CN114301645A - Abnormal behavior detection method, device, terminal device and storage medium - Google Patents

Abstract

The invention discloses a method, a device, terminal equipment and a storage medium for detecting abnormal behaviors, which are used for detecting abnormal behaviors by acquiring flow information of network equipment; establishing a behavior baseline according to the flow information; and monitoring network behaviors based on the behavior baselines, and taking the network behaviors which are not accordant with the behavior baselines as abnormal behaviors. The invention improves the network security of the industrial field.

Description

Abnormal behavior detection method, device, terminal device and storage medium

technical field

The present invention relates to the field of network security, and in particular, to a method, device, terminal device and storage medium for detecting abnormal behavior.

Background technique

At present, the key infrastructure represented by the industrial control system increasingly adopts the general protocol of the Internet, and conducts data exchange and operation management through the Internet, which makes the network security risk penetrate into all aspects of the industrial control system. The impact of cyber attacks on the industrial field continues to intensify, and industrial information security has become an important part of cyber security assurance.

The most effective and deadly attacks on industrial sites are those based on industrial protocols. Such attacks can cause equipment abnormalities in light cases, equipment damage in heavy cases, and even major security incidents, resulting in casualties and financial losses. Therefore, it has become an indispensable part of industrial security to provide reliable abnormal detection methods for abnormal behavior detection in industrial sites.

Therefore, it is necessary to propose a solution to enhance the network security of industrial sites.

SUMMARY OF THE INVENTION

The main purpose of the present invention is to provide an abnormal behavior detection method, device, terminal device and storage medium, aiming at improving the network security of the industrial site.

In order to achieve the above object, the present invention provides a method for detecting abnormal behavior, and the method for detecting abnormal behavior includes:

Obtain traffic information of network devices;

establishing a behavioral baseline based on the traffic information;

The network behavior is monitored based on the behavior baseline, and network behaviors inconsistent with the behavior baseline are regarded as abnormal behaviors.

Optionally, the step of establishing a behavior baseline according to the traffic information includes:

Read the data packets in the traffic information to obtain the industrial control protocol;

Perform in-depth analysis on the industrial control protocol, and obtain each operation instruction in the industrial control protocol;

Fit each behavior trend according to each of the operation instructions;

The behavioral baseline is established based on each of the behavioral trends.

Optionally, the step of fitting each behavior trend according to each of the operation instructions includes:

Calculate the average number of operations of each of the operation instructions within the preset operation time;

Each of the behavioral trends is fitted according to the average number of operations of each of the operation instructions within a preset operation time, wherein each of the behavioral trends includes an allowable deviation of the execution times of each of the operation instructions.

Optionally, the step of monitoring network behavior based on the behavior baseline, and using the network behavior inconsistent with the behavior baseline as abnormal behavior includes:

Read the behavior data of the network behavior to obtain a control protocol;

Perform protocol matching between the behavioral baseline and the control protocol, and determine whether the control protocol is consistent with the behavioral baseline;

If the control protocol is inconsistent with the behavior baseline, determine that the network behavior corresponding to the control protocol is the first abnormal behavior;

If the control protocol matches the behavior baseline, perform in-depth analysis on the control protocol and then perform function code matching with the behavior baseline, and take the network behavior corresponding to the function code that does not match the behavior baseline as the second Abnormal behavior.

Optionally, after performing in-depth analysis on the control protocol, perform function code matching with the behavior baseline, and use the network behavior corresponding to the function code that does not match the behavior baseline as the second abnormal behavior, and according to the The steps of providing a detailed alarm for the second abnormal behavior include:

Perform in-depth analysis on the control protocol to obtain a function code of the control protocol, wherein the function code includes the execution times and execution time of the control instruction;

Matching the control instruction with the behavior trend in the behavior baseline, and judging whether the control instruction is consistent with the behavior trend in the behavior baseline;

If the control instruction does not match the behavior trend in the behavior baseline, the network behavior corresponding to the control instruction is regarded as the second abnormal behavior, and a detailed alarm is provided according to the second abnormal behavior.

Optionally, after the step of monitoring the network behavior based on the behavior baseline, and taking the network behavior inconsistent with the behavior baseline as abnormal behavior, the method further includes:

provide a preliminary warning according to the first abnormal behavior;

A detailed alert is provided based on the second abnormal behavior.

