Patent Description:
<CIT> (<CIT>) relates to a network device behavior analysis method and system.

<CIT> (<CIT>) relates to a method for detection of cyber-threat to a computer system.

<CIT> (<CIT>) relates event monitoring and management on a network.

An industrial control system (ICS) is used to implement automatic control of industrial processes. An industrial control system may be a wind power generation system, a vehicle manufacturing workshop, a pharmaceutical factory, a wastewater treatment system in a city, etc..

Traditional industrial control systems are closed, and it is difficult for external attacks to pose security threats to critical devices such as an industrial controller in the industrial control system. Therefore, traditional industrial control systems have a low requirement for network security. In modern industrial control systems, a large number of network technologies and commercial components are employed, so that the modern industrial control systems can be connected to other networks including the Internet, which makes it possible for external network attacks to tamper with a control process of an industrial controller, thereby causing damages to an industrial device, and thus severely affecting the normal running of the industrial control systems. Therefore, knowing how to avoid external network attacks becomes notably important.

In order to effectively repel the external network attacks and guarantee a critical industrial control system and a control process thereof, a feasible method is first monitoring the network security of the industrial control system to identify possible network attacks.

Embodiments of the present invention provide a network security monitoring method for effectively monitoring the network security of an industrial control system.

In a first aspect, a method for monitoring the network security of an industrial control system is provided.

The method comprises: selecting at least one first data source related to the industrial control system, wherein the at least one first data source is used for measuring whether the industrial control system meets a network security requirement; acquiring first data from the at least one first data source; counting time-varying features of the first data to serve as a behavior model for the industrial control system; acquiring second data from some or all of the at least one first data source; and determining whether the second data has the features described by the behavior model, and if so, determining that behavior of the industrial control system that is represented by the second data is normal behavior, and if not, determining that the behavior is abnormal behavior.

In consideration of the certainty of the behavior of the industrial control system, and based on the certainty of such a behavior, a behavior model for the industrial control system is obtained by means of counting, and the behavior model also has definite certainty. A judgement regarding an abnormal system behavior is made based on the relatively determined behavior model, so that the obtained determination result is more accurate. Moreover, in the embodiments of the present invention, a data source related to the industrial control system is properly selected, and data is acquired from the selected data source, so that the behavior model for the industrial control system is determined according to the acquired data. Then, based on the determined data model, it is determined whether the industrial control system exhibits abnormal behavior. Effective monitoring of the network security of the industrial control system can be thus implemented.

Firstly, during the selection of a data source, a data source that can measure whether the industrial control system meets a network security requirement is selected, so that data used as a basis during subsequent judgment regarding an abnormal system behavior can more cater to the need for network security, and a determination result is more accurate. Secondly, when the industrial control system is not subjected to a network attack, data is acquired from the selected data source, and then time-varying features of the acquired data are counted to serve as a behavior model for the industrial control system. In this way, a normal behavior feature of the system can be accurately learned, so that the determination result for the abnormal system behavior that is obtained during subsequent feature comparison is more accurate.

Optionally, in the method, the at least one first data source related to the industrial control system can be selected according to at least one of the following factors: at least one running indicator of the industrial control system that is defined by a customer of the industrial control system; at least one network security policy of the industrial control system that is defined by the customer of the industrial control system; a normal running process of the industrial control system; configuration information of at least one constituent part of the industrial control system; and a network attack that the industrial control system may be subjected to.

Here, various sources of the data source are given.

Optionally, the at least one first data source comprises: a log of at least one industrial host in the industrial control system, and/or network traffic captured from at least one critical network position in the industrial control system, and/or a security log of at least one security protective device in the industrial control system, and/or a network log of at least one network switching and routing device in the industrial control system.

If the at least one first data source comprises the log of the at least one industrial host in the industrial control system, the first data can be acquired from the at least one first data source in the following manner: acquiring, for each of the at least one industrial host, at least one piece of the following data from a log of the industrial host to serve as the first data of the industrial host: hardware performance data during running of the industrial host; file input/output information during running of the industrial host; a processing flow for an industrial application program running on the industrial host; and a resource in the industrial control system that is accessed by the industrial application program running on the industrial host.

If the at least one first data source comprises the network traffic captured from the at least one critical network position in the industrial control system, the first data can be acquired from the at least one first data source in the following manner: determining, for each of the at least one critical network position, at least one piece of the following information of the network traffic to serve as the first data of the critical network position: a source address of a data packet in the network traffic; a destination address of the data packet in the network traffic; a function code of an industrial control communication protocol used by the network traffic; and application layer data in the network traffic.

For this case, optionally, the behavior model can be used to describe at least one of the following features of communication within the industrial control system: a communication flow between an industrial host and an industrial controller in the industrial control system; a function performed by an industrial application program in the industrial control system; and the state of an industrial device in the industrial control system and the state of a process variable monitored by the industrial device.

If the at least one first data source comprises the log of the at least one industrial host in the industrial control system, the first data can be acquired from the at least one first data source in the following manner: acquiring at least one piece of the following information from the at least one industrial host to serve as the first data: information for logging in and/or logging out of the industrial control system by a user by means of the at least one industrial host; a control command executed by the user on the at least one industrial host for the industrial control system; and data in the industrial control system that is accessed by the user by means of the at least one industrial host.

