, characterized in that, After obtaining the fingerprint of the industrial control system equipment, the basic information of the industrial control system equipment is obtained, and the fingerprint of the industrial control system equipment and the basic information of the industrial control system equipment are bound and stored in the fingerprint baseline database of the industrial control system equipment.

7. The fingerprint extraction method for industrial control system equipment according to claim 6, characterized in that, The basic information includes the device number, installation location, and hardware information.

8. A fingerprint extraction system for industrial control system equipment, characterized in that, include: The first data acquisition module is used to acquire the hardware and software characteristics of industrial control system equipment using an active detection method; The second data acquisition module is used to acquire the network status characteristics of industrial control system equipment using a passive detection method. The feature encoding module is used to encode the hardware features, software features, and network status features of industrial control system equipment to obtain the feature vector of industrial control system equipment. The fingerprint generation module is used to obtain the fingerprint of industrial control system equipment based on the feature vector of the equipment.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the industrial control system equipment fingerprint extraction method according to any one of claims 1 to 7.

10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the industrial control system equipment fingerprint extraction method according to any one of claims 1 to 7.

Images