Optionally, the step of matching the control instruction with the behavior trend in the behavior baseline, and judging whether the control instruction is consistent with the behavior trend in the behavior baseline includes:

calculating the average number of executions of the control instruction within the execution time;

Comparing the average execution times of the control instruction within the execution time with the behavior baseline, to obtain the deviation of the execution times of the control instruction;

It is judged whether the deviation of the execution times exceeds the allowable deviation of the execution times of the behavior trend, that is, it is judged whether the control instruction is consistent with the behavior trend in the behavior baseline.

In addition, in order to achieve the above purpose, the present invention also provides a method and device for detecting abnormal behavior, and the method device for detecting abnormal behavior includes:

The acquisition module is used to acquire the traffic information of the network device;

establishing a baseline module for establishing a behavioral baseline according to the flow information;

The monitoring module is configured to monitor network behavior based on the behavior baseline, and regard network behavior that is inconsistent with the behavior baseline as abnormal behavior.

In addition, in order to achieve the above object, the present invention also provides a terminal device, the terminal device includes a memory, a processor, and an abnormal behavior detection method program stored on the memory and executable on the processor, the When the abnormal behavior detection method program is executed by the processor, the steps of the abnormal behavior detection method as described above are implemented.

In addition, in order to achieve the above object, the present invention also provides a computer-readable storage medium, on which an abnormal behavior detection method program is stored, and the abnormal behavior detection method program is executed by a processor to achieve the above-mentioned The steps of the abnormal behavior detection method described above.

An abnormal behavior detection method, device, terminal device, and storage medium proposed by the embodiments of the present invention obtain traffic information of network devices; establish a behavior baseline according to the traffic information; monitor network behavior based on the behavior baseline, Network behaviors that do not conform to the behavioral baseline are considered abnormal behaviors. By establishing a behavior baseline based on the traffic information of network devices, it can provide judgment criteria for the analysis of network behavior; by taking network behaviors inconsistent with the behavior baselines as abnormal behaviors and providing corresponding alarms, abnormal behaviors can be accurately detected and the content of the behaviors can be determined. Thereby improving the network security of the industrial site.

Description of drawings

1 is a schematic diagram of functional modules of a terminal device to which a method and apparatus for detecting abnormal behavior according to the present invention belongs;

2 is a schematic flowchart of an exemplary embodiment of an abnormal behavior detection method of the present invention;

3 is a schematic diagram of a refinement process of monitoring network behavior based on the behavior baseline, and taking network behaviors inconsistent with the behavior baseline as abnormal behaviors in an embodiment of the present invention;

FIG. 4 is a schematic diagram of providing a detailed alarm in an embodiment of the present invention;

FIG. 5 is a schematic flowchart of establishing a baseline and performing abnormality monitoring according to the baseline in an embodiment of the present invention.

The realization, functional characteristics and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments.

Detailed ways

It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

The main solutions of the embodiments of the present invention are: by acquiring traffic information of network devices; establishing a behavior baseline according to the traffic information; monitoring network behaviors based on the behavior baselines, and taking network behaviors inconsistent with the behavior baselines as Abnormal behavior. By establishing a behavior baseline based on the traffic information of network devices, it can provide judgment criteria for the analysis of network behavior; by taking network behaviors inconsistent with the behavior baselines as abnormal behaviors and providing corresponding alarms, abnormal behaviors can be accurately detected and the content of the behaviors can be determined. Thereby improving the network security of the industrial site.

Specifically, referring to FIG. 1 , FIG. 1 is a schematic diagram of functional modules of a terminal device to which a method and apparatus for detecting abnormal behavior according to the present invention belongs. The abnormal behavior detection method apparatus may be an apparatus independent of the terminal device and capable of performing the abnormal behavior detection method, which may be carried on the terminal device in the form of hardware or software. The terminal device may be an intelligent mobile terminal with a data processing function, such as a mobile phone or a tablet computer, or a fixed terminal device or a server with a data processing function.

In this embodiment, the terminal device to which the apparatus for detecting abnormal behavior belongs at least includes an output module 110 , a processor 120 , a memory 130 and a communication module 140 .

The memory 130 stores the operating system and the abnormal behavior detection method program, and the abnormal behavior detection method device can monitor the network behavior based on the acquired traffic information of the network device, the behavior baseline established according to the traffic information, and the behavior baseline, The network behavior that does not conform to the behavior baseline is regarded as abnormal behavior, and corresponding alarms and other information provided according to the abnormal behavior are stored in the memory 130; the output module 110 may be a display screen or the like. The communication module 140 may include a WIFI module, a mobile communication module, a Bluetooth module, etc., and communicate with an external device or a server through the communication module 140 .

