CN116633965A - Industrial control network environment data acquisition system and method - Google Patents

Abstract

The application discloses an industrial control network environment data acquisition system and method, wherein the system comprises an acquisition task management module, an acquisition proxy module, a host acquisition module, a flow acquisition module and a protocol acquisition module; the acquisition task management module receives and analyzes the control instruction and the acquisition scheme to form a deployment scheme, and feeds back the acquisition strategy upwards; after deployment is completed, issuing a request for full-source acquisition data; the acquisition agent module receives the deployment proposal, transmits the deployment proposal to the host acquisition module, the flow acquisition module and the protocol acquisition module, and uploads deployment feedback data to the acquisition task management module; and receiving the total source acquisition data request, distributing a request message to the host acquisition module, the flow acquisition module and the protocol acquisition module, and pushing acquisition data reported by the host acquisition module, the flow acquisition module and the protocol acquisition module to the acquisition task management module.

Description

Industrial control network environment data acquisition system and method

technical field

The application relates to an industrial control network environment data collection system and method, belonging to the field of industrial control network monitoring.

Background technique

At present, most of the collection and processing strategies for industrial control network assets are to display the topological assets in a full and flat two-dimensional manner. When there are many network asset nodes, all nodes are crowded and displayed together, which has performance problems and is difficult to maintain. and management.

Contents of the invention

According to one aspect of the present application, an industrial control network environment data acquisition system is provided. The system can monitor, collect and summarize industrial control protocol business data, network data, and host node data in the form of acquisition tasks.

The industrial control network environment data acquisition system includes: an acquisition task management module, an acquisition agent module, a host acquisition module, a traffic acquisition module, and a protocol acquisition module;

The acquisition task management module is used to receive and analyze control instructions and acquisition schemes, form a deployment scheme from the analyzed acquisition schemes, and feed back the acquisition strategies upward; when the deployment is completed, issue an all-source acquisition data request;

The collection agent module is used to receive the deployment plan, issue it to the host collection module, traffic collection module, and protocol collection module, and upload deployment data to the collection task management module; receive the all-source collection data request, and send The request message is dispatched to the host acquisition module, traffic acquisition module, and protocol acquisition module, and the acquisition data reported by the host acquisition module, traffic acquisition module, and protocol acquisition module is pushed to the acquisition task management module.

Preferably, the acquisition task management module provides an interface for issuing a collection and deployment plan, which is used to issue a deployment plan to the collection agent module; the acquisition agent module provides a deployment plan receiving interface, adopts the http protocol, and supports post request mode, It is used to receive the deployment scheme and send it to the host collection module, traffic collection module, and protocol collection module.

Preferably, the collection agent module also provides an environment deployment feedback interface for reporting the deployment feedback data of the host collection module, traffic collection module, and protocol collection module to the collection task management module; the collection task management module An environment deployment feedback receiving interface is provided for obtaining the deployment feedback data.

Preferably, the collection agent module is also used to save the summarized raw data, and classify and store the data after data cleaning and preprocessing.

Preferably, the collection agent module is further configured to provide a collection task control interface for obtaining the collection task control command pushed by the collection task management module.

Preferably, the message of the task control command includes the collection task id and task status, and the task status is start, pause or stop.

Preferably, the collection agent module provides an all-source collection data receiving interface, which is used to obtain the host collection module, flow collection The collection data reported by the module and the protocol collection module are pushed to the collection task management module.

Preferably, the reporting type of the collected data includes at least one of the following: host node data, network data, and service data.

Preferably, the host node data includes status information of industrial control equipment.

Preferably, the network data includes at least one of the following: traffic in the industrial control network, and remote control events.

Preferably, the business data includes three remote data of industrial control equipment.

Preferably, the host collection module is deployed on the target host as a service.

Preferably, the traffic collection module is deployed on the traffic collection device in a bypass mode, connected to the aggregation switch of the target environment, and traffic mirroring is configured on the access port to introduce the traffic of the target environment into the traffic collection module. At present, the traffic collection technology is to capture traffic packets on each terminal in the environment, and then complete the aggregation. This application adopts the bypass method to complete the deployment, which can avoid capturing packets on each terminal device port, and only needs to perform traffic mirroring on the core switch to collect all the traffic forwarded by the switch.

