Industrial internet-based industrial control audit method and apparatus

Abstract

The present disclosure provides an Industrial Internet-based industrial control audit method and apparatus. The method comprises: by means of the similarity between industrial control protocol data and protocol rule templates of various types of industrial control protocols in a protocol database, determining a protocol rule template corresponding to the industrial control protocol data; on the basis of the protocol rule template corresponding to the industrial control protocol data, parsing control information of the industrial control protocol data, and determining a first audit result on the basis of the control information of the industrial control protocol data, complete message data, and data area message data; determining a second audit result on the basis of a statistical feature of network traffic per unit time in network behavior data, and / or on the basis of the difference between current running program information and historical running program information in the network behavior data; performing level evaluation of a network security event on the basis of the first audit result and the second audit result, to obtain a network security evaluation result of a time period to be audited. It is thus possible to determine whether a network security event has occurred in an industrial control network in a timely and accurate manner.

Description

Industrial internet-based industrial control auditing method and device

[0001] Cross-reference to Related Applications

[0002] The present disclosure claims priority to the Chinese patent application No. 2024108821113, filed on July 3, 2024, and entitled "Industrial internet-based industrial control auditing method and device", the entire content of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present disclosure relates to the technical field of network data auditing, and in particular to an industrial internet-based industrial control auditing method and device. BACKGROUND

[0004] With the rise of the concept of Industry 4.0 and the proposal of Made in China 2025, the integration process of industrial internet and information network is accelerating. Traditional network communication technology has been widely used in industrial control networks. Industrial internet is developing towards a direction of comprehensive interconnection of man-machine-objects, gradually changing from the original interconnection mode for human-human interaction. This change not only expands the function and boundary of the existing network space, but also subverts the closed pattern of traditional industrial control systems. Between the control layer, device layer, network layer and other levels of industrial internet, security problems are increasingly prominent, and security risks are constantly added, forming a complex security situation.

[0005] Specifically, with the rise of hacker conferences, white hat communities and open source communities, it has become easier to attack industrial control systems. A large number of security vulnerabilities and exploitation methods of industrial control system software and hardware devices can be obtained through public or semi-public channels, which greatly increases the risk of industrial control network attacks. This trend has made the security of industrial control systems face unprecedented challenges, and the current manual auditing method cannot meet the current application requirements, and a more comprehensive and efficient network security auditing strategy is needed to cope with it. SUMMARY

[0006] The present disclosure provides an industrial internet-based industrial control auditing method and device to solve the defects of insufficient accuracy and efficiency of industrial control system security auditing in the prior art.

[0007] The present disclosure provides an industrial internet-based industrial control auditing method, comprising:

[0008] obtaining industrial control protocol data and network behavior data in a to-be-audited time period;

[0009] determine a protocol rule template corresponding to the industrial control protocol data based on similarity between the industrial control protocol data and protocol rule templates of various types of industrial control protocols in the protocol database, analyze control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determine a first audit result based on the control information of the industrial control protocol data, complete message data, and data area message data of the industrial control protocol data;

[0010] determine a second audit result based on statistical characteristics of network traffic of each unit of time in the network behavior data, and / or based on differences between current running program information and historical running program information in the network behavior data;

[0011] perform level evaluation on a network security event based on the first audit result and the second audit result, and obtain a network security evaluation result of the to-be-audited time period.

[0012] According to the industrial internet-based industrial control audit method provided by the present disclosure, the first audit result is determined based on the control information, complete message data, and data area message data of the industrial control protocol data, which includes:

[0013] determine a control anomaly analysis result of the industrial control protocol data based on sample control information of sample industrial control protocol data labeled as normal and the control information of the industrial control protocol data;

[0014] perform anomaly analysis on the complete message data of the industrial control protocol data based on a trained global anomaly analysis model, and obtain a complete message anomaly analysis result of the industrial control protocol data; wherein the global anomaly analysis model is trained based on sample complete message data of sample industrial control protocol data and labels of the sample industrial control protocol data;

[0015] perform anomaly analysis on the data area message data of the industrial control protocol data based on a trained local anomaly analysis model, and obtain a data area message anomaly analysis result of the industrial control protocol data; wherein the local anomaly analysis model is trained based on sample data area message data of sample industrial control protocol data and labels of the sample industrial control protocol data;

[0016] determine the first audit result based on the control anomaly analysis result, the complete message anomaly analysis result, and the data area message anomaly analysis result of the industrial control protocol data.

[0017] According to the industrial internet-based industrial control audit method provided by the present disclosure, the similarity between the industrial control protocol data and the protocol rule template of any type of industrial control protocol in the protocol database is determined based on the following steps:

[0018] determine all common subsequences and the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol;

[0019] determine a difference factor based on the sequence length of the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and the sequence length of the industrial control protocol data and the protocol rule template of any type of industrial control protocol;

[0020] determine a sequence consistency factor based on the sum of the sequence lengths of all common subsequences between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, the sequence length of the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and the difference factor;

[0021] calculate the edit distance between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and determine a sequence similarity factor based on the sequence length of the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and the edit distance between the industrial control protocol data and the protocol rule template of any type of industrial control protocol;

[0022] determine the similarity between the industrial control protocol data and the protocol rule template of any type of industrial control protocol based on the sequence consistency factor and the sequence similarity factor.

[0023] According to the industrial control auditing method based on the industrial internet provided by the present disclosure, the protocol rule templates of various types of industrial control protocols in the protocol database are constructed based on the following steps:

[0024] characteristic extraction step: extract the text features of each sample industrial control protocol data in the protocol database; wherein the text features of any sample industrial control protocol data are determined based on the word frequency and inverse document frequency of each sentence segment in the sample industrial control protocol data;

[0025] clustering step: based on the current cluster number setting value, cluster each sample industrial control protocol data in combination with the text features of each sample industrial control protocol data, obtain a plurality of current clusters, and obtain the clustering center of each cluster;

[0026] iteration step: evaluate the plurality of current clusters to obtain a current clustering evaluation value; if the current clustering evaluation value is greater than a current best evaluation value, update the current best evaluation value based on the current clustering evaluation value, and update the current best clustering cluster and the clustering center of each current best clustering cluster based on the plurality of current clusters and their clustering centers; increase the current cluster number setting value, and repeat the clustering step until the current cluster number setting value reaches a preset value;

[0027] Template determining step: determining the protocol rule templates of each industrial control protocol based on the cluster centers of each current best cluster class cluster.

