CN116684124A - Data acquisition and transmission method and system - Google Patents

Abstract

The application provides a data acquisition and transmission method and system, and belongs to the technical field of data acquisition. The method comprises the following steps: and establishing communication connection between the intelligent collector and the DCS system. And collecting log data and full flow data of the DCS system through an intelligent collector. Therefore, the burden of the DCS system network external networking structure is reduced, and the complexity of the DCS system information security network is also reduced. And after the log data and the full flow data are gathered, the collected log data and the full flow data are sent to a plant-level analysis platform outside a local area network to which the DCS system belongs. And analyzing the log data and the full flow data through a factory-level analysis platform to obtain a first analysis result. The intelligent construction method and the intelligent construction system provide accurate data support for constructing the network security environment of the local area network, improve the work response efficiency of engineers, reduce the maintenance cost and effectively reduce the network access of the local area network while completing the intelligent construction, thereby reducing the network security risk point of the local area network and being beneficial to the network security management of the local area network.

Description

Data collection and transmission method and system

technical field

The invention relates to the technical field of data collection, and in particular to a data collection and transmission method and a data collection and transmission system.

Background technique

The safety area of the power plant is divided into the control area (safety production area I), the non-control area (safety area II) and the management information area. Among them, the DCS system is mainly distributed in the control area, that is, the safety production area I. The production control instruction data and other contents in the DCS system are all in the safety production area I. It is a relatively independent LAN environment, and the data is separated from the safety area II through one-way isolation Interactive, not directly connected to the Internet, the data of the safety production area I need to be sent out separately, and sent to the factory-level analysis platform, in order to realize the construction of the factory-level analysis platform. The security II area is mainly the SIS system, which is responsible for data collection and processing, and realizes the sharing of real-time production information and management information; while the management information area combines production data and enterprise office information and other data. In the construction process of smart power plants, traditional log collection and traffic collection need to use two sets of independent collection devices to complete the data collection work, and import them into the corresponding analysis platform for analysis and processing, and then send them to the outside of the safety production zone I through the analysis platform The plant-level analysis platform sends data to complete the overall construction of the situation awareness platform of the smart power plant. In this scheme, the burden of the DCS system network external network structure is increased, and at the same time, more network entrances and exits are brought to the safety production zone I. The introduction of The network security risk point is not conducive to the network security management of the safe production area I.

Figure 1 is a traditional log collection and flow collection network structure diagram provided by this application. As shown in Figure 1, the traditional log collection and flow collection devices are independent of each other, and the analysis platform is relatively independent, and it can be analyzed at the factory level outside the safety production zone I When the platform is aggregated, an independent export is required, which not only causes untimely engineer maintenance and threat response, but also increases the relatively independent external connection risk points of the safety production zone I.

Contents of the invention

The purpose of the embodiments of the present invention is to provide a data collection and transmission method and system to at least solve the above-mentioned existing technology that increases the burden on the network structure outside the DCS system network, and at the same time brings more network entrances and exits to the safe production zone I. The introduction of network security risk points is not conducive to the issue of network security management in the safety production area I.

In order to achieve the above object, the first aspect of the present invention provides a data collection and transmission method, including:

Establish a communication connection between the intelligent collector and the DCS system;

Collect the log data and full flow data of the DCS system through the intelligent collector;

After the log data and full flow data are aggregated, they are sent to the factory-level analysis platform located outside the local area network to which the DCS system belongs;

The log data and full flow data are analyzed through the factory-level analysis platform to obtain the first analysis results.

Optionally, the above-mentioned DCS system includes a switch;

The above-mentioned collection of full flow data of the DCS system through the intelligent collector includes:

Receive the full flow data transmitted by the mirror port of the switch through the intelligent collector.

Optionally, the above-mentioned collection of log data of the DCS system through the intelligent collector includes:

The intelligent collector receives the log data collected by the device agent of the device deployed in the DCS system in the form of Syslog.

Optionally, after the above aggregated log data and full flow data are sent to a factory-level analysis platform located outside the local area network to which the DCS system belongs, including:

After compressing the full flow data, send it to the factory-level analysis platform;

Send the log data to the factory-level analysis platform in the form of Syslog.

Optionally, the log data and full flow data are analyzed through the factory-level analysis platform to obtain the first analysis results, including:

Mining network characteristics of log data and full traffic data;

Based on network characteristics and preset whitelist rules, combined with preset threat databases, correlation analysis is performed to determine whether there is abnormal data traffic;

If there is an abnormal data flow, an alarm message will be generated according to the abnormal data flow;

According to the alarm information, identify the assets that send out abnormal data traffic;

Based on the asset that sends out the abnormal data flow, traceability analysis is performed to obtain the first analysis result, which is used to indicate whether there is abnormal data and the cause of the abnormal data.