Preferably, the traffic collection module is also used to filter the traffic according to the collection strategy, and package and encapsulate the matched traffic packets into restful packets and send them to the collection agent module;

Preferably, the filtered information includes at least one of the following: set source IP, destination IP, port, packet protocol, and packet fields.

Preferably, the protocol collection module is deployed on the protocol collection device in a bypass manner and connected to the target PLC device. The existing technology is usually to capture packets and analyze the protocol data content at the protocol data receiving end of the upstream workstation. This application adopts a bypass method, which can obtain the most original protocol data from the protocol data sender, and does not need to capture and analyze the data in the environment.

According to another aspect of the present application, a collection method based on the above-mentioned industrial control network environment data collection system is provided, including:

The collection task management module receives and analyzes the control instructions and the collection plan, forms the deployment plan after the analysis of the collection plan, sends it to the collection agent module, and feeds back the collection strategy;

The collection proxy module sends the collection policy to the host collection module, traffic collection module and protocol collection module according to the deployment plan, collects deployment data and deploys feedback data;

After the deployment is completed, the collection agent module receives the all-source collection data request issued by the collection task management module, and distributes the request message to the host collection module, traffic collection module and protocol collection module;

The host acquisition module, traffic acquisition module and protocol acquisition module feed back the acquired data to the acquisition task management module through the acquisition agent module.

Preferably, the collection task management module forms a deployment plan from the parsed collection plan, and sending it to the collection agent module includes:

The acquisition task management module provides an interface for issuing a deployment plan, and issues an environment deployment plan to the acquisition agent module. The acquisition agent module provides a receiving interface, and the receiving interface adopts the http protocol and supports post request for data delivery.

Preferably, the timing for collecting the deployment data is: after the host collection module, flow collection module and protocol collection module receive the deployment scheme.

Preferably, the collection timing of the deployment feedback data is: the collection agent module receives the deployment completion instruction sent by the host collection module, the flow collection module and the protocol collection module, and notifies the collection task management module that the deployment is completed and the collection can start. The collection task management module sends a task start control command to the collection agent module, and the collection agent module sends it to the host collection module, traffic collection module and protocol collection module to start data collection. The host collection module, traffic collection module and protocol collection module perform collection according to the collection interval period and collection target IP in the collection strategy, and report the collected data in real time. After the collection task management module issues a collection task stop command to the collection agent module, the collection agent module notifies the host collection module, traffic collection module and protocol collection module to stop collection and reporting.

Preferably, the collection and deployment data includes at least one of the following: collection task id, device id, and start time.

Preferably, the collection task management module provides an environment deployment feedback receiving interface, and the collection agent module reports the environment deployment status to the collection task management module.

Preferably, the collecting deployment feedback data includes at least one of the following: collecting task id and deployment progress.

Preferably, the collection method further includes: the collection task management module pushes a collection task control command to the collection proxy module; the host collection module, traffic collection module and protocol collection module complete the collection task according to the task control command .

Preferably, during the execution of the collection task, the collection agent module uploads the collection data of the host collection module, flow collection module and protocol collection module.

Preferably, after the collection agent module acquires the data collected by the host collection module, flow collection module and protocol collection module, it collects and stores the original data in the database.

Preferably, the collection agent module performs data cleaning on the raw data, and stores the classified and organized data into the database.

Preferably, the collection agent module provides a collection task control interface.

Preferably, the packet of the collection task control command includes at least one of the following: a collection task id, a task start command, a task pause command, and a task stop command.

Preferably, the collection method includes: after the host collection module, the flow collection module and the protocol collection module receive the collection request sent by the collection agent module, they collect the data while reporting the collection data to the collection through the all-source collection data reporting interface A subsystem in the agent management module.

Preferably, the collected data includes at least one of the following: host node data collected by the host collection module, network data collected by the traffic collection module, and service data collected by the protocol collection module.

Preferably, the host node data includes status information of industrial control equipment.

Preferably, the network data includes at least one of the following: traffic in the industrial control network, and remote control events.

Preferably, the business data includes three remote data of industrial control equipment.

The beneficial effect that this application can produce comprises:

1) The industrial control network environment data acquisition system provided by this application, according to the equipment, manufacturers, protocol regulations, business communication content, etc. The method ensures the simultaneity of data collection and business data transmission, and has the ability to obtain real-time data of the target network.