[0028] According to the industrial internet-based industrial control auditing method provided by the present disclosure, the second auditing result is determined based on the statistical characteristics of network traffic of each unit time in the network behavior data, and / or based on the difference between the current running program information and the historical running program information in the network behavior data, including:

[0029] The network traffic anomaly analysis result is determined based on the statistical characteristics of network traffic of each unit time in the network behavior data; wherein the statistical characteristics include the average value, variance and quantile of network traffic of each unit time;

[0030] And / or, based on the current running program information and the historical running program information in the historical time period in the network behavior data, the current running program information that does not match the historical running program information is determined as a suspected abnormal running program; based on the running frequency of the suspected abnormal running program in each unit time of the to-be-audited time period and the memory information of the suspected abnormal running program, the running program anomaly analysis result is determined;

[0031] The second auditing result is determined based on the network traffic anomaly analysis result and / or the running program anomaly analysis result.

[0032] According to the industrial internet-based industrial control auditing method provided by the present disclosure, the determination of the second auditing result further includes:

[0033] If the network traffic anomaly analysis result or the running program anomaly analysis result is abnormal, a network security alarm is issued under the premise of uninterrupted power supply and uninterrupted network;

[0034] If the network traffic anomaly analysis result and the running program anomaly analysis result are both abnormal, a network security alarm is issued under the premise of uninterrupted power supply and interrupted network.

[0035] According to the industrial internet-based industrial control auditing method provided by the present disclosure, the network security event is graded based on the first auditing result and the second auditing result, and the network security evaluation result of the to-be-audited time period is obtained, including:

[0036] The third auditing result is determined based on the binding state of IP address and MAC address in the to-be-audited time period, the access relationship between at least two devices and the devices appearing in the industrial control network;

[0037] based on the first audit result, the second audit result and the third audit result, a network security event is graded to obtain a network security evaluation result of the to-be-audited time period.

[0038] The present disclosure also provides an industrial internet-based industrial control audit device, comprising:

[0039] a data acquisition unit configured to acquire industrial control protocol data and network behavior data in a to-be-audited time period;

[0040] a first audit unit configured to determine a protocol rule template corresponding to the industrial control protocol data based on a similarity between the industrial control protocol data and protocol rule templates of various types of industrial control protocols in a protocol database, parse control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determine a first audit result based on the control information of the industrial control protocol data, complete message data and data area message data;

[0041] a second audit unit configured to determine a second audit result based on statistical features of network traffic of each unit time in the network behavior data, and / or based on a difference between current running program information and historical running program information in the network behavior data;

[0042] a security evaluation unit configured to grade a network security event based on the first audit result and the second audit result to obtain a network security evaluation result of the to-be-audited time period.

[0043] The present disclosure also provides an electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the above-mentioned any one industrial internet-based industrial control audit method when executing the program.

[0044] The present disclosure also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to implement the above-mentioned any one industrial internet-based industrial control audit method.

[0045] The present disclosure also provides a computer program product comprising a computer program, wherein the computer program is executable by a processor to implement the above-mentioned any one industrial internet-based industrial control audit method.

[0046] The industrial internet-based industrial control auditing method and device provided by the present disclosure determines the protocol rule template corresponding to the industrial control protocol data according to the similarity between the industrial control protocol data and the protocol rule templates of various industrial control protocols in the protocol database, analyzes the control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determines a first auditing result based on the control information of the industrial control protocol data, the complete message data, and the data area message data. A second auditing result is determined based on the statistical characteristics of the network traffic of each unit time in the network behavior data and / or based on the difference between the current running program information and the historical running program information in the network behavior data. The network security event is graded and evaluated based on the first auditing result and the second auditing result, and the network security evaluation result of the to-be-audited time period is obtained. Through the double industrial control security auditing of the industrial control protocol data and the network behavior data, it can be determined whether a network security event occurs in the industrial control network in a timely and accurate manner, thereby greatly reducing the risk of network attacks on the industrial control network. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the present disclosure or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor.

[0048] FIG. 1 is a flowchart of the industrial internet-based industrial control auditing method provided by the present disclosure;

[0049] FIG. 2 is a flowchart of the first auditing result determination method provided by the present disclosure;

[0050] FIG. 3 is a flowchart of the similarity calculation method provided by the present disclosure;

[0051] FIG. 4 is a structural diagram of the industrial internet-based industrial control auditing device provided by the present disclosure;

[0052] FIG. 5 is a structural diagram of the electronic device provided by the present disclosure. DETAILED DESCRIPTION

[0053] In order to make the objectives, technical solutions, and advantages of the present disclosure clearer, the technical solutions in the present disclosure will be described clearly and completely below with reference to the drawings in the present disclosure. Obviously, the described embodiments are some embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present disclosure.

[0054] FIG. 1 is a flowchart of an industrial control audit method based on an industrial internet provided by the present disclosure, as shown in FIG. 1, the method comprises:

[0055] Step 110, obtaining industrial control protocol data and network behavior data in a to-be-audited time period;

[0056] Step 120, determining a protocol rule template corresponding to the industrial control protocol data based on a similarity between the industrial control protocol data and protocol rule templates of various types of industrial control protocols in a protocol database, analyzing control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determining a first audit result based on the control information of the industrial control protocol data, complete packet data, and data area packet data;

[0057] Step 130, determining a second audit result based on statistical characteristics of network traffic of each unit time in the network behavior data, and / or based on a difference between current running program information and historical running program information in the network behavior data;

[0058] Step 140, performing level evaluation on a network security event based on the first audit result and the second audit result, to obtain a network security evaluation result of the to-be-audited time period.

[0059] Here, the industrial control protocol data and the network behavior data are two important types of data generated in an industrial control system (ICS). Among them, the devices and controllers in the industrial control system usually communicate and interact through specific protocols, and these protocols are usually designed for the industrial control field. Therefore, the industrial control protocol data includes commands, data, and state information transmitted between devices, and is the basis for the normal operation and interaction of the control system. The industrial control system is usually deployed in a network environment, and devices communicate through the network. Therefore, the network behavior data is the data traffic generated by the industrial control devices in the network, including communication between devices, transmission of control commands, and transmission of data. These data can be captured and analyzed by network packet capture tools or network traffic monitoring devices. It can be seen that the industrial control protocol data and the network behavior data in the to-be-audited time period are very important for the security audit and monitoring of the industrial control system. By analyzing these data, security risks, abnormal behaviors, and potential attacks in the system can be identified, helping to discover and respond to security threats in a timely manner and ensuring the safe and stable operation of the industrial control system.