For this case, the behavior model is used to describe at least one of the following features of user behavior of the industrial control system: a working time; a normal operation; and a data acquisition mode.

Different implementations for various data sources are given above, and specific implementations for acquiring data are provided above for different data sources.

Different behavior models are established for different data sources, and the established behavior models can embody behavior features of the industrial control system, such that a determination result is more accurate when it is determined, according to data collected in real time, whether the behavior is abnormal.

Optionally, after it is determined that the behavior of the industrial control system that is represented by the second data is abnormal behavior, a level of an alarm corresponding to the behavior of the industrial control system that is represented by the second data can be further determined; and if the determined level is higher than a preset lowest alarm priority level, alarm reporting is triggered, otherwise, alarm reporting is not triggered.

For this optional solution, a possible implementation is that the levels of the alarms in descending order of priorities sequentially comprise at least two of the following first to fifth levels: alarms at the first level comprise alarms related to an industrial controller in the industrial control system; alarms at the second level comprise alarms in an industrial control network in the industrial control system; alarms at the third level comprise alarms related to an industrial host in the industrial control system; alarms at the fourth level comprise alarms related to a back-end firewall, server and/or application in a demilitarized zone, and the demilitarized zone is used for separating the industrial control system from an enterprise network of the industrial control system; and alarms at the fifth level comprise alarms related to a front-end firewall in the demilitarized zone.

In this way, a policy for alarm reporting can be set in advance, and the alarms can be selectively reported, so that the implementation of alarm reporting is more flexible, and excessive alarm reporting can be effectively avoided.

Optionally, after it is determined that the behavior of the industrial control system that is represented by the second data is abnormal behavior, it can be further determined whether the behavior of the industrial control system that is represented by the second data is a network attack, and if so, an attack source is positioned according to an object targeted by the behavior of the industrial control system that is represented by the second data.

In this way, the attack source of the network attack can be effectively positioned.

After it is determined that the behavior of the industrial control system that is represented by the second data is abnormal behavior, it can be further determined whether the behavior of the industrial control system that is represented by the second data is a network attack; and if so, a network attack phase of the behavior of the industrial control system that is represented by the second data is determined, wherein different network attack phases pose different levels of threat to the industrial control system.

In this way, the network attack phase can be clearly determined, so that corresponding security measures can be subsequently taken for different network attack phases.

In a second aspect, an alarming method in an industrial control system is provided.

The method may comprise: determining a level of an alarm generated in the industrial control system; and triggering alarm reporting if the level of the alarm is higher than a preset lowest alarm priority level, otherwise, skipping triggering alarm reporting;
wherein the levels of the alarms in descending order of priorities sequentially comprise at least two of the following levels: a first level, wherein alarms at the first level comprise alarms related to an industrial controller in the industrial control system; a second level, wherein alarms at the second level comprise alarms in an industrial control network in the industrial control system; a third level, wherein alarms at the third level comprise alarms related to an industrial host in the industrial control system; a fourth level, wherein alarms at the fourth level comprise alarms related to a back-end firewall, server and/or application in a demilitarized zone, and the demilitarized zone is used for separating the industrial control system from an enterprise network of the industrial control system; and a fifth level, wherein alarms at the fifth level comprise alarms related to a front-end firewall in the demilitarized zone.

In a third aspect, a network security monitoring system for an industrial control system is provided. The network security monitoring system can be used to implement the method provided in the first aspect or any possible implementation of the first aspect. The system may comprise:.

Optionally, the data source selection module is specifically used for selecting the at least one first data source related to the industrial control system according to at least one of the following factors: at least one running indicator of the industrial control system that is defined by a customer of the industrial control system; at least one network security policy of the industrial control system that is defined by the customer of the industrial control system; a normal running process of the industrial control system; configuration information of at least one constituent part of the industrial control system; and a network attack that the industrial control system may be subjected to.

Optionally, the at least one first data source selected by the data source selection module comprises: a log of at least one industrial host in the industrial control system, and/or network traffic captured from at least one critical network position in the industrial control system, and/or a security log of at least one security protective device in the industrial control system, and/or a network log of at least one network switching and routing device in the industrial control system.

If the at least one first data source selected by the data source selection module comprises the log of the at least one industrial host in the industrial control system, the data acquisition module is specifically used for acquiring, for each of the at least one industrial host, at least one piece of the following data from the log of the industrial host to serve as the first data of the industrial host: hardware performance data during running of the industrial host; file input/output information during running of the industrial host; a processing flow for an industrial application program running on the industrial host; and a resource in the industrial control system that is accessed by the industrial application program running on the industrial host.

If the at least one first data source selected by the data source selection module comprises the network traffic captured from the at least one critical network position in the industrial control system, the data acquisition module is specifically used for determining, for each of the at least one critical network position, at least one piece of the following information of the network traffic to serve as the first data of the critical network position: a source address of a data packet in the network traffic; a destination address of the data packet in the network traffic; a function code of an industrial control communication protocol used by the network traffic; and application layer data in the network traffic.

For this case, the behavior model generated by the model generation module is used to describe at least one of the following features of communication within the industrial control system: a communication flow between an industrial host and an industrial controller in the industrial control system; a function performed by an industrial application program in the industrial control system; and the state of an industrial device in the industrial control system and the state of a process variable monitored by the industrial device.