Optionally, the above data collection and transmission method also includes:

Visual display of log data through the factory-level analysis platform.

Optionally, the communication connection of the above-mentioned intelligent collector has an analysis platform in a local area network, and the method also includes:

The intelligent collector sends the log data and full flow data to the analysis platform in the LAN;

The log data and full flow data are analyzed through the analysis platform in the local area network to obtain the second analysis result.

A second aspect of the present invention provides a data collection and transmission system, including:

The connection establishment module is used to establish the communication connection between the intelligent collector and the DCS system;

The data collection module is used to collect the log data and full flow data of the DCS system through the intelligent collector;

The data transmission module is used to aggregate log data and full flow data and send them to the factory-level analysis platform located outside the local area network to which the DCS system belongs;

The data analysis module is used to analyze the log data and full flow data through the factory-level analysis platform to obtain the first analysis result.

A third aspect of the present invention provides a machine-readable storage medium, where instructions are stored on the machine-readable storage medium, and when the instructions are executed by a processor, the processor is configured to execute the above data collection and transmission method.

The fourth aspect of the present invention provides an electronic device. The electronic device includes a memory, a processor, and a computer program stored in the memory and operable on the processor. When the processor executes the computer program, the above-mentioned data collection and transmission are realized. method.

Through the above technical solution, a data collection and transmission method and system only use the intelligent collector to collect the full flow data of the DCS system and the log data collection of the DCS system equipment, thereby reducing the burden on the network structure outside the DCS system network, and also reducing The complexity of the DCS system information security network is improved, and the threat alarm and equipment status information in the DCS system network are highly integrated. Through the intelligent collector, the data is sent out to the factory-level analysis platform located outside the safety production area I, which is the local area network of the DCS system, to provide accurate data support for the construction of the network security environment of the safety production area I area. While completing the intelligent construction, It improves the work response efficiency of engineers, reduces maintenance costs, and effectively reduces the network entrances and exits of the safety production area I, thereby reducing the network security risk points of the safety production area I area, which is beneficial to the network security management of the safety production area I area.

Other features and advantages of embodiments of the invention will be described in detail in the detailed description that follows.

Description of drawings

The accompanying drawings are used to provide a further understanding of the embodiments of the present invention, and constitute a part of the description, together with the following specific embodiments, are used to explain the embodiments of the present invention, but do not constitute limitations to the embodiments of the present invention. In the attached picture:

Fig. 1 is a kind of traditional log collection and traffic collection network structural diagram that this application provides;

Fig. 2 is a flow chart of a data collection and transmission method provided by an embodiment of the present invention;

Fig. 3 is a log and traffic collection network structural diagram of an intelligent collector provided by an embodiment of the present invention;

Fig. 4 is a structural block diagram of a data acquisition and transmission system provided by an embodiment of the present invention;

Fig. 5 is a schematic structural diagram of an electronic device provided by a preferred embodiment of the present invention.

Explanation of reference signs

10-electronic equipment, 100-processor, 101-memory, 102-computer program.

Detailed ways

Specific embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described here are only used to illustrate and explain the present invention, and are not intended to limit the present invention.

Please refer to Figure 2 and Figure 3, Figure 2 is a flow chart of a data collection and transmission method provided by an embodiment of the present invention, and Figure 3 is a structural diagram of an intelligent collector log and traffic collection network provided by an embodiment of the present invention . An embodiment of the present invention provides a data collection and transmission method, including:

S110: establishing a communication connection between the intelligent collector and the DCS system;

Specifically, the intelligent collector is connected to the DCS system, so as to establish a communication connection between the intelligent collector and the DCS system.

S120: collect the log data and full flow data of the DCS system through the intelligent collector;

S130: After collecting log data and full flow data, send them to the factory-level analysis platform located outside the local area network to which the DCS system belongs;

Among them, the local area network to which the DCS system belongs belongs to the safety production area I.

Specifically, the intelligent collector receives the full flow data and log data, completes the aggregation of information and data in the safety production area I, and forwards it to the factory-level analysis platform outside the safety production area I for analysis, providing a network security environment for the construction of the safety production area I area Accurate data support. Effectively avoid the problem in the existing technology that the analysis results can only be forwarded through the analysis platform in the LAN because the full traffic forwarding cannot be realized, resulting in incomplete data on the factory-level analysis platform, which can only display the analyzed results and cannot realize the source of network threats .

S140: Analyzing the log data and full flow data through the factory-level analysis platform to obtain a first analysis result.

Specifically, this method only collects the full flow data of the DCS system and the log data collection of the DCS system equipment through the intelligent collector, thereby reducing the burden on the network structure outside the DCS system network, and also reducing the complexity of the information security network of the DCS system , and then highly integrate threat alarms and equipment status information in the DCS system network. Through the intelligent collector, the data is sent out to the factory-level analysis platform located outside the safety production area I, which is the local area network of the DCS system, to provide accurate data support for the construction of the network security environment of the safety production area I area. While completing the intelligent construction, It improves the work response efficiency of engineers, reduces maintenance costs, and effectively reduces the network entrances and exits of the safety production area I, thereby reducing the network security risk points of the safety production area I area, which is beneficial to the network security management of the safety production area I area.