[0060] Specifically, for the industrial control protocol data, a similarity between the industrial control protocol data and protocol rule templates of various types of industrial control protocols in the pre-constructed protocol database can be calculated to determine a protocol rule template corresponding to the industrial control protocol data, so that the industrial control protocol data can be parsed based on the protocol rule template corresponding to the industrial control protocol data to determine control information of the industrial control protocol data, and a first audit result can be determined based on the control information of the industrial control protocol data, complete message data corresponding to the industrial control protocol data, and data area message data (i.e., message data of the data area part). The control information of the industrial control protocol data includes control commands, control points, and control values, etc. In some embodiments, if the similarity between the industrial control protocol data and the protocol rule templates of various types of industrial control protocols in the pre-constructed protocol database is low, it is determined that the format of the industrial control protocol data does not match the formats of various types of industrial control protocols, and the first audit result can be directly determined as abnormal.

[0061] In some embodiments, as shown in FIG. 2, the first audit result can be determined by the following steps:

[0062] Step 210, based on the sample control information of the sample industrial control protocol data labeled as normal and the control information of the industrial control protocol data, a control abnormality analysis result of the industrial control protocol data is determined.

[0063] Step 220, based on the trained global abnormality analysis model, the complete message data of the industrial control protocol data is subjected to abnormality analysis to obtain a complete message abnormality analysis result of the industrial control protocol data; wherein the global abnormality analysis model is trained based on the sample complete message data of the sample industrial control protocol data and the label of the sample industrial control protocol data.

[0064] Step 230, based on the trained local abnormality analysis model, the data area message data of the industrial control protocol data is subjected to abnormality analysis to obtain a data area message abnormality analysis result of the industrial control protocol data; wherein the local abnormality analysis model is trained based on the sample data area message data of the sample industrial control protocol data and the label of the sample industrial control protocol data.

[0065] Step 240, based on the control abnormality analysis result, the complete message abnormality analysis result, and the data area message abnormality analysis result of the industrial control protocol data, the first audit result is determined.

[0066] Here, before the formal audit, sample industrial protocol data generated in the normal operation of the equipment can be collected in advance, and the label of the sample industrial protocol data at this time is normal. Since the control information generated by the equipment in the stable operation of the industrial control system is also stable, the control abnormality analysis result of the industrial protocol data can be determined based on the sample control information of the sample industrial protocol data labeled as normal and the control information of the industrial protocol data to be audited. In some embodiments, if the control information of the industrial protocol data to be audited does not appear in the sample control information of the sample industrial protocol data labeled as normal, it can be determined that the control abnormality analysis result is abnormal.

[0067] On the other hand, the global abnormality analysis model can also be used to analyze the complete message data of the industrial protocol data, and the local abnormality analysis model can also be used to analyze the data area message data of the industrial protocol data, so as to obtain the complete message abnormality analysis result and the data area message abnormality analysis result of the industrial protocol data, respectively. By analyzing the complete message data and the data area message data of the industrial protocol data, respectively, the global information of the complete message and the local information of the data area message data can be detected from two directions, respectively. Subsequently, based on the control abnormality analysis result, the complete message abnormality analysis result and the data area message abnormality analysis result of the industrial protocol data, the first audit result is determined comprehensively. It can be seen that by further detecting the abnormality of the industrial protocol data from the perspective of the message data, the control abnormality analysis result from the perspective of the control information can be supplemented, thereby improving the accuracy of the abnormality detection result of the industrial protocol data. It should be noted that the global abnormality analysis model and the local abnormality analysis model can be constructed based on a neural network (such as an autoencoder, a long short-term memory network, etc.), and trained based on the sample complete message data of the sample industrial protocol data and the label of the sample industrial protocol data, and the sample data area message data of the sample industrial protocol data and the label of the sample industrial protocol data, respectively.

[0068] In order to accurately analyze the abnormality of the industrial protocol data, the correct parsing of the industrial protocol data is the core, and the basis for determining whether the industrial protocol data can be correctly parsed is to accurately determine the protocol rule template corresponding to the industrial protocol data. Therefore, in order to ensure the accuracy of the abnormality analysis of the industrial protocol data, an efficient and accurate similarity measurement method is proposed to determine the similarity between the industrial protocol data and the protocol rule templates of various industrial protocols in the protocol database, and the accuracy and efficiency of the similarity measurement are improved by combining the similarity of character position, the similarity of character sequence and structure, and the continuity of text.

[0069] Specifically, as shown in FIG. 3, the similarity between the industrial control protocol data and the protocol rule template of any type of industrial control protocol in the protocol database can be determined by the following steps:

[0070] Step 310, determining all common subsequences and the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol;

[0071] Step 320, determining a difference factor based on the sequence length of the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and the sequence lengths of the industrial control protocol data and the protocol rule template of any type of industrial control protocol;

[0072] Step 330, determining a sequence consistency factor based on the sum of the sequence lengths of all common subsequences between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, the sequence lengths of the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and the difference factor;

[0073] Step 340, calculating the edit distance between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and determining a sequence similarity factor based on the sequence length of the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and the edit distance between the industrial control protocol data and the protocol rule template of any type of industrial control protocol;

[0074] Step 350, determining the similarity between the industrial control protocol data and the protocol rule template of any type of industrial control protocol based on the sequence consistency factor and the sequence similarity factor.

[0075] Here, all common subsequences and the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol can be determined. A difference factor can be determined based on the sequence length of the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and the sequence lengths of the industrial control protocol data and the protocol rule template of any type of industrial control protocol. The difference factor is configured to limit the repeated influence of the longest common subsequence and the common subsequences on the similarity. In some embodiments, the difference factor can be calculated by the following formula: d = 1 - a x L LCS / (p + q)

[0076] where d is the difference factor, L LCS is the sequence length of the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, p is the sequence length of the industrial control protocol data, q is the sequence length of the protocol rule template of any type of industrial control protocol, and a is a first adjustment factor which can be preset.