Wherein, when the abnormal behavior detection method program in the memory 130 is executed by the processor, the following steps are implemented:

Obtain traffic information of network devices;

establishing a behavioral baseline based on the traffic information;

The network behavior is monitored based on the behavior baseline, and network behaviors inconsistent with the behavior baseline are regarded as abnormal behaviors.

Further, when the abnormal behavior detection method program in the memory 130 is executed by the processor, the following steps are also implemented:

Read the data packets in the traffic information to obtain the industrial control protocol;

Perform in-depth analysis on the industrial control protocol, and obtain each operation instruction in the industrial control protocol;

Fit each behavior trend according to each of the operation instructions;

The behavioral baseline is established based on each of the behavioral trends.

Further, when the abnormal behavior detection method program in the memory 130 is executed by the processor, the following steps are also implemented:

Calculate the average number of operations of each of the operation instructions within the preset operation time;

Each of the behavioral trends is fitted according to the average number of operations of each of the operation instructions within a preset operation time, wherein each of the behavioral trends includes an allowable deviation of the execution times of each of the operation instructions.

Further, when the abnormal behavior detection method program in the memory 130 is executed by the processor, the following steps are also implemented:

Read the behavior data of the network behavior to obtain a control protocol;

Perform protocol matching between the behavioral baseline and the control protocol, and determine whether the control protocol is consistent with the behavioral baseline;

If the control protocol is inconsistent with the behavior baseline, determine that the network behavior corresponding to the control protocol is the first abnormal behavior;

If the control protocol matches the behavior baseline, perform in-depth analysis on the control protocol and then perform function code matching with the behavior baseline, and take the network behavior corresponding to the function code that does not match the behavior baseline as the second Abnormal behavior.

Further, when the abnormal behavior detection method program in the memory 130 is executed by the processor, the following steps are also implemented:

Perform in-depth analysis on the control protocol to obtain a function code of the control protocol, wherein the function code includes the execution times and execution time of the control instruction;

Matching the control instruction with the behavior trend in the behavior baseline, and judging whether the control instruction is consistent with the behavior trend in the behavior baseline;

If the control instruction does not match the behavior trend in the behavior baseline, the network behavior corresponding to the control instruction is regarded as the second abnormal behavior.

Further, when the abnormal behavior detection method program in the memory 130 is executed by the processor, the following steps are also implemented:

provide a preliminary warning according to the first abnormal behavior;

A detailed alert is provided based on the second abnormal behavior.

Further, when the abnormal behavior detection method program in the memory 130 is executed by the processor, the following steps are also implemented:

calculating the average number of executions of the control instruction within the execution time;

Comparing the average execution times of the control instruction within the execution time with the behavior baseline, to obtain the deviation of the execution times of the control instruction;

It is judged whether the deviation of the execution times exceeds the allowable deviation of the execution times of the behavior trend, that is, it is judged whether the control instruction is consistent with the behavior trend in the behavior baseline.

This embodiment adopts the above solution, specifically by acquiring traffic information of network devices; establishing a behavior baseline according to the traffic information; monitoring network behaviors based on the behavior baselines, and taking network behaviors inconsistent with the behavior baselines as abnormal behaviors . By establishing a behavior baseline based on the traffic information of network devices, it can provide judgment criteria for the analysis of network behavior; by taking network behaviors inconsistent with the behavior baselines as abnormal behaviors and providing corresponding alarms, abnormal behaviors can be accurately detected and the content of the behaviors can be determined. Thereby improving the network security of the industrial site.

Based on the above-mentioned terminal device architecture but not limited to the above-mentioned architecture, the method embodiments of the present invention are proposed.

The execution subject of the method in this embodiment may be an abnormal behavior detection method apparatus or a terminal device, etc. This embodiment takes the abnormal behavior detection method apparatus as an example.

Referring to FIG. 2 , FIG. 2 is a schematic flowchart of an exemplary embodiment of an abnormal behavior detection method of the present invention. The abnormal behavior detection method includes:

Step S10, obtaining traffic information of the network device;

The use of network equipment in key infrastructures represented by industrial control systems is becoming more and more common. Each network equipment can exchange data and manage operations through the Internet, so a large amount of traffic information will be generated, such as during various business operations and technological operations. Traffic information generated in the process, etc., according to the traffic information, the behavior trend of each operation instruction can be analyzed.