2) The industrial control network environment data acquisition system provided by this application can acquire target network protocol data and status data of designated target devices as needed, and has the ability to flexibly configure acquisition strategies.

3) The industrial control network environment data acquisition system provided by this application can start, suspend and delete the acquisition tasks as needed, and has the ability to control the acquisition status.

4) The industrial control network environment data acquisition system provided by this application has a flexible and expandable data transmission interface. By adopting the restful protocol to transmit the collected data, the collected data fields and types can be customized and expanded after simple secondary development.

Description of drawings

FIG. 1 is a schematic structural diagram of the industrial control network environment data acquisition system of the present application.

Detailed ways

The present application is described in detail below in conjunction with the examples, but the present application is not limited to these examples.

An industrial control network environment data acquisition system can be applied to, but not limited to, electric power industrial control systems. The acquisition system includes: an acquisition task management module, an acquisition agent module, a host acquisition module, a traffic acquisition module, and a protocol acquisition module.

The acquisition task management module is used to receive and analyze control instructions and acquisition schemes, form a deployment scheme from the analyzed acquisition schemes, and feed back the acquisition strategies upward; when the deployment is completed, issue an all-source acquisition data request;

The collection agent module is configured to receive the deployment plan, send it to the host collection module, flow collection module, and protocol collection module, and feed back deployment data to the collection task management module; receive the all-source collection data request, and send The request message is dispatched to the host acquisition module, traffic acquisition module, and protocol acquisition module, and the acquisition data reported by the host acquisition module, traffic acquisition module, and protocol acquisition module is pushed to the acquisition task management module.

The collection agent module can maintain the distributed cluster composed of the host collection module, traffic collection module and protocol collection module in real time.

In one embodiment, the control instruction includes starting a collection task, stopping a collection task, and deleting a collection task.

In one embodiment, the collection scheme includes collection task ID, UUID information of the equipment to be collected in this collection task, collection status and collection progress.

In an implementation manner, the collection policy includes a collection interval, a protocol type of the collected traffic, and a filter condition of the collected traffic.

In one embodiment, the collection task management module can be edited. Acquisition policy as described for obtaining user adjustments.

In one embodiment, the collection agent module is further configured to save the summary data as raw data, and at the same time, according to relevant rules, classify and store the raw data after preprocessing.

In an implementation manner, the host acquisition module is configured to acquire status information of equipment such as an operator station. The host acquisition module is deployed on the target host as a service to obtain the status of the acquired device most realistically and quickly, and report the collected results to the acquisition agent module.

In one embodiment, the traffic collection module is used to collect traffic and remote control events in the industrial control network. The traffic collection module is deployed on the traffic collection device, and is connected to the aggregation switch of the target environment in a bypass mode. And configure traffic mirroring on the access port to introduce the traffic of the target environment into the traffic collection module. The traffic collection module filters the traffic according to the parameter information set by the collection policy, and the parameter information includes one or more of source IP, destination IP, port, message protocol, and message field. Pack and encapsulate the matching traffic packets into restful packets and send them to the collection proxy module.

In one embodiment, the protocol collection module is used to collect once telemetry, telesignal and remote control information from the DTU and the industrial control equipment SEL. The protocol acquisition module is deployed on the protocol acquisition device, and is connected to the target PLC device in a bypass mode. The protocol acquisition device has an Ethernet port and a serial port, and supports access to a PLC device with a network port or a serial port.

A collection method based on the above collection system includes 3 stages.

Phase 1 (collection task deployment phase):

The acquisition task management module stores the analyzed control commands in the database, and sends the control commands to the acquisition agent module,

The collection proxy module receives and sends deployment plans, ensures that commands are sent to various host collection modules, traffic collection modules, and protocol collection modules, and feeds back the deployment progress. After the deployment is complete, wait for the collection task management module to issue an all-source data collection request. Among them, under the premise of considering the resource utilization of the collection agent, the collection agent module also undertakes related tasks such as executing collection tasks, collecting collection results, downloading and assembling collection modules, issuing collection tasks, and reporting collection results.

The collection and deployment phase involves the deployment plan delivery interface and the environment deployment feedback interface.