[0077] Subsequently, a sequence consistency factor can be determined based on the sum of sequence lengths of all common subsequences between the industrial protocol data and the protocol rule template of the type of industrial protocol, the sequence length of the industrial protocol data and the protocol rule template of the type of industrial protocol, and the difference factor obtained above. The sequence consistency factor can reflect the influence of continuous consistency on the text similarity. In some embodiments, the sequence consistency factor can be calculated using the following formula: suc = β × d × Sop(D, T) / (p + q)

[0078] wherein suc is the sequence consistency factor, Sop(D, T) is the sum of sequence lengths of all common subsequences between the industrial protocol data D and the protocol rule template T of the type of industrial protocol, and β is a second adjustment factor, which can be pre-set.

[0079] The edit distance between the industrial protocol data and the protocol rule template of the type of industrial protocol is calculated, and a sequence similarity factor is determined based on the sequence length of the longest common subsequence between the industrial protocol data and the protocol rule template of the type of industrial protocol and the edit distance between the industrial protocol data and the protocol rule template of the type of industrial protocol. Here, the sequence similarity factor takes into account the longest common subsequence and the edit distance between two texts, and reflects the similarity of character positions and the similarity of character sequences and structures between two texts. In some embodiments, the sequence similarity factor can be calculated using the following formula: sos = L LCS +(max(p, q) - L ED )

[0080] wherein sos is the sequence similarity factor, and LED is the edit distance between the industrial protocol data and the protocol rule template of the type of industrial protocol.

[0081] Based on the sequence consistency factor and the sequence similarity factor, the similarity between the industrial protocol data and the protocol rule template of the type of industrial protocol can be determined. For example, the sequence consistency factor and the sequence similarity factor can be summed or weighted summed to obtain the similarity between the industrial protocol data and the protocol rule template of the type of industrial protocol.

[0082] In other embodiments, the protocol rule templates of various types of industrial protocols in the protocol database can be constructed based on the following steps:

[0083] a feature extraction step of extracting text features of each sample industrial protocol data in the protocol database; wherein the text features of each sample industrial protocol data are determined based on the term frequency and inverse document frequency of each sentence segment in the sample industrial protocol data;

[0084] The clustering step: based on the current cluster number setting value, the text features of each sample industrial control protocol data are combined to cluster each sample industrial control protocol data, to obtain a plurality of current clusters, and to obtain the clustering centers of each cluster;

[0085] The iteration step: the current clustering evaluation value is obtained by evaluating the plurality of current clusters; if the current clustering evaluation value is greater than the current best evaluation value, the current best evaluation value is updated based on the current clustering evaluation value, and the current best clustering cluster and the clustering center of each current best clustering cluster are updated based on the plurality of current clusters and the clustering centers thereof; the current cluster number setting value is increased, and the clustering step is repeated until the current cluster number setting value reaches a preset value.

[0086] The template determination step: based on the clustering center of each current best clustering cluster, the protocol rule templates of each industrial control protocol are determined.

[0087] Specifically, in the feature extraction step, the term frequency and inverse document frequency of each segment in each sample industrial control protocol data can be extracted (the sample industrial control protocol data can be segmented based on a predetermined rule to obtain a plurality of segments), and the text features of each sample industrial control protocol data can be extracted based on the TF-IDF method. Wherein, for any sample industrial control protocol data, the ratio of the number of occurrences of any segment in the sample industrial control protocol data to the total number of segments in the sample industrial control protocol data can be taken as the term frequency of the segment; the logarithm of the ratio of the total number of sample industrial control protocol data in the protocol database to the number of sample industrial control protocol data containing any segment in the protocol database can be taken as the inverse document frequency of the segment. Then, the product of the term frequency and the inverse document frequency of any segment is taken as the feature value of the segment, and the vector composed of the feature values of all segments in any sample industrial control protocol data is the text feature of the sample industrial control protocol data.

[0088] Subsequently, the clustering can be iterated and the clustering centers of the respective clusters can be determined. In one iteration process, the number of current clusters can be set based on the number of cluster setting value (1 in the initial case), and the clustering algorithm (such as the KMeans algorithm) can be used to cluster the sample industrial protocol data based on the text features of the sample industrial protocol data, to obtain a plurality of current clusters, and to obtain the clustering centers of the respective clusters. Here, for any cluster, the sample industrial protocol data with the smallest sum of edit distances between the text features of other sample industrial protocol data in the cluster can be obtained as the clustering center of the cluster. Subsequently, the current clustering evaluation value can be obtained by clustering evaluation of the plurality of current clusters. Here, the current clustering evaluation value can be determined based on the silhouette coefficient. If the current clustering evaluation value is greater than the current best evaluation value (0 in the initial case), the current best evaluation value is updated based on the current clustering evaluation value, and the current best clustering cluster and the clustering center of each current best clustering cluster (the current best clustering cluster and the clustering center of each current best clustering cluster are empty in the initial case) are updated based on the plurality of current clusters and their clustering centers. If the number of current cluster setting values has reached the preset value, the iteration process is ended; otherwise, the number of current cluster setting values is increased (for example, by 1), and the next iteration process is entered, and the above clustering steps are executed again. After iteration, the protocol rule templates of the respective industrial protocols can be determined based on the clustering centers of the respective current best clustering clusters, thereby improving the extraction efficiency of the protocol rule templates of the respective industrial protocols.

[0089] For network behavior data, a second audit result can be determined based on the statistical characteristics of network traffic of each unit time in the network behavior data, and / or based on the difference between the current running program information and the historical running program information in the network behavior data. Specifically, the network behavior data can include at least one of the network traffic of each unit time and the current running program information of each unit time. The statistical characteristics of network traffic of each unit time in the network behavior data can be used for anomaly analysis, the difference between the current running program information and the historical running program information in the network behavior data can be used for anomaly analysis, and the statistical characteristics of network traffic of each unit time in the network behavior data and the difference between the current running program information and the historical running program information in the network behavior data can be used for anomaly analysis together, which is not limited in the embodiments of the present disclosure.