Step S20, establishing a behavior baseline according to the traffic information;

By analyzing the traffic of all devices in the network, focusing on industrial protocol-related behavior, a common, device-based behavior-based baseline is established.

Specifically, an industrial control protocol can be obtained by reading the data packets in the flow information, and the industrial control protocol includes most of the well-known industrial control protocols and a small number of industrial control protocols, such as public Modbus, IEC104, OPC_UA, OPC_DA, etc., as well as private UMAS, GE EGD, CIP, S7, OmronFINS, etc. Through in-depth analysis of the industrial control protocol, various operation instructions in the industrial control protocol can be obtained, and each behavior trend can be fitted according to each of the operation instructions. The specific steps include:

Calculate the average number of operations of each of the operation instructions within the preset operation time;

Each of the behavioral trends is fitted according to the average number of operations of each of the operation instructions within a preset operation time, wherein each of the behavioral trends includes an allowable deviation of the execution times of each of the operation instructions.

For the parsed operation instructions, according to the time, the average number of operations can be calculated, and then the behavior trend can be fitted. The behavior baseline is established based on each behavior trend. The behavior baseline can be regarded as a collection. There are corresponding devices under the collection. Each device establishes its own behavior baseline. Through the behavior baseline of the device, the network behavior of the device can be determined. monitor.

The baseline learning scheme can be based on the analysis of the binary flow in the network, or it can be replaced by the accumulation of their respective technologies.

Step S30 , monitor network behavior based on the behavior baseline, and regard network behavior that is inconsistent with the behavior baseline as abnormal behavior.

After the behavior baseline is established by analyzing the network traffic of the device, the network behavior is monitored according to the behavior baseline, and the corresponding control protocol can be obtained by reading the behavior data of the network behavior. If the protocol does not conform to the behavior baseline, a preliminary alarm is raised; if the control protocol conforms to the behavior baseline, the control protocol is further analyzed in depth, and the parsed function code is matched with the behavior baseline. If the operation instruction in the function code does not match the behavior trend in the behavior baseline, it will be judged as abnormal behavior and a detailed alarm will be raised.

In this embodiment, the traffic information of network devices is obtained; a behavior baseline is established according to the traffic information; network behavior is monitored based on the behavior baseline, and network behaviors inconsistent with the behavior baseline are regarded as abnormal behaviors, and A corresponding alarm is provided according to the abnormal behavior. By establishing a behavior baseline based on the traffic information of network devices, it can provide judgment criteria for the analysis of network behavior; by taking network behaviors inconsistent with the behavior baselines as abnormal behaviors and providing corresponding alarms, abnormal behaviors can be accurately detected and the content of the behaviors can be determined. Thereby improving the network security of the industrial site.

Referring to FIG. 3, FIG. 3 is a refinement of monitoring network behavior based on the behavior baseline in an embodiment of the present invention, taking network behaviors inconsistent with the behavior baseline as abnormal behaviors, and providing corresponding alarms according to the abnormal behaviors Schematic diagram of the process.

This embodiment is based on the embodiment shown in FIG. 2. In this embodiment, in the above step S30, the network behavior is monitored based on the behavior baseline, and the network behavior inconsistent with the behavior baseline is regarded as abnormal behavior, and The step of providing a corresponding alarm according to the abnormal behavior includes:

Step S301, read the behavior data of the network behavior to obtain a control protocol;

By reading the message data of the network behavior, the industrial control protocols in the network behavior can be obtained, such as public Modbus, IEC104, OPC_UA, OPC_DA, etc., as well as private UMAS, GE EGD, CIP, S7, OmronFINS and other industrial control protocols .

Step S302, performing protocol matching between the behavioral baseline and the control protocol, and judging whether the control protocol is consistent with the behavioral baseline;

After obtaining the control protocol of the network behavior, first perform protocol matching between the control protocol and the behavior baseline, and determine whether the control protocol is within the baseline. If the control protocol is not within the baseline, it indicates that the control protocol corresponds to Network behavior does not conform to the baseline, if the control protocol is within the baseline, the control protocol conforms to the baseline.