It should be noted that the above-mentioned factory-level analysis platform can simultaneously receive data from the safety production area I, the safety area II, and the management information area.

Optionally, the above-mentioned DCS system includes a switch;

The above-mentioned collection of full flow data of the DCS system through the intelligent collector includes:

Receive the full flow data transmitted by the mirror port of the switch through the intelligent collector. In order to complete the DCS system full flow data collection work. Wherein, the mirrored data in FIG. 3 is the full flow data transmitted by the mirrored port of the switch.

Optionally, the above-mentioned collection of log data of the DCS system through the intelligent collector includes:

The intelligent collector receives the log data collected by the device agent of the device deployed in the DCS system in the form of Syslog.

Specifically, all devices deployed in the DCS system are provided with a device agent (agent), which may be a software or hardware entity, and is mainly used to periodically collect log data of the corresponding device. The agent transmits the collected log data to the intelligent collector in the form of Syslog, so as to realize the purpose of collecting log data through the intelligent collector.

Exemplarily, the above log data may include device alarm information and device resource usage.

Optionally, after the above aggregated log data and full flow data are sent to a factory-level analysis platform located outside the local area network to which the DCS system belongs, including:

After compressing the full flow data, send it to the factory-level analysis platform;

Send the log data to the factory-level analysis platform in the form of Syslog.

Specifically, the intelligent collector collects the full flow data in the DCS system network, and forwards it to the plant-level analysis platform after compression processing, and the plant-level analysis platform analyzes the full flow data, and at the same time forwards the collected log data in the form of Syslog To the factory-level analysis platform, the factory-level analysis platform performs equipment log analysis, resource usage and other content display.

Optionally, the log data and full flow data are analyzed through the factory-level analysis platform to obtain the first analysis results, including:

Mining network characteristics of log data and full traffic data;

Based on network characteristics and preset whitelist rules, combined with preset threat databases, correlation analysis is performed to determine whether there is abnormal data traffic;

If there is an abnormal data flow, an alarm message will be generated according to the abnormal data flow;

According to the alarm information, identify the assets that send out abnormal data traffic;

Based on the asset that sends out the abnormal data flow, traceability analysis is performed to obtain the first analysis result, which is used to indicate whether there is abnormal data and the cause of the abnormal data.

Specifically, dig out the high-grained network characteristics of log data and full traffic data, manually configure preset whitelist rules or based on the mined network characteristics, and perform multi-dimensional correlation analysis in combination with preset threat databases to identify aggregated log data And whether there are risk characteristics in the full flow data, if there is an abnormal data flow, an abnormal data alarm will be generated, and an alarm message will be generated, and the asset that sent the abnormal data flow will be identified through the alarm information, and traceability analysis will be performed to obtain evidence to determine whether there is an abnormality data, as well as specific exceptions, and handle them.

For example, after investigating the cause of the abnormality, carry out specific treatment according to the specific problem. If the machine is broken, replace the machine. If it is human-made, it may be caused by the handler.

In some implementations of this embodiment, a deep learning algorithm may be used to process log data and full traffic data to mine high-fine-grained network features.

Optionally, the above data collection and transmission method also includes:

Visual display of log data through the factory-level analysis platform.

Optionally, the communication connection of the above-mentioned intelligent collector has an analysis platform in a local area network, and the method also includes:

The intelligent collector sends the log data and full flow data to the analysis platform in the LAN;

The log data and full flow data are analyzed through the analysis platform in the local area network to obtain the second analysis result.

Specifically, an analysis platform in the LAN is set up in the LAN to which the DCS system belongs, and the intelligent collector sends log data and full flow data to the analysis platform in the LAN for analysis, so that the data analysis results of the DCS system can be displayed separately through the analysis platform in the LAN .

Fig. 4 is a structural block diagram of a data collection and transmission system provided by an embodiment of the present invention. As shown in Fig. 4, an embodiment of the present invention provides a data collection and transmission system, including:

The connection establishment module is used to establish the communication connection between the intelligent collector and the DCS system;

The data collection module is used to collect the log data and full flow data of the DCS system through the intelligent collector;

The data transmission module is used to aggregate log data and full flow data and send them to the factory-level analysis platform located outside the local area network to which the DCS system belongs;

The data analysis module is used to analyze the log data and full flow data through the factory-level analysis platform to obtain the first analysis result.