[0090] In some embodiments, the statistical characteristics of the network traffic of each unit time in the network behavior data can include the mean, variance and quantile of the network traffic of each unit time. The network traffic anomaly analysis result can be determined by comparing the statistical characteristics of the network traffic of each unit time in the network behavior data with the preset threshold range. Here, if the statistical characteristics of the network traffic of any unit time in the network behavior data are not within the preset threshold range, the network traffic anomaly analysis result can be determined as abnormal.

[0091] In addition, based on the current running program information in the network behavior data and the historical running program information in the historical time period, the current running program information in the network behavior data that does not match the historical running program information can be determined as a suspected abnormal running program, i.e., the suspected abnormal running program does not appear in the historical time period. Based on the number of running times of the suspected abnormal running program in each unit time of the to-be-audited time period and the memory information of the suspected abnormal running program, the running program anomaly analysis result can be determined. If the number of running times of the suspected abnormal running program in the unit time of the preset length time period increases, the running program anomaly analysis result can be determined as abnormal; otherwise, the memory information of the suspected abnormal running program can be obtained through the debugger, and the running program anomaly analysis result can be determined based on the memory information of the suspected abnormal running program.

[0092] Based on the network traffic anomaly analysis result and / or the running program anomaly analysis result, the second audit result can be determined. In some embodiments, after the second audit result is determined, corresponding processing measures can be taken. Specifically, if the network traffic anomaly analysis result or the running program anomaly analysis result is abnormal, a network security alarm can be issued under the premise of uninterrupted power supply and uninterrupted network to enable technical personnel to remove malicious software and repair vulnerabilities; if both the network traffic anomaly analysis result and the running program anomaly analysis result are abnormal, a network security alarm can be issued under the premise of network interruption and uninterrupted power supply to enable technical personnel to remove malicious software and repair vulnerabilities.

[0093] By integrating the first audit result and the second audit result, the network security event can be evaluated based on a preset rule to obtain the network security evaluation result of the to-be-audited time period, so that the network security evaluation result can be sent to the staff for timely processing. That is, the industrial control protocol data and the network behavior data are subjected to double industrial control security auditing in the embodiments of the present disclosure, which can timely and accurately determine whether a network security event occurs in the industrial control network and timely notify the staff for processing, thereby greatly reducing the risk of network attacks on the industrial control network.

[0094] In some embodiments, in addition to the dual industrial control security audit of the industrial control protocol data and the network behavior data, a third audit result can be determined based on the binding state of the IP address and the MAC address in the to-be-audited time period, the access relationship between at least two devices, and the device appearing in the industrial control network, so as to comprehensively evaluate the network security event based on the first audit result, the second audit result and the third audit result, and obtain the network security evaluation result of the to-be-audited time period. Wherein, the security audit can be performed on whether the IP address and the MAC address binding change, the security audit can be performed on whether the access relationship between at least two devices changes, and the security audit can be performed on whether unknown devices appear in the industrial control network.

[0095] In summary, the method provided by the embodiments of the present disclosure determines the protocol rule template corresponding to the industrial control protocol data through the similarity between the industrial control protocol data and the protocol rule templates of various industrial control protocols in the protocol database, analyzes the control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determines the first audit result based on the control information of the industrial control protocol data, the complete message data and the data area message data; determines the second audit result based on the statistical characteristics of the network traffic of each unit time in the network behavior data, and / or based on the difference between the current running program information and the historical running program information in the network behavior data; thereby, the network security event is evaluated based on the first audit result and the second audit result, and the network security evaluation result of the to-be-audited time period is obtained. Through the dual industrial control security audit of the industrial control protocol data and the network behavior data, it can be determined whether a network security event occurs in the industrial control network in a timely and accurate manner, thereby greatly reducing the risk of network attack on the industrial control network.

[0096] The industrial internet-based industrial control audit device provided by the present disclosure is described below. The industrial internet-based industrial control audit device described below can be referred to in correspondence with the industrial internet-based industrial control audit method described above.

[0097] Based on any of the above embodiments, FIG. 4 is a structural schematic diagram of an industrial internet-based industrial control audit device provided by the present disclosure, as shown in FIG. 4, the device comprises:

[0098] The data acquisition unit 410 is configured to acquire industrial control protocol data and network behavior data in a to-be-audited time period;

[0099] The first audit unit 420 is configured to determine a protocol rule template corresponding to the industrial control protocol data based on similarity between the industrial control protocol data and protocol rule templates of various industrial control protocols in a protocol database, parse control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determine a first audit result based on the control information of the industrial control protocol data, complete message data, and data area message data.

[0100] The second audit unit 430 is configured to determine a second audit result based on statistical characteristics of network traffic of each unit time in the network behavior data, and / or based on differences between current running program information and historical running program information in the network behavior data.

[0101] The security evaluation unit 440 is configured to perform level evaluation on a network security event based on the first audit result and the second audit result, to obtain a network security evaluation result of the to-be-audited time period.

[0102] The apparatus provided by the embodiments of the present disclosure determines a protocol rule template corresponding to industrial control protocol data based on similarity between the industrial control protocol data and protocol rule templates of various industrial control protocols in a protocol database, parses control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determines a first audit result based on the control information of the industrial control protocol data, complete message data, and data area message data. A second audit result is determined based on statistical characteristics of network traffic of each unit time in network behavior data, and / or based on differences between current running program information and historical running program information in the network behavior data. The network security event is evaluated based on the first audit result and the second audit result, to obtain a network security evaluation result of the to-be-audited time period. Through double industrial control security audit on the industrial control protocol data and the network behavior data, it can be determined whether a network security event occurs in the industrial control network in a timely and accurate manner, thereby greatly reducing the risk of network attack on the industrial control network.

[0103] Based on any of the above embodiments, the first audit result is determined based on the control information of the industrial control protocol data, the complete message data, and the data area message data, including:

[0104] The control anomaly analysis result of the industrial control protocol data is determined based on sample control information of sample industrial control protocol data labeled as normal and the control information of the industrial control protocol data.

[0105] performing abnormality analysis on complete message data of the industrial protocol data based on a trained global abnormality analysis model to obtain a complete message abnormality analysis result of the industrial protocol data, wherein the global abnormality analysis model is trained based on sample complete message data of sample industrial protocol data and labels of the sample industrial protocol data;

[0106] performing abnormality analysis on data area message data of the industrial protocol data based on a trained local abnormality analysis model to obtain a data area message abnormality analysis result of the industrial protocol data, wherein the local abnormality analysis model is trained based on sample data area message data of sample industrial protocol data and labels of the sample industrial protocol data;

[0107] determining the first audit result based on the control abnormality analysis result, the complete message abnormality analysis result and the data area message abnormality analysis result of the industrial protocol data.