If the at least one first data source selected by the data source selection module comprises the log of the at least one industrial host in the industrial control system, the data acquisition module is specifically used for acquiring at least one piece of the following information from the at least one industrial host to serve as the first data: information for logging in and/or logging out of the industrial control system by a user by means of the at least one industrial host; a control command executed by the user on the at least one industrial host for the industrial control system; and data in the industrial control system that is accessed by the user by means of the at least one industrial host.

For this case, the behavior model generated by the model generation module is used to describe at least one of the following features of user behavior of the industrial control system: a working time; a normal operation; and a data acquisition mode.

Optionally, the network security monitoring system further comprises an alarm processing module, wherein after the abnormal behavior determination module determines that the behavior of the industrial control system that is represented by the second data is abnormal behavior, the alarm processing module is used for: determining a level of an alarm corresponding to the behavior of the industrial control system that is represented by the second data; and triggering alarm reporting if the determined level is higher than a preset lowest alarm priority level, otherwise, skipping triggering alarm reporting.

The levels of the alarms in descending order of priority sequentially comprise at least two of the following first to fifth levels: a first level, wherein alarms at the first level comprise alarms related to an industrial controller in the industrial control system; a second level, wherein alarms at the second level comprise alarms in an industrial control network in the industrial control system; a third level, wherein alarms at the third level comprise alarms related to an industrial host in the industrial control system; a fourth level, wherein alarms at the fourth level comprise alarms related to a back-end firewall, server and/or application in a demilitarized zone, and the demilitarized zone is used for separating the industrial control system from an enterprise network of the industrial control system; and a fifth level, wherein alarms at the fifth level comprise alarms related to a front-end firewall in the demilitarized zone.

Optionally, the network security monitoring system further comprises an attack source positioning module, wherein after the abnormal behavior determination module determines that the behavior of the industrial control system that is represented by the second data is abnormal behavior, the attack source positioning module is used for: determining whether the behavior of the industrial control system that is represented by the second data is a network attack; and if so, positioning an attack source according to an object targeted by the behavior of the industrial control system that is represented by the second data.

Optionally, the network security monitoring system further comprises an attack phase determination module, wherein after the abnormal behavior determination module determines that the behavior of the industrial control system that is represented by the second data is abnormal behavior, the attack phase determination module is used for: determining whether the behavior of the industrial control system that is represented by the second data is a network attack; and if so, determining a network attack phase of the behavior of the industrial control system that is represented by the second data, wherein different network attack phases pose different levels of threat to the industrial control system.

In a fourth aspect, a network security monitoring system for an industrial control system is provided, which comprises:.

In a fifth aspect, an alarm processing apparatus in an industrial control system is provided, which comprises:.

In a sixth aspect, an alarm processing apparatus in an industrial control system is provided, which comprises:.

In a seventh aspect, a machine-readable medium is provided, which has machine-readable instructions stored thereon, wherein the machine-readable instructions carry out, when invoked by a processor, the method provided in the first aspect, any possible implementation of the first aspect, the second aspect, or any possible implementation of the second aspect.

As described previously, industrial control systems may be used to implement automatic control of industrial processes, and may also be referred to as operations technology (OT) systems. Traditional industrial control systems are usually closed and have no connection to an external network, such as the Internet, and therefore, there is little or no consideration of the security of the system. However, with the development of digital technologies, automation technologies, and process control technologies, information technologies have been widely used in industrial control systems, and the industrial control systems have gradually become open and interconnected systems. For example: networks of joint venture companies or subsidiaries, or even service outsourcing companies, of an industrial enterprise, may be connected to an industrial control system of the industrial enterprise. Consequently, there is a risk of network attacks, and the industrial control system is faced with increasingly severe security threats. Therefore, there is an urgent need to protect the industrial control system from security attacks.

In known security solutions available to IT systems, security events generated from network hardware and application programs may be analyzed in real time, and corresponding security alarms can be generated. The security solutions are targeted at network devices, security protective devices, various servers, etc. in the IT systems. Unlike the IT systems, behavior of the IT systems is usually uncertain and unpredictable. However, behavior of the industrial control systems is of high certainty. For example: after an industrial control system is installed and debugged, and put into operation, the configuration thereof is basically determined.

In the embodiments of the present invention, in consideration of the certainty of the behavior of the industrial control system, and based on the certainty of such a behavior, a behavior model for the industrial control system is obtained by means of counting, and the behavior model also has definite certainty. A judgement regarding an abnormal system behavior is made based on the relatively determined behavior model, so that the obtained determination result is more accurate. Moreover, in the embodiments of the present invention, a data source related to the industrial control system is properly selected, and data is acquired from the selected data source, so that the behavior model for the industrial control system is determined according to the acquired data. Then, based on the determined data model, it is determined whether the industrial control system exhibits abnormal behavior. Effective monitoring of the network security of the industrial control system can be thus implemented.

In the embodiments of the present invention, a network security monitoring system may be used to implement monitoring of the network security of an industrial control system. The network security monitoring system may comprise at least one device. When comprising only one device, the network security monitoring system may also be referred to as a network security monitoring device. In the embodiments of the present invention, the network security monitoring system may be located inside the industrial control system or may be located outside the industrial control system.