Specifically, the system only collects DCS system full-flow data and DCS system equipment log data collection through intelligent collectors, thereby reducing the burden on the network structure outside the DCS system network, and also reducing the complexity of the DCS system information security network , and then highly integrate threat alarms and equipment status information in the DCS system network. Through the intelligent collector, the data is sent out to the factory-level analysis platform located outside the safety production area I, which is the local area network of the DCS system, to provide accurate data support for the construction of the network security environment of the safety production area I area. While completing the intelligent construction, It improves the work response efficiency of engineers, reduces maintenance costs, and effectively reduces the network entrances and exits of the safety production area I, thereby reducing the network security risk points of the safety production area I area, which is beneficial to the network security management of the safety production area I area.

An embodiment of the present invention provides a machine-readable storage medium, where an instruction is stored on the machine-readable storage medium, and when the instruction is executed by a processor, the processor is configured to execute the above data collection and transmission method.

Machine-readable storage media includes both volatile and non-volatile, removable and non-removable media that may be implemented by any method or technology for storage of information. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridge, tape magnetic disk storage or other magnetic storage device or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media excludes transitory computer-readable media, such as modulated data signals and carrier waves.

An embodiment of the present invention provides an electronic device. The electronic device includes a memory, a processor, and a computer program stored in the memory and operable on the processor. When the processor executes the computer program, the above data collection and transmission method is realized.

FIG. 5 is a schematic diagram of an electronic device provided by an embodiment of the present invention. As shown in FIG. 5 , the electronic device 10 of this embodiment includes: a processor 100 , a memory 101 , and a computer program 102 stored in the memory 101 and operable on the processor 100 . The steps in the foregoing method embodiments are implemented when the processor 100 executes the computer program 102 . Alternatively, when the processor 100 executes the computer program 102, the functions of the modules/units in the above device embodiments are implemented.

Exemplarily, the computer program 102 can be divided into one or more modules/units, and one or more modules/units are stored in the memory 101 and executed by the processor 100 to implement the present invention. One or more modules/units may be a series of computer program instruction segments capable of accomplishing specific functions, and the instruction segments are used to describe the execution process of the computer program 102 in the terminal device 10 . For example, the computer program 102 can be divided into a connection establishment module, a data acquisition module, a data transmission module and a data analysis module.

The electronic device 10 may be computing devices such as desktop computers, notebooks, palmtop computers, and cloud servers. The electronic device 10 may include, but not limited to, a processor 100 and a memory 101 . Those skilled in the art can understand that FIG. 5 is only an example of the electronic device 10, and does not constitute a limitation to the electronic device 10. It may include more or less components than shown in the figure, or combine certain components, or different components. , for example, the electronic device may also include input and output devices, network access devices, buses, and so on.

The processor 100 may be a central processing unit (Central Processing Unit, CPU), and may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), off-the-shelf Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

The storage 101 may be an internal storage unit of the electronic device 10 , such as a hard disk or a memory of the electronic device 10 . The memory 101 can also be an external storage device of the electronic device 10, such as a plug-in hard disk equipped on the electronic device 10, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash memory card (Flash Card) and so on. Further, the memory 101 may also include both an internal storage unit of the electronic device 10 and an external storage device. The memory 101 is used to store computer programs and other programs and data required by the electronic device 10 . The memory 101 can also be used to temporarily store data that has been output or will be output.

Those skilled in the art can clearly understand that for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used for illustration. In practical applications, the above-mentioned functions can be assigned to different functional units, Completion of modules means that the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment may be integrated into one processing unit, or each unit may exist separately physically, or two or more units may be integrated into one unit, and the above-mentioned integrated units may adopt hardware It can also be implemented in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the protection scope of the present application. For the specific working processes of the units and modules in the above system, reference may be made to the corresponding processes in the aforementioned method embodiments, and details will not be repeated here.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

It should also be noted that the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes Other elements not expressly listed, or elements inherent in the process, method, commodity, or apparatus are also included. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

The above are only examples of the present application, and are not intended to limit the present application. For those skilled in the art, various modifications and changes may occur in this application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the scope of the claims of the present application.

Claims (10)

1. A data acquisition and transmission method, comprising:

establishing communication connection between the intelligent collector and the DCS system;

collecting log data and full flow data of the DCS system through the intelligent collector;

the log data and the full flow data are collected and then sent to a factory-level analysis platform outside a local area network to which the DCS system belongs;

and analyzing the log data and the full flow data through the factory-level analysis platform to obtain a first analysis result.

2. The data acquisition and transmission method according to claim 1, wherein the DCS system includes a switch;

the collecting of the full flow data of the DCS system by the intelligent collector comprises the following steps:

and receiving full-flow data transmitted by the switch mirror image port through the intelligent collector.

3. The data collection and transmission method according to claim 1, wherein the collecting, by the intelligent collector, log data of the DCS system includes:

the intelligent collector receives log data collected by an equipment agent of equipment deployed in the DCS system in a Syslog form.

4. The data collection and