Step S303, if the control protocol is inconsistent with the behavior baseline, determine that the network behavior corresponding to the control protocol is the first abnormal behavior;

If the control protocol is not within the behavior baseline, determine that the network behavior corresponding to the control protocol is the first abnormal behavior, and provide a preliminary alarm according to the network behavior. The alarm content includes the protocol name, risk level, source IP, and destination IP. , source port and destination port, etc.

Step S304, if the control protocol is consistent with the behavior baseline, perform in-depth analysis on the control protocol and then perform function code matching with the behavior baseline, and compare the network behavior corresponding to the function code that does not match the behavior baseline. as the second abnormal behavior.

If the control protocol is within the behavioral baseline, further matching is required. The control protocol is firstly analyzed in depth, the function code is parsed into the value range to ensure the accuracy of subsequent identification, and whether the operation behavior is abnormal is determined according to whether the operation instruction contained in the function code conforms to the behavior trend in the behavior baseline. include:

Perform in-depth analysis on the control protocol to obtain a function code of the control protocol, wherein the function code includes the execution times and execution time of the control instruction;

Specifically, a deep parsing function is provided for the control protocol, and the function code is parsed into the value range to ensure the accuracy of subsequent identification. The parsed function code includes the execution times of the control instruction and the corresponding execution time.

Matching the control instruction with the behavior trend in the behavior baseline, and judging whether the control instruction is consistent with the behavior trend in the behavior baseline;

Specifically, by calculating the average number of executions of the control instruction and comparing the number of times with the behavioral trend in the behavioral baseline, it can be determined whether the control instruction is consistent with the behavioral trend in the behavioral baseline, specifically including:

calculating the average number of executions of the control instruction within the execution time;

Comparing the average execution times of the control instruction within the execution time with the behavior baseline, to obtain the deviation of the execution times of the control instruction;

It is judged whether the deviation of the execution times exceeds the allowable deviation of the execution times of the behavior trend, that is, it is judged whether the control instruction is consistent with the behavior trend in the behavior baseline.

If the control instruction does not match the behavior trend in the behavior baseline, the network behavior corresponding to the control instruction is regarded as the second abnormal behavior.

Further, if it is judged that the control instruction is inconsistent with the behavioral trend in the behavioral baseline, it is considered that the operation behavior corresponding to the control instruction is abnormal, and it is judged as the second abnormal behavior, and the second abnormal behavior is provided according to the analysis result. 4 is a schematic diagram of providing a detailed alarm in an embodiment of the present invention. As shown in FIG. 4, the detailed alarm content includes event content and event protocol, wherein the event content includes source IP, destination IP, source mac, destination mac, danger level, source port, and destination port, etc. The event protocol includes protocol name, operation command, operation address, and operation value. The abnormal behavior can be further determined according to the alarm content, so as to achieve the purpose of accurately identifying the abnormal behavior.

This embodiment obtains a control protocol through the above solution, specifically by reading the behavior data of the network behavior; performing protocol matching between the behavior baseline and the control protocol, and judging whether the control protocol is consistent with the behavior baseline; If the control protocol does not conform to the behavior baseline, determine that the network behavior corresponding to the control protocol is the first abnormal behavior; if the control protocol conforms to the behavior baseline, perform in-depth analysis on the control protocol Then, function code matching is performed with the behavior baseline, and the network behavior corresponding to the function code that does not match the behavior baseline is regarded as the second abnormal behavior. By monitoring network behaviors based on the behavior baseline, abnormal behaviors in network behaviors can be accurately identified, and by providing corresponding alarms, abnormal behaviors can be further determined according to the content of the alarms, so as to achieve the purpose of accurately identifying abnormal behaviors, thereby improving industrial performance. On-site cybersecurity.

In addition, an embodiment of the present invention also provides a method and apparatus for detecting abnormal behavior, and the method and apparatus for detecting abnormal behavior includes:

The acquisition module is used to acquire the traffic information of the network device;

establishing a baseline module for establishing a behavioral baseline according to the flow information;

The monitoring module is configured to monitor network behavior based on the behavior baseline, and regard network behavior that is inconsistent with the behavior baseline as abnormal behavior.

By analyzing the traffic of all devices in the network, focusing on industrial protocol-related behavior, a common, device-based behavior-based baseline is established.