The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

<FIG> show how a network security monitoring system <NUM> is deployed into an industrial control system <NUM> in an embodiment of the present invention.

In <FIG>, the network security monitoring system <NUM> is located inside the industrial control system <NUM>.

In <FIG>, some devices in the network security monitoring system <NUM> are located inside the industrial control system <NUM>, and some devices therein are located outside the industrial control system <NUM>.

In <FIG>, the network security monitoring system <NUM> is located outside the industrial control system <NUM>. The network security monitoring system <NUM> may be used to monitor the network security of one industrial control system <NUM>, and may also be used to monitor the network security of two or more network security monitoring systems <NUM>.

The network security monitoring system <NUM> may implement monitoring of the network security of the industrial control system <NUM> by means of at least one server and monitoring software deployed thereon.

A method for monitoring the network security of an industrial control system <NUM> by a network security monitoring system <NUM> in an embodiment of the present invention is described in detail below. As shown in <FIG>, the method may comprise the following steps:.

The steps above will be described below in detail one by one.

In step S201, the network security monitoring system <NUM> selects at least one first data source related to the industrial control system <NUM>.

Since running environments of different industrial control systems are different, the network security monitoring system <NUM> may first determine a network security requirement of the industrial control system <NUM> when selecting the first data source. For example: the network security monitoring system <NUM> may use a threat and risk assessment (TRA) method to determine a network security requirement. The network security monitoring system <NUM> may determine the network security requirement of the industrial control system <NUM> according to at least one of the following factors:.

Then, the network security monitoring system <NUM> may select the first data source according to the determined network security requirement. The first data source is used for measuring whether the industrial control system <NUM> meets the determined network security requirement.

The network attack may come from inside the industrial control system <NUM>. For example: a malicious employee introducing a network attack such as a virus, or an employee inadvertently enabling a USB flash drive infected with malicious software to access the industrial control system <NUM>, etc., may bring network attacks on the industrial control system <NUM>.

The network attack may also come from outside the industrial control system <NUM>. For example: according to open source or commercial threat intelligence, outside the industrial control system <NUM>, it may be known packets coming from which IP address may be network attacks, or which types of files may be network attacks, or network traffic exhibiting which features may be network attacks.

A structure of the industrial control system <NUM> will be exemplified below with reference to <FIG> to facilitate understanding the position of the first data source in the industrial control system <NUM>.

As shown in <FIG>, the industrial control system <NUM> may comprise:.

The first data source determined by the network security monitoring system <NUM> may come from inside the industrial control system <NUM>, for example:.

The critical network position where the captured network traffic is located may be defined by itself, for example: the captured network traffic is located at the firewall 204a, at a core network switching and routing device, between the industrial controller <NUM> and the industrial host, at the industrial controller <NUM>, at the database server 200b, etc..

In step S202, the network security monitoring system <NUM> acquires the first data from the at least one first data source when the industrial control system <NUM> is not subjected to a network attack. In step S203, the network security monitoring system <NUM> counts time-varying features of the first data to serve as a behavior model for the industrial control system <NUM>.

As described previously, unlike IT systems, behavior of industrial control systems is of high certainty. Therefore, in this embodiment of the present invention, based on the certainty, the network security monitoring system <NUM> acquires a behavior feature of the industrial control system <NUM> by means of data counting when the industrial control system <NUM> is not subjected to a network attack, so as to serve as a standard for subsequently determining that behavior of the industrial control system <NUM> is abnormal.

It should be noted that, in one possible case, the network security monitoring system <NUM> can acquire the first data when the industrial control system <NUM> is not subjected to a network attack at all. Another possible case is that a part or some parts in the industrial control system <NUM> or might be being subjected to network attacks when the network security monitoring system <NUM> acquires the first data. These network attacks may affect features of the first data at a certain first data source. One optional solution is as follows: because the behavior model indicates time-varying features of the first data, the network security monitoring system <NUM> may screen out data samples obviously different from other data samples in advance, and then count data to determine behavior features so as to obtain behavior features of normal behavior of the industrial control system <NUM>. Another optional solution is to assess the current situation of the industrial control system <NUM> before acquiring the first data, to determine whether the industrial control system <NUM> has been subjected to a network attack, and then to acquire the first data if it is determined that the industrial control system is not subjected to a network attack.

A method for acquiring data and determining behavior features by the network security monitoring system <NUM> will be exemplified below.

The at least one first data source comprises a log of at least one industrial host in the industrial control system <NUM>. The network security monitoring system <NUM> acquires, for each of the industrial hosts, at least one piece of the following data from a log of the industrial host to serve as the first data of the industrial host:.

The network security monitoring system <NUM> may record the acquired changes of the first data as a function of time to serve as a time sequence. After a period of observations, the time-varying features of the first data may be obtained by means of counting, for example: an average value of the CPU occupancy rate, time-varying variance of the memory occupancy rate, etc. A normal processing flow for an industrial application program, a list of files accessed during normal running, a list of registries, etc. may also be obtained. The network security monitoring system <NUM> may determine these features as behavior features of the industrial host.