[0108] According to any of the above embodiments, the similarity between the industrial protocol data and a protocol rule template of any type of industrial protocol in the protocol database is determined based on the following steps:

[0109] determining all common subsequences and the longest common subsequence between the industrial protocol data and the protocol rule template of any type of industrial protocol;

[0110] determining a difference factor based on the sequence length of the longest common subsequence between the industrial protocol data and the protocol rule template of any type of industrial protocol, and the sequence length of the industrial protocol data and the protocol rule template of any type of industrial protocol;

[0111] determining a sequence consistency factor based on the sum of the sequence lengths of all common subsequences between the industrial protocol data and the protocol rule template of any type of industrial protocol, the sequence length of the industrial protocol data and the protocol rule template of any type of industrial protocol, and the difference factor;

[0112] calculating the edit distance between the industrial protocol data and the protocol rule template of any type of industrial protocol, and determining a sequence similarity factor based on the sequence length of the longest common subsequence between the industrial protocol data and the protocol rule template of any type of industrial protocol and the edit distance between the industrial protocol data and the protocol rule template of any type of industrial protocol;

[0113] determining the similarity between the industrial protocol data and the protocol rule template of any type of industrial protocol based on the sequence consistency factor and the sequence similarity factor.

[0114] Based on any of the above embodiments, the protocol rule templates of each type of industrial control protocol in the protocol database are constructed based on the following steps:

[0115] a feature extraction step of extracting text features of each sample industrial control protocol data in the protocol database; wherein the text features of any sample industrial control protocol data are determined based on the word frequency and inverse document frequency of each segment in the any sample industrial control protocol data;

[0116] a clustering step of clustering each sample industrial control protocol data based on the current cluster number setting value and the text features of each sample industrial control protocol data, obtaining a plurality of current clusters, and obtaining the cluster centers of each cluster;

[0117] an iteration step of evaluating the plurality of current clusters to obtain a current clustering evaluation value; if the current clustering evaluation value is greater than a current best evaluation value, updating the current best evaluation value based on the current clustering evaluation value, and updating the current best clustering clusters and the cluster centers of each current best clustering cluster based on the plurality of current clusters and their cluster centers; increasing the current cluster number setting value, and repeating the clustering step until the current cluster number setting value reaches a preset value;

[0118] a template determination step of determining the protocol rule templates of each type of industrial control protocol based on the cluster centers of each current best clustering cluster.

[0119] Based on any of the above embodiments, the second audit result is determined based on the statistical characteristics of the network traffic of each unit time in the network behavior data, and / or based on the difference between the current running program information and the historical running program information in the network behavior data, including:

[0120] determining a network traffic anomaly analysis result based on the statistical characteristics of the network traffic of each unit time in the network behavior data; wherein the statistical characteristics include the mean, variance and quantile of the network traffic of each unit time;

[0121] and / or, based on the current running program information and the historical running program information in the historical time period in the network behavior data, determining the current running program information that does not match the historical running program information as a suspected abnormal running program; based on the running frequency of the suspected abnormal running program in each unit time of the to-be-audited time period, and the memory information of the suspected abnormal running program, determining a running program anomaly analysis result;

[0122] based on the network traffic anomaly analysis result and / or the running program anomaly analysis result, determining the second audit result.

[0123] Based on any of the above embodiments, the device further comprises an exception handling unit configured to perform the following after determining the second audit result:

[0124] If the network traffic anomaly analysis result or the running program anomaly analysis result is abnormal, a network security alarm is issued under the premise of uninterrupted power supply and uninterrupted network;

[0125] If the network traffic anomaly analysis result and the running program anomaly analysis result are both abnormal, a network security alarm is issued under the premise of uninterrupted power supply and network interruption.

[0126] Based on any of the above embodiments, the network security event is graded based on the first audit result and the second audit result to obtain a network security evaluation result of the to-be-audited time period, comprising:

[0127] Based on the binding state of the IP address and the MAC address in the to-be-audited time period, the access relationship between at least two devices, and the devices appearing in the industrial control network, a third audit result is determined;

[0128] The network security event is graded based on the first audit result, the second audit result, and the third audit result to obtain a network security evaluation result of the to-be-audited time period.

[0129] Figure 5 is a structural schematic diagram of an electronic device provided by the present disclosure. As shown in Figure 5, the electronic device can include a processor 510, a memory 520, a communications interface 530, and a communications bus 540, wherein the processor 510, the memory 520, and the communications interface 530 communicate with each other through the communications bus 540. The processor 510 can invoke logical instructions in the memory 520 to execute an industrial internet-based industrial control audit method, which includes: obtaining industrial control protocol data and network behavior data in a to-be-audited time period; determining a protocol rule template corresponding to the industrial control protocol data based on the similarity between the industrial control protocol data and the protocol rule templates of various industrial control protocols in a protocol database, analyzing control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determining a first audit result based on the control information of the industrial control protocol data, complete packet data, and data area packet data; determining a second audit result based on the statistical characteristics of network traffic of each unit time in the network behavior data, and / or based on the difference between current running program information and historical running program information in the network behavior data; grading a network security event based on the first audit result and the second audit result to obtain a network security evaluation result of the to-be-audited time period.

[0130] In addition, the logic instructions in the memory 520 described above can be implemented in the form of a software function unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present disclosure essentially or say the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present disclosure. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0131] In another aspect, the present disclosure also provides a computer program product, which comprises a computer program stored on a non-transitory computer readable storage medium, and the computer program comprises program instructions, when the program instructions are executed by a computer, the computer can execute the industrial internet-based industrial control auditing method provided by the above-mentioned method, which comprises: obtaining industrial control protocol data and network behavior data in a to-be-audited time period; determining the protocol rule template corresponding to the industrial control protocol data based on the similarity between the industrial control protocol data and the protocol rule templates of various types of industrial control protocols in the protocol database, analyzing the control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determining a first auditing result based on the control information of the industrial control protocol data, complete message data and data area message data; determining a second auditing result based on the statistical characteristics of network traffic of each unit time in the network behavior data, and / or based on the difference between the current running program information and the historical running program information in the network behavior data; performing level evaluation on network security events based on the first auditing result and the second auditing result, and obtaining a network security evaluation result of the to-be-audited time period.