Referring to FIG. 5 , FIG. 5 is a schematic flowchart of establishing a baseline and performing abnormality monitoring according to the baseline in an embodiment of the present invention. As shown in FIG. 5 , during the baseline learning process, the traffic of network equipment is acquired and analyzed, and the industrial control protocol therein is analyzed. To analyze, that is, to provide in-depth analysis function for most well-known industrial control protocols and a small number of industrial control protocols to ensure the accuracy of their identification, and to calculate the behavior frequency of the analyzed operation instructions according to time, and fit them into behavior trends. A behavioral baseline is formed by individual behavioral trends. In the baseline matching process, the protocol matching is performed first. If the industrial control protocol of the network behavior is not within the baseline, an alarm will be raised directly. If the industrial control protocol of the network behavior is within the baseline, it is necessary to further check whether the execution frequency of the operation instructions conforms to the baseline. If the behavior trend in the data does not match the behavior trend, a detailed alarm will be issued for the data that does not conform to the behavior trend, so as to achieve the purpose of accurately identifying abnormal behavior.

In addition, through the abnormal behavior analysis technology, it is possible to further check the IP address network information, active status, protocol traffic distribution, application information, session information and other information of asset equipment, making the deployment of the network environment in the industrial site more convenient and safe.

In this embodiment, through the above solution, in-depth content analysis and identification of the industrial control protocol, fine-grained extraction of industrial control instructions and user behaviors in the protocol, and time as a parameter, the operation instructions of the industrial control protocol are modeled for the behavior baseline , correlate with business and technological process, and carry out comparative analysis, so as to effectively support the detection of behaviors that do not conform to business processes, and improve the accuracy and effectiveness of industrial control abnormal behavior detection. On the basis of protocol identification, a set of independent behavioral baseline analysis is established for each individual device, which can greatly avoid problems such as serious event false positives caused by common rules. It provides a reliable and effective threat monitoring method for the network security of the current industrial site, and has a strong guiding role in improving the network security of the industrial site.

In addition, an embodiment of the present invention further provides a terminal device, the terminal device includes a memory, a processor, and an abnormal behavior detection method program stored on the memory and executable on the processor, the abnormal behavior detection method program When the method program is executed by the processor, the steps of the abnormal behavior detection method described above are implemented.

Since the program of the abnormal behavior detection method is executed by the processor, it adopts all the technical solutions of all the foregoing embodiments, so it has at least all the beneficial effects brought by all the technical solutions of the foregoing embodiments, and will not be repeated here. .

In addition, an embodiment of the present invention also provides a computer-readable storage medium, where an abnormal behavior detection method program is stored, and the abnormal behavior detection method program is executed by a processor to realize the above abnormality The steps of the behavior detection method.

Since the program of the abnormal behavior detection method is executed by the processor, it adopts all the technical solutions of all the foregoing embodiments, so it has at least all the beneficial effects brought by all the technical solutions of the foregoing embodiments, and will not be repeated here. .

Compared with the prior art, the abnormal behavior detection method, device, terminal device, and storage medium proposed by the embodiments of the present invention obtain traffic information of network devices; establish a behavior baseline according to the traffic information; and analyze network behavior based on the behavior baseline. Monitoring is performed, network behaviors inconsistent with the behavior baseline are regarded as abnormal behaviors, and corresponding alarms are provided according to the abnormal behaviors. Through in-depth content analysis and identification of industrial control protocols, fine-grained extraction of industrial control instructions and user behaviors in the protocol, taking time as a parameter, modeling behavior baselines for the operation instructions of industrial control protocols, and correlating them with business and process processes , and carry out comparative analysis to effectively support the detection of behaviors that do not conform to business processes, and improve the accuracy and effectiveness of industrial control abnormal behavior detection. On the basis of protocol identification, a set of independent behavioral baseline analysis is established for each individual device, which can greatly avoid problems such as serious event false positives caused by common rules. It provides a reliable and effective threat monitoring method for the network security of the current industrial site, and has a strong guiding role in improving the network security of the industrial site.

It should be noted that, herein, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article or system comprising a series of elements includes not only those elements, It also includes other elements not expressly listed or inherent to such a process, method, article or system. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article or system that includes the element.

The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments.

From the description of the above embodiments, those skilled in the art can clearly understand that the method of the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is better implementation. Based on such understanding, the technical solutions of the present application can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products are stored in the above storage medium (such as ROM/RAM, magnetic CD, CD), including several instructions to make a terminal device (which may be a mobile phone, a computer, a server, a controlled terminal, or a network device, etc.) to execute the method of each embodiment of the present application.