The at least one first data source comprises network traffic captured from at least one critical network position in the industrial control system <NUM>. The network security monitoring system <NUM> may determine, for each of the at least one critical network position, at least one piece of the following information of the network traffic to serve as the first data of the critical network position:.

The network security monitoring system <NUM> may acquire the first data at the critical network position in a manner of port mapping or wiretapping.

The network security monitoring system <NUM> may record the acquired changes of the first data as a function of time to serve as a time sequence. After a period of observations, the time-varying features of the first data may be obtained by means of counting, that is, the features of network communication, including but not limited to:.

The at least one first data source comprises a log of at least one industrial host in the industrial control system. The network security monitoring system <NUM> acquires at least one piece of the following information from the at least one industrial host to serve as the first data:.

The network security monitoring system <NUM> may record the acquired changes of the first data as a function of time to serve as a time sequence. After a period of observations, the time-varying features of the first data may be obtained by means of counting, that is, the behavior features of the user, including but not limited to: a working time, a normal operation, a data acquisition mode, etc. For example, an HMI always accesses a specific PLC every two seconds to acquire a control state, which is a time-varying behavior feature of the HMI.

In step S204, the network security monitoring system <NUM> acquires the second data from some or all of the at least one first data source.

In step S205, the network security monitoring system <NUM> determines whether the second data has the features described by the behavior model, and if so, determines that behavior of the industrial control system <NUM> that is represented by the second data is normal behavior, and if not, determines that the behavior is abnormal behavior.

For example: in step S203, the behavior model obtained by means of counting comprises: a specific HMI only accesses a specific PLC. Then, according to the second data acquired in step S204, that is, a log of the HMI, if the HMI accessed other PLCs, it is determined that the access behavior is abnormal behavior.

As another example: in step S203, the behavior model obtained by means of counting comprises: a CPU occupancy rate of an operator station does not exceed <NUM>%. Then, according to the second data acquired in step S204, that is, a log of the operator station, if the CPU occupancy rate exceeds <NUM>%, it is determined that the industrial control system <NUM> exhibits abnormal behavior. If it is determined in step S205 that the behavior of the industrial control system <NUM> that is represented by the second data is abnormal behavior, optionally, alarm reporting may be performed by using the method shown in <FIG>.

As shown in <FIG>, an embodiment of the present invention further provides a hierarchical alarming method, wherein the method comprises the following steps:.

Unlike IT systems, industrial control systems are typical cyber-physical systems (CPS). The most critical devices for an industrial control system are industrial controllers and field devices that control the physical world, and therefore, these devices have higher requirements for network security. Relatively, a manufacturing execution system (MES) and an enterprise resource planning (ERP) system in an enterprise network that are at a management level have requirements for network security that are not higher than requirements of the industrial controllers and the field devices. To avoid excessive security-related alarm reporting, a level of the previously described alarm and the lowest alarm priority level may be preset. When the industrial control system <NUM> exhibits abnormal behavior, the method shown in <FIG> is used to first determine an alarm level corresponding to the abnormal behavior, and if the alarm level is higher than the preset lowest alarm priority level, alarm reporting is performed, otherwise, alarm reporting is not performed, which effectively reduces the reporting of low-level alarms.

In order to implement the isolation of the industrial control system from the enterprise network, a demilitarized zone (DMZ) may be arranged between the industrial control system and the enterprise network to place, in the DMZ, some devices such as servers accessible to a network outside the industrial control system. The DMZ usually comprises a front-end firewall, a back-end firewall, and other devices and applications for data exchange, such as OPC servers. The DMZ is isolated from the enterprise network by means of the front-end firewall, and the industrial control system is isolated from the DMZ by means of the back-end firewall.

In this embodiment of the present invention, optionally, as shown in <FIG>, the DMZ <NUM> is isolated from the industrial control system <NUM> by means of the back-end firewall <NUM>, and the DMZ <NUM> is isolated from the enterprise network <NUM> by means of the front-end firewall <NUM>. A file transfer protocol (FTP) server 300a, a mail server 300b, etc. may be deployed in the DMZ <NUM>. Security policies may be respectively set on the front-end firewall <NUM> and the back-end firewall <NUM>, so as to prevent the enterprise network <NUM> from directly communicating with the industrial control system by means of the DMZ <NUM>. An anti-virus mechanism based on a blacklist or a whitelist may also be deployed on an industrial host of the industrial control system <NUM>. In addition, an additional firewall or virtual private network (VPN) may also be deployed on the industrial controller <NUM>, so as to ensure the security of communication between the industrial host and the industrial controller <NUM>.

Optionally, as shown in <FIG>, the levels of alarms in descending order of priorities sequentially comprise at least two of the following levels:.

The alarms related to the front-end firewall <NUM> are of the lowest level because an attack source can only detect the demilitarized zone <NUM>.

The alarms related to the back-end firewall <NUM> or the server and/or application in the demilitarized zone <NUM> are set to be alarms with a slightly high priority because an attack source has been able to penetrate through the demilitarized zone <NUM> and may interfere with communication and application between the industrial control system <NUM> and the enterprise network <NUM>, but is not accessible to the industrial control system <NUM>.

The alarms related to the industrial host in the industrial control system <NUM> are of a higher priority because these alarms indicate that an attack source has been accessible to management-level devices such as an engineer station, an HMI device, and a server in the industrial control system <NUM>, and has already posed a relatively great threat to the industrial control system <NUM>.