The collection task management module sends the environment deployment plan to the collection agent module through the collection deployment plan delivery interface. The collection agent module provides a receiving interface for the collection and deployment plan, and the receiving interface adopts the http protocol and supports post request for data delivery. The collection agent module collects the deployment scheme delivery interface, and obtains deployment data including the collection task id, device id and start time; when the deployment scheme is delivered, the collection behavior is controlled by a task start command, a task pause command, and a task stop command.

The acquisition task management module provides an interface for receiving environment deployment feedback. The collection agent module reports the environment deployment status, that is, the deployment feedback data, to the collection task management module. The deployment feedback data includes collection task id and deployment progress.

Phase 2 (collection task startup phase):

After the collection proxy module receives the all-source data collection request, it dispatches the request message to the host collection module, flow collection module and protocol collection module.

Each collection module starts, pauses, and stops data collection tasks according to commands, and feeds back the task status at the same time. During the execution of the acquisition task, the acquisition agent module uploads the acquisition result data. The collection agent module will store the aggregated raw data in the database, clean the data at the same time, and classify and store the regularized data according to certain rules.

The acquisition and deployment phase involves the acquisition task control interface, which is provided by the acquisition agent module. The collection task management module pushes the collection task control command to the collection agent module. The task control command includes collection start, pause, stop and so on. The message of the task control command includes a collection task id, commands such as task start, pause or stop.

Phase 3 (collection result reporting phase):

After the host collection module, traffic collection module and protocol collection module receive the collection request sent by the agent module. While starting to collect host node, network traffic and primary device status information, it starts to report the collected information to the management subsystem through the all-source data collection reporting interface.

The collection result reporting stage involves the all-source collection data reporting interface, which is provided by the collection agent module. The collection agent module pushes the collection data to the collection task management module, which can be divided into host node data, network data (traffic, nodes, etc.), business data (three remotes), etc. according to the reporting type.

The above is only an embodiment of the application, and does not limit the application in any form. Although the application is disclosed as above with a preferred embodiment, it is not used to limit the application. Within the scope of the technical solution of the present application, some changes or modifications made using the technical content disclosed above are equivalent to equivalent implementation cases, and all belong to the scope of the technical solution.

Claims (10)

1. An industrial control network environment data acquisition system, comprising: the system comprises an acquisition task management module, an acquisition proxy module, a host acquisition module, a flow acquisition module and a protocol acquisition module;

the acquisition task management module is used for receiving and analyzing the control instruction and the acquisition scheme, forming a deployment scheme by the analyzed acquisition scheme, and feeding back the acquisition strategy upwards; after deployment is completed, issuing a request for full-source acquisition data;

the acquisition agent module is used for receiving the deployment scheme, transmitting the deployment scheme to the host acquisition module, the flow acquisition module and the protocol acquisition module, and uploading deployment data to the acquisition task management module; and receiving the total source acquisition data request, distributing a request message to the host acquisition module, the flow acquisition module and the protocol acquisition module, and pushing acquisition data reported by the host acquisition module, the flow acquisition module and the protocol acquisition module to the acquisition task management module.

2. The industrial control network environment data acquisition system according to claim 1, wherein the acquisition task management module provides an acquisition deployment scheme issuing interface for issuing a deployment scheme to the acquisition proxy module; the acquisition agent module provides a deployment scheme receiving interface, adopts an http protocol, supports a post request mode, and is used for receiving the deployment scheme and issuing the deployment scheme to the host acquisition module, the flow acquisition module and the protocol acquisition module;

preferably, the collection agent module further provides an environment deployment feedback interface, which is used for reporting deployment feedback data of the host collection module, the flow collection module and the protocol collection module to the collection task management module; the acquisition task management module provides an environment deployment feedback receiving interface for acquiring the deployment feedback data;

preferably, the collecting agent module is further used for storing summarized original data, and classifying and storing the summarized original data after data cleaning and preprocessing;

preferably, the acquisition agent module provides an acquisition task control interface for acquiring an acquisition task control command pushed by the acquisition task management module;

preferably, the message of the task control command includes a task id and a task state, wherein the task state is start, pause or stop;

preferably, the collecting agent module provides a total source collecting data reporting interface, and is used for acquiring collecting data reported by the host collecting module, the flow collecting module and the protocol collecting module after the host collecting module, the flow collecting module and the protocol collecting module receive the total source collecting data request, and pushing the collecting data to the collecting task management module;

preferably, the reporting type of the collected data includes at least one of the following: host node data, network data, service data;

preferably, the host node data includes status information of the industrial control device;

preferably, the network data comprises at least one of: traffic within the industrial control network, remote control events;

preferably, the service data comprises three remote data of the industrial control equipment.