The above are only preferred embodiments of the present invention, and are not intended to limit the scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present invention, or directly or indirectly applied in other related technical fields , are similarly included in the scope of patent protection of the present invention.

Claims (10)

1. An abnormal behavior detection method, characterized by comprising the steps of:

acquiring flow information of network equipment;

establishing a behavior baseline according to the flow information;

and monitoring network behaviors based on the behavior baselines, and taking the network behaviors which are not accordant with the behavior baselines as abnormal behaviors.

2. The abnormal behavior detection method of claim 1, wherein the step of establishing a behavior baseline based on the traffic information comprises:

reading a data packet in the flow information to obtain an industrial control protocol;

carrying out deep analysis on the industrial control protocol to obtain each operation instruction in the industrial control protocol;

fitting each behavior trend according to each operation instruction;

establishing the behavioral baseline based on each of the behavioral trends.

3. The abnormal behavior detection method according to claim 2, wherein the step of fitting each behavior trend according to each of the operation instructions comprises:

calculating the average operation times of each operation instruction in preset operation time;

and fitting each behavior trend according to the average operation times of each operation instruction in a preset operation time, wherein each behavior trend comprises the allowable deviation of the execution times of each operation instruction.

4. The abnormal behavior detection method according to claim 1, wherein the step of monitoring the network behavior based on the behavior baseline, and the step of regarding the network behavior that does not match the behavior baseline as the abnormal behavior comprises:

reading the behavior data of the network behavior to obtain a control protocol;

carrying out protocol matching on the behavior baseline and the control protocol, and judging whether the control protocol is consistent with the behavior baseline;

if the control protocol does not accord with the behavior baseline, determining that the network behavior corresponding to the control protocol is a first abnormal behavior;

and if the control protocol is in accordance with the behavior baseline, performing deep analysis on the control protocol, then performing function code matching on the control protocol and the behavior baseline, and taking the network behavior corresponding to the function code which is not in accordance with the behavior baseline as a second abnormal behavior.

5. The abnormal behavior detection method according to any one of claims 3 to 4, wherein the step of performing function code matching with the behavior baseline after performing deep parsing on the control protocol, and taking a network behavior corresponding to a function code that does not conform to the behavior baseline as a second abnormal behavior comprises:

deeply analyzing the control protocol to obtain a function code of the control protocol, wherein the function code comprises execution times and execution time of a control instruction;

matching the control command with the behavior trend in the behavior baseline, and judging whether the control command is consistent with the behavior trend in the behavior baseline;

and if the control instruction does not accord with the behavior trend in the behavior baseline, taking the network behavior corresponding to the control instruction as a second abnormal behavior.

6. The abnormal behavior detection method according to claim 4, wherein the step of monitoring the network behavior based on the behavior baseline and determining the network behavior that does not match the behavior baseline as the abnormal behavior further comprises:

providing a preliminary warning according to the first abnormal behavior;

and providing detailed alarm according to the second abnormal behavior.

7. The abnormal behavior detection method according to claim 5, wherein the step of matching the control command with the behavior trend in the behavior baseline and determining whether the control command matches the behavior trend in the behavior baseline comprises:

calculating the average execution times of the control instructions in the execution time;

comparing the average execution times of the control instruction in the execution time with the behavior baseline to obtain the execution time deviation of the control instruction;

and judging whether the execution time deviation exceeds the execution time allowable deviation of the behavior trend, namely judging whether the control instruction is consistent with the behavior trend in the behavior baseline.

8. An abnormal behavior detection apparatus, characterized by comprising:

the acquisition module is used for acquiring the flow information of the network equipment;

the base line establishing module is used for establishing a behavior base line according to the flow information;

and the monitoring module is used for monitoring the network behavior based on the behavior baseline and taking the network behavior which is not accordant with the behavior baseline as abnormal behavior.

9. A terminal device, characterized in that the terminal device comprises a memory, a processor and an abnormal behavior detection method program stored on the memory and executable on the processor, the abnormal behavior detection method program, when executed by the processor, implementing the steps of the abnormal behavior detection method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that the computer-readable storage medium has stored thereon an abnormal behavior detection method program, which when executed by a processor implements the steps of the abnormal behavior detection method according to any one of claims 1 to 7.

Images