If the behavior of the attack source continues to expand and has infiltrated into a control network, that is, having an impact on a network communication between a management level and a control level, i.e. a network communication between the industrial host and the industrial controller <NUM>, it indicates that a greater threat has been imposed on the industrial control system <NUM>. Therefore, the alarms related to the network communication in the industrial control system <NUM> have a higher priority.

Alarms with the highest priority occur when an attack source has gained access to the industrial controller <NUM> or even to the field device to manipulate a control operation.

The above hierarchical method is only taken as an example. In fact, as long as the alarm can be reported hierarchically according to the security threat to the industrial control system <NUM>, an important alarm can be preferentially processed. By distinguishing the priorities of alarms, maintenance personnel can spend a relatively large amount of time and effort in processing higher-priority alarms without paying too much attention to lower-priority alarms.

Optionally, in this embodiment of the present invention, after determining that the behavior of the industrial control system that is represented by the second data is abnormal behavior, the network security monitoring system <NUM> may further determine whether the behavior of the industrial control system that is represented by the second data is a network attack, and if so, position an attack source according to an object targeted by the behavior of the industrial control system that is represented by the second data.

For one network attack, there are three important factors shown in <FIG>:
an attack source <NUM>, a security threat <NUM>, and an attack target <NUM>.

The attack source <NUM> may come from inside the industrial control system <NUM> and/or outside the industrial control system <NUM>, and aims to attack the industrial control system <NUM>. The attack source <NUM> may come from hackers, malicious organizations, or even malicious countries, or may come from malicious employees, former employees, joint venture companies, etc..

The security threat <NUM> is a capability and/or a mechanism used by the attack source <NUM> to attack the industrial control system <NUM>.

The attack target <NUM> may be the industrial controller <NUM>, the network switching and routing device <NUM> in the industrial control system <NUM>, control operations and flows of the industrial host, or even important data in the industrial control system <NUM>.

The attack target <NUM> may also be referred to as assets in the industrial control system <NUM>. The aforesaid first data source may be state data of these assets in the industrial control system <NUM>. The network security monitoring system <NUM> may acquire state data, i.e. the aforesaid first data, of these assets by deploying an data acquisition apparatus at these assets, and store the first data as historical data.

When determining, by using step S205 mentioned previously, that the behavior of the industrial control system <NUM> is abnormal, the network security monitoring system <NUM> may determine, based on the above-mentioned historical data, whether the abnormal behavior is a network attack. The network attack comprises but is not limited to: malicious software, a phishing mail, a vulnerability detection, a violent password attack, etc..

If determining that the abnormal behavior is a network attack, the network security monitoring system <NUM> may determine the attack source <NUM> according to the abnormal behavior, for example:.

In addition, optionally, after determining that the abnormal behavior of the industrial control system <NUM> is a network attack, the network security monitoring system <NUM> may further determine a network attack phase of the abnormal behavior, wherein different network attack phases pose different levels of threats to the industrial control system <NUM>. The network attack phases comprise but are not limited to the following phases:.

In the reconnaissance phase, the attack source <NUM> may study, identify, and select the attack target <NUM>, i.e. assets in the industrial control system <NUM>. For example: a meeting agenda, a list of mail addresses, social relationship information, etc. may be acquired from the Internet website through crawler technology.

In the weaponization phase, remote access Trojans are placed in transmittable payloads by means of automation tools, etc., and these transmittable payloads may be referred to as "weapons". These transmittable payloads comprise but are not limited to: client application data files such as a portable document format (PDF) file, a Microsoft Office file, etc..

In the weapon delivery phase, the attack target <NUM> is attacked by exploiting a weapon in manners comprising but not limited to: a mail attachment, a website, a universal serial bus (USB) pluggable medium.

After the attack target <NUM> has been attacked by exploiting a weapon, an attack code starts to be triggered. Usually, the attack target <NUM> comprises the vulnerability in an application program or an operating system. Alternatively, characteristics of a user or an operating system of the industrial control system <NUM> may also be simply exploited so as to execute a segment of codes that is automatically to be executed.

In the installation phase, a remote Trojan or backdoor may be installed on the attack target <NUM>, so as to implement continuous operations on the industrial control system <NUM>.

In the command and control phase, the attack target <NUM> establishes a C2 channel with an external Internet server. An intruder manually operates the attack source <NUM> to implement a direct operation on the attack target <NUM>.

After the above-mentioned six phases, the intruder may directly operate the attack target <NUM>. For example: Data infiltration (data exfiltration), such as data collection, data encryption, and information extraction, may be performed for the attack target <NUM>, so as to destroy the data integrity and availability of the attack target <NUM>. In addition, the intruder may also use the attack target <NUM> as an intermediate point, so as to go deeper into the interior of the industrial control system <NUM>.

Through analysis of the above-mentioned network attack phases, the performance, mechanisms, and technologies of the network attacks in different phases may be studied, real security threats may be identified, appropriate measures may be taken to prevent the network attack, and then the network security of the industrial control system <NUM> may be further predicted.

<FIG> is a schematic structural diagram of the network security monitoring system <NUM> provided in an embodiment of the present invention. The network security monitoring system may be used to implement the above-mentioned network security monitoring method. As shown in <FIG>, the network security monitoring system <NUM> may comprise:.