[0132] In yet another aspect, the present disclosure also provides a non-transitory computer-readable storage medium having stored thereon a computer program, which, when executed by a processor, implements the above-mentioned industrial internet-based industrial control auditing method, which comprises: obtaining industrial control protocol data and network behavior data in a to-be-audited time period; determining a protocol rule template corresponding to the industrial control protocol data based on a similarity between the industrial control protocol data and protocol rule templates of various types of industrial control protocols in a protocol database, analyzing control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determining a first auditing result based on the control information of the industrial control protocol data, complete packet data, and data area packet data; determining a second auditing result based on statistical characteristics of network traffic of each unit time in the network behavior data, and / or based on a difference between current running program information and historical running program information in the network behavior data; performing level evaluation on a network security event based on the first auditing result and the second auditing result, to obtain a network security evaluation result of the to-be-audited time period.

[0133] The device embodiments described above are merely illustrative, wherein the units illustrated as separate components can or can not be physically separated, and the components illustrated as units can or can not be physical units, i.e., can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0134] From the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be realized by means of software and necessary general hardware platforms, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0135] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present disclosure, but not to limit them; although the present disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure. Industrial applicability

[0136] By using the above scheme, through double industrial control security audit on industrial control protocol data and network behavior data, whether a network security event occurs in the industrial control network can be found in time and accurately, so that the risk of network attack on the industrial control network is greatly reduced.

Claims

1. An industrial control audit method based on an industrial internet, characterized in that, The method comprises the following steps: obtaining industrial control protocol data and network behavior data in a to-be-audited time period; determining a protocol rule template corresponding to the industrial control protocol data based on the similarity between the industrial control protocol data and the protocol rule templates of various types of industrial control protocols in a protocol database, analyzing the control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determining a first audit result based on the control information of the industrial control protocol data, complete message data, and data area message data; determining a second audit result based on the statistical characteristics of network traffic of each unit time in the network behavior data and / or the difference between the current running program information and the historical running program information in the network behavior data; performing level evaluation on a network security event based on the first audit result and the second audit result to obtain a network security evaluation result of the to-be-audited time period; the similarity between the industrial control protocol data and the protocol rule template of any type of industrial control protocol in the protocol database is determined based on the following steps: determining all common subsequences and the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol; determining a difference factor based on the sequence length of the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and the sequence length of the industrial control protocol data and the protocol rule template of any type of industrial control protocol; determining a sequence consistency factor based on the sum of the sequence lengths of all common subsequences between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, the sequence length of the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and the difference factor; calculating the edit distance between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and determining a sequence similarity factor based on the sequence length of the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol and the edit distance between the industrial control protocol data and the protocol rule template of any type of industrial control protocol; determining the similarity between the industrial control protocol data and the protocol rule template of any type of industrial control protocol based on the sequence consistency factor and the sequence similarity factor; the protocol rule templates of various types of industrial control protocols in the protocol database are constructed based on the following steps: a feature extraction step: extracting text features of each sample industrial control protocol data in the protocol database; wherein the text features of any sample industrial control protocol data are determined based on the word frequency and inverse document frequency of each sentence in the sample industrial control protocol data; a clustering step: clustering each sample industrial control protocol data based on the current cluster number setting value and the text features of each sample industrial control protocol data to obtain multiple current clusters, and obtaining the cluster centers of each cluster; The iteration step includes: performing cluster evaluation on the plurality of current class clusters to obtain a current cluster evaluation value; if the current cluster evaluation value is greater than a current best evaluation value, updating the current best evaluation value based on the current cluster evaluation value, and updating a current best cluster class cluster and a cluster center of each current best cluster class cluster based on the plurality of current class clusters and the cluster centers thereof; increasing the current cluster number setting value, and repeating the cluster step until the current cluster number setting value reaches a preset value; The template determination step includes: determining a protocol rule template of each type of industrial control protocol based on the cluster center of each current best cluster class cluster. 2.The industrial internet-based industrial control auditing method according to claim 1, characterized in that, The first audit result is determined based on the control information, complete message data and data area message data of the industrial control protocol data, and includes: The control anomaly analysis result of the industrial control protocol data is determined based on the sample control information of the sample industrial control protocol data labeled as normal and the control information of the industrial control protocol data; The complete message anomaly analysis result of the industrial control protocol data is obtained by performing anomaly analysis on the complete message data of the industrial control protocol data based on a trained global anomaly analysis model, wherein the global anomaly analysis model is trained based on the sample complete message data of the sample industrial control protocol data and the label of the sample industrial control protocol data; The data area message anomaly analysis result of the industrial control protocol data is obtained by performing anomaly analysis on the data area message data of the industrial control protocol data based on a trained local anomaly analysis model, wherein the local anomaly analysis model is trained based on the sample data area message data of the sample industrial control protocol data and the label of the sample industrial control protocol data; The first audit result is determined based on the control anomaly analysis result, the complete message anomaly analysis result and the data area message anomaly analysis result of the industrial control protocol data. 3.The industrial internet-based industrial control auditing method according to claim 1, characterized in that, The second audit result is determined based on the statistical characteristics of the network traffic of each unit time in the network behavior data, and / or based on the difference between the current running program information and the historical running program information in the network behavior data, and includes: The network traffic anomaly analysis result is determined based on the statistical characteristics of the network traffic of each unit time in the network behavior data, wherein the statistical characteristics include the average, variance and quantile of the network traffic of each unit time; And / or, the current running program information that does not match the historical running program information is determined as a suspected abnormal running program based on the current running program information and the historical running program information in the historical time period in the network behavior data, and the running program anomaly analysis result is determined based on the running frequency of the suspected abnormal running program in each unit time of the to-be-audited time period and the memory information of the suspected abnormal running program; The second audit result is determined based on the network traffic anomaly analysis result and / or the running program anomaly analysis result. 4.The industrial internet-based industrial control auditing method according to claim 3, characterized in that, After determining the second audit result, the method further includes: If the network traffic anomaly analysis result or the running program anomaly analysis result is abnormal, issuing a network security alarm under the premise of uninterrupted power supply and uninterrupted network. If the network traffic anomaly analysis result and the running program anomaly analysis result are both abnormal, a network security alarm is sent under the premise of network disconnection and power continuity. 5.The industrial internet-based industrial control auditing method according to claim 1, wherein, The network security event is graded based on the first audit result and the second audit result to obtain a network security evaluation result of the to-be-audited time period, including: A third audit result is determined based on the binding state of IP addresses and MAC addresses in the to-be-audited time period, the access relationship between at least two devices, and the devices appearing in the industrial control network; The network security event is graded based on the first audit result, the second audit result, and the third audit result to obtain a network security evaluation result of the to-be-audited time period. 6.The industrial internet-based industrial control auditing method according to claim 1, wherein, The difference factor is calculated as follows: d = 1 - a x L LCS / (p+q) wherein d is the difference factor, L LCS is the sequence length of the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, p is the sequence length of the industrial control protocol data, q is the sequence length of the protocol rule template of any type of industrial control protocol, and a is a first adjustment factor. 7.The industrial internet-based industrial control auditing method according to claim 6, characterized in that, The calculation method of the sequence consistency factor is: suc=β×d×Sop(D,T) / (p+q) Wherein, suc is the sequence consistency factor, Sop(D,T) is the total sequence length of all common subsequences between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and β is a second adjustment factor. 8.The industrial internet-based industrial control auditing method according to claim 7, characterized in that, The sequence similarity factor is calculated as follows: sos = L LCS + (max(p,q) - L ED ) where, sos is the sequence similarity factor, L ED is the edit distance between the industrial protocol data and the protocol rule template of any type of industrial protocol. 9.The industrial internet-based industrial control auditing method according to claim 1, wherein, The text features of each sample industrial control protocol data in the protocol database are extracted, including: The term frequency of any sentence is determined according to the ratio of the number of times the sentence appears in the sample industrial control protocol data to the total number of sentences in the sample industrial control protocol data; The inverse document frequency of any sentence is determined according to the logarithm of the ratio of the total number of sample industrial control protocol data in the protocol database to the number of sample industrial control protocol data containing the sentence in the protocol database; The feature value of any sentence is determined according to the product of the term frequency of the sentence and the inverse document frequency of the sentence; The text features of the sample industrial control protocol data are determined according to the vector composed of the feature values of all sentences in the sample industrial control protocol data. 10.The industrial internet-based industrial control auditing method according to claim 1, wherein, The method further includes: If the similarity between the industrial control protocol data and the protocol rule templates of each type of industrial control protocol in the data protocol library is less than a preset threshold, it is determined that the first audit result is abnormal. 11.The industrial internet-based industrial control auditing method according to claim 1, wherein, The control anomaly analysis result of the industrial control protocol data is determined based on the sample control information of the sample industrial control protocol data labeled as normal and the control information of the industrial control protocol data, including: If the control information of the industrial control protocol data is not in the sample control information of the sample industrial control protocol data labeled as normal, it is determined that the control anomaly analysis result is abnormal.