3. The industrial control network environment data collection system of claim 1, wherein the host collection module is deployed on a target host in a service manner.

4. The industrial control network environment data acquisition system according to claim 1, wherein the flow acquisition module is deployed on the flow acquisition device in a bypass manner, is connected to a convergence switch of the target environment, is configured with a flow mirror image on the access port, and introduces the flow of the target environment into the flow acquisition module.

5. The industrial control network environment data acquisition system according to claim 1, wherein the flow acquisition module is further configured to screen and filter flows according to an acquisition policy, package the matched flow packets into a restful packet, and send the restful packet to the acquisition proxy module;

preferably, the screened information at least includes one of the following: the set source IP, destination IP, port, message protocol and message field.

6. The industrial control network environment data acquisition system of claim 1, wherein the protocol acquisition module is deployed on the protocol acquisition device in a bypass manner to access the target PLC device.

7. A method for collecting environmental data based on the industrial control network according to any one of claims 1 to 6, comprising:

the acquisition task management module receives and analyzes the control instruction and the acquisition scheme, forms a deployment scheme by the analyzed acquisition scheme, issues the deployment scheme to the acquisition agent module, and feeds back the acquisition strategy upwards;

the acquisition agent module transmits an acquisition strategy to the host acquisition module, the flow acquisition module and the protocol acquisition module according to a deployment scheme, and acquires deployment data and deployment feedback data;

after deployment is completed, the acquisition agent module receives the full-source acquisition data request issued by the acquisition task management module and distributes the request message to the host acquisition module, the flow acquisition module and the protocol acquisition module;

the host acquisition module, the flow acquisition module and the protocol acquisition module feed back acquisition data to the acquisition task management module through the acquisition agent module.

8. The method according to claim 7, wherein the collecting task management module forms a deployment scenario from the parsed collecting scenario, and issues the deployment scenario to the collecting agent module includes:

the acquisition task management module provides a deployment scheme issuing interface and issues an environment deployment scheme to the acquisition proxy module, the acquisition proxy module provides a receiving interface, and the receiving interface adopts an http protocol to support a post request mode for data issuing;

preferably, the collecting deployment data comprises at least one of: collecting task id, equipment id and starting time;

preferably, the acquisition task management module provides an environment deployment feedback receiving interface, and the acquisition agent module reports an environment deployment state to the acquisition task management module;

preferably, the collecting deployment feedback data includes at least one of: and collecting task ids and deployment progress.

9. The acquisition method according to claim 7, characterized by comprising: the acquisition task management module pushes an acquisition task control command to the acquisition proxy module; the host acquisition module, the flow acquisition module and the protocol acquisition module complete acquisition tasks according to the task control commands;

preferably, in the executing process of the collection task, the collection agent module uploads the collection data of the host collection module, the flow collection module and the protocol collection module;

preferably, the collecting agent module gathers the original data into a database after acquiring the collected data of the host collecting module, the flow collecting module and the protocol collecting module;

preferably, the acquisition agent module performs data cleaning on the original data, and stores the data subjected to classification storage normalization into a database;

preferably, the acquisition agent module provides an acquisition task control interface;

preferably, the message for collecting the task control command includes at least one of the following: acquisition task DD220607I

id. Task start command, task pause command, task stop command.

10. The acquisition method according to claim 7, characterized by comprising: after the host acquisition module, the flow acquisition module and the protocol acquisition module receive the acquisition request issued by the acquisition proxy module, the acquisition data is reported to a subsystem in the acquisition proxy management module through a full-source acquisition data reporting interface while the data is acquired;

preferably, the acquired data comprises at least one of: host node data collected by the host collecting module, network data collected by the flow collecting module and service data collected by the protocol collecting module;

preferably, the host node data includes status information of the industrial control device;

preferably, the network data comprises at least one of: traffic within the industrial control network, remote control events;

preferably, the service data comprises three remote data of the industrial control equipment.