Optionally, the data source selection module <NUM> is specifically used for selecting the at least one first data source related to the industrial control system <NUM> according to at least one of the following factors: at least one running indicator of the industrial control system <NUM> that is defined by a customer of the industrial control system <NUM>; at least one network security policy of the industrial control system <NUM> that is defined by the customer of the industrial control system <NUM>; a normal running process of the industrial control system <NUM>; configuration information of at least one constituent part of the industrial control system <NUM>; and a network attack that the industrial control system <NUM> may be subjected to.

Optionally, the at least one first data source selected by the data source selection module <NUM> comprises: a log of at least one industrial host in the industrial control system <NUM>, and/or network traffic captured from at least one critical network position in the industrial control system <NUM>, and/or a security log of at least one security protective device in the industrial control system <NUM>, and/or a network log of at least one network switching and routing device in the industrial control system <NUM>.

Optionally, the at least one first data source selected by the data source selection module <NUM> comprises the log of the at least one industrial host in the industrial control system <NUM>, and the data acquisition module <NUM> is specifically used for acquiring, for each of the at least one industrial host, at least one piece of the following data from the log of the industrial host to serve as the first data of the industrial host: hardware performance data during running of the industrial host; file input/output information during running of the industrial host; a processing flow for an industrial application program running on the industrial host; and a resource in the industrial control system <NUM> that is accessed by the industrial application program running on the industrial host.

Optionally, the at least one first data source selected by the data source selection module <NUM> comprises the network traffic captured from the at least one critical network position in the industrial control system <NUM>, and the data acquisition module <NUM> is specifically used for determining, for each of the at least one critical network position, at least one piece of the following information of the network traffic to serve as the first data of the critical network position: a source address of a data packet in the network traffic; a destination address of the data packet in the network traffic; a function code of an industrial control communication protocol used by the network traffic; and application layer data in the network traffic.

In this case, the behavior model generated by the model generation module <NUM> is used to describe at least one of the following features of communication within the industrial control system <NUM>: a communication flow between an industrial host and an industrial controller in the industrial control system <NUM>; a function performed by an industrial application program in the industrial control system <NUM>; and the state of an industrial device in the industrial control system <NUM> and the state of a process variable monitored by the industrial device.

Optionally, the at least one first data source selected by the data source selection module <NUM> comprises the log of the at least one industrial host in the industrial control system <NUM>, and the data acquisition module <NUM> is specifically used for acquiring at least one piece of the following information from the at least one industrial host to serve as the first data: information for logging in and/or logging out of the industrial control system <NUM> by the user by means of the at least one industrial host; a control command executed by the user on the at least one industrial host for the industrial control system <NUM>; and data in the industrial control system <NUM> that is accessed by the user by means of the at least one industrial host.

For this case, the behavior model generated by the model generation module <NUM> is used to describe at least one of the following features of user behavior of the industrial control system <NUM>: a working time; a normal operation; and a data acquisition mode.

Optionally, the network security monitoring system <NUM> further comprises an alarm processing module <NUM>, wherein after the abnormal behavior determination module <NUM> determines that the behavior of the industrial control system <NUM> that is represented by the second data is abnormal behavior, the alarm processing module is used for: determining a level of an alarm corresponding to the behavior of the industrial control system <NUM> that is represented by the second data; and triggering alarm reporting if the determined level is higher than a preset lowest alarm priority level, otherwise, skipping triggering alarm reporting.

The levels of the alarms in descending order of priorities sequentially comprise at least two of the following levels: a first level, wherein alarms at the first level comprise alarms related to an industrial controller in the industrial control system <NUM>; a second level, wherein alarms at the second level comprise alarms in an industrial control network in the industrial control system <NUM>; a third level, wherein alarms at the third level comprise alarms related to an industrial host in the industrial control system <NUM>; a fourth level, wherein alarms at the fourth level comprise alarms related to a back-end firewall, server and/or application in a demilitarized zone <NUM>, and the demilitarized zone <NUM> is used for separating the industrial control system <NUM> from an enterprise network <NUM> of the industrial control system <NUM>; and a fifth level, wherein alarms at the fifth level comprise alarms related to the front-end firewall in the demilitarized zone <NUM>.

Optionally, the network security monitoring system <NUM> further comprises an attack source positioning module <NUM>, wherein after the abnormal behavior determination module <NUM> determines that the behavior of the industrial control system <NUM> that is represented by the second data is abnormal behavior, the attack source positioning module is used for: determining whether the behavior of the industrial control system <NUM> that is represented by the second data is a network attack; and if so, positioning an attack source according to an object targeted by the behavior of the industrial control system <NUM> that is represented by the second data.

Optionally, the network security monitoring system <NUM> further comprises an attack phase determination module <NUM>, wherein after the abnormal behavior determination module <NUM> determines that the behavior of the industrial control system <NUM> that is represented by the second data is abnormal behavior, the attack phase determination module is used for: determining whether the behavior of the industrial control system <NUM> that is represented by the second data is a network attack; and if so, determining a network attack phase of the behavior of the industrial control system <NUM> that is represented by the second data, wherein different network attack phases pose different levels of threats to the industrial control system <NUM>.