12. An industrial control auditing device based on an industrial internet, characterized by, It includes: A data acquisition unit configured to acquire industrial control protocol data and network behavior data in a to-be-audited time period; A first audit unit configured to determine the protocol rule template corresponding to the industrial control protocol data based on the similarity between the industrial control protocol data and the protocol rule templates of each type of industrial control protocol in the protocol database, parse the control information of the industrial control protocol data based on the protocol rule template corresponding to the industrial control protocol data, and determine a first audit result based on the control information of the industrial control protocol data, complete packet data, and data area packet data; The second audit unit is configured to determine a second audit result based on statistical features of network traffic per unit time in the network behavior data and / or based on differences between current running program information and historical running program information in the network behavior data; The security evaluation unit is configured to perform a level evaluation on a network security event based on the first audit result and the second audit result, to obtain a network security evaluation result of the to-be-audited time period; The similarity between the industrial control protocol data and the protocol rule template of any type of industrial control protocol in the protocol database is determined based on the following steps: All common subsequences and the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol are determined; A difference factor is determined based on the sequence length of the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol and the sequence lengths of the industrial control protocol data and the protocol rule template of any type of industrial control protocol; A sequence consistency factor is determined based on the sum of the sequence lengths of all common subsequences between the industrial control protocol data and the protocol rule template of any type of industrial control protocol, the sequence lengths of the industrial control protocol data and the protocol rule template of any type of industrial control protocol, and the difference factor; An edit distance between the industrial control protocol data and the protocol rule template of any type of industrial control protocol is calculated, and a sequence similarity factor is determined based on the sequence length of the longest common subsequence between the industrial control protocol data and the protocol rule template of any type of industrial control protocol and the edit distance between the industrial control protocol data and the protocol rule template of any type of industrial control protocol; The similarity between the industrial control protocol data and the protocol rule template of any type of industrial control protocol is determined based on the sequence consistency factor and the sequence similarity factor; The protocol rule templates of various types of industrial control protocols in the protocol database are constructed based on the following steps: A feature extraction step: text features of each sample industrial control protocol data in the protocol database are extracted; wherein the text features of any sample industrial control protocol data are determined based on the word frequency and inverse document frequency of each segment in the any sample industrial control protocol data; A clustering step: based on a current cluster number setting value, each sample industrial control protocol data is clustered based on the text features of the sample industrial control protocol data, to obtain a plurality of current clusters, and to obtain a clustering center of each cluster; An iteration step: a current clustering evaluation value is obtained by evaluating the plurality of current clusters; if the current clustering evaluation value is greater than a current best evaluation value, the current best evaluation value is updated based on the current clustering evaluation value, and the current best clustering clusters and the clustering centers of each current best clustering cluster are updated based on the plurality of current clusters and their clustering centers; the current cluster number setting value is increased, and the clustering step is repeated until the current cluster number setting value reaches a preset value; A template determination step: the protocol rule templates of various types of industrial control protocols are determined based on the clustering centers of each current best clustering cluster.

13. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the industrial internet-based industrial control auditing method according to any one of claims 1-11 when executing the program. 14.A non-transitory computer-readable storage medium having stored thereon a computer program. The computer program implements the industrial internet-based industrial control auditing method according to any one of claims 1-11 when executed by the processor.

Images