Other optional implementations of the network security monitoring system may be implemented with reference to the network security monitoring method mentioned previously, which is not described herein again.

<FIG> is another schematic structural diagram of the network security monitoring system <NUM> provided in the embodiment of the present invention. The network security monitoring system <NUM> may also be used to implement the network security monitoring method mentioned previously. As shown in <FIG>, the network security monitoring system <NUM> may comprise: at least one memory <NUM> for storing machine-readable instructions; and at least one processor <NUM> for invoking the machine-readable instructions, so as to carry out the network security monitoring method provided in this embodiment of the present invention.

<FIG> is a schematic structural diagram of an alarm processing apparatus <NUM> provided in an embodiment of the present invention. The alarm processing apparatus <NUM> may be used to implement the alarming method mentioned previously. As shown in <FIG>, the alarm processing apparatus <NUM> may comprise:.

The levels of the alarms in descending order of priority sequentially comprise at least two of the following levels: a first level, wherein alarms at the first level comprise alarms related to an industrial controller in the industrial control system <NUM>; a second level, wherein alarms at the second level comprise alarms in an industrial control network in the industrial control system <NUM>; a third level, wherein alarms at the third level comprise alarms related to an industrial host in the industrial control system <NUM>; a fourth level, wherein alarms at the fourth level comprise alarms related to a back-end firewall, server and/or application in a demilitarized zone <NUM>, and the demilitarized zone <NUM> is used for separating the industrial control system <NUM> from an enterprise network <NUM> of the industrial control system <NUM>; and a fifth level, wherein alarms at the fifth level comprise alarms related to the front-end firewall in the demilitarized zone <NUM>.

For other optional implementations of the alarm processing apparatus <NUM>, reference may be made to the alarming method mentioned previously, which is not described herein again.

<FIG> is another schematic structural diagram of the alarm processing apparatus <NUM> provided in the embodiment of the present invention. The alarm processing apparatus <NUM> may also be used to implement the alarming method mentioned previously. As shown in <FIG>, the alarm processing apparatus <NUM> may comprise: at least one memory <NUM> for storing machine-readable instructions; and at least one processor <NUM> for invoking the machine-readable instructions, so as to carry out the alarming method provided in this embodiment of the present invention.

The machine-readable medium provided in the embodiments of the present invention stores machine-readable instructions thereon that, when executed by a processor, cause the processor to carry out any one of the methods mentioned previously. Specifically, a system or apparatus equipped with a machine-readable medium may be provided, and the machine-readable medium stores thereon software program codes that implement the functions of any one of the embodiments described above, and cause a computer or processor for the system or apparatus to read and execute machine-readable instructions stored in the machine-readable medium.

In this condition, the program codes per se read from the machine-readable medium may implement the functions of any one of the embodiments described above, and therefore the machine-readable codes and the machine-readable medium storing the machine-readable codes constitute a part of the present invention.

The embodiments of the machine-readable medium comprise a floppy disk, a hard disk, a magnetic optical disk, a compact disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW and DVD+RW), a magnetic tape, a non-volatile memory card and ROM. Optionally, the program codes may be downloaded from a server computer or a cloud via a communication network.

It needs to be noted that not all the steps and modules in the flow and structural diagrams of the system described above are necessary, and some steps or modules may be omitted according to practical requirements. The execution order of the various steps is not fixed and may be adjusted according to requirements. The structure of the system described in the various embodiments above may be a physical structure and may also be a logical structure, i.e. some modules may be implemented by the same physical entity, or some modules may be implemented separately by a plurality of physical entities, or may be implemented jointly by some components in a plurality of independent devices.

In the various embodiments above, a hardware unit may be implemented mechanically or electrically. For example, a hardware unit may comprise a permanent dedicated circuit or logic (such as a dedicated processor, FPGA or ASIC) to accomplish a corresponding operation. The hardware unit may also comprise a programmable logic or circuit (such as a general-purpose processor or other programmable processors), and may be set temporarily by software to accomplish a corresponding operation. The specific implementation (mechanically, or a dedicated permanent circuit, or a temporarily set circuit) may be determined in consideration of cost and time.

Claim 1:
A method for monitoring the network security of an industrial control system (<NUM>), characterized by comprising:
selecting (S201) at least one first data source related to the industrial control system (<NUM>), wherein the at least one first data source is used for measuring whether the industrial control system (<NUM>) meets a network security requirement;
acquiring (S202) first data from the at least one first data source;
counting (S203) time-varying features of the first data to serve as a behavior model for the industrial control system (<NUM>);
acquiring (S204) second data from some or all of the at least one first data source; and
determining (S205) whether the second data has the features described by the behavior model, and if so, determining that behavior of the industrial control system (<NUM>) that is represented by the second data is normal behavior, and if not, determining that the behavior is abnormal behavior,
wherein after determining that the behavior of the industrial control system (<NUM>) that is represented by the second data is abnormal behavior, the method further comprises:
determining whether the behavior of the industrial control system (<NUM>) that is represented by the second data is a network attack,
and if so, determining a network attack phase among a plurality of different network attack phases of the abnormal behavior of the industrial control system (<NUM>) that is represented by the second data, wherein the different network attack phases pose different levels of threat to the industrial control system (<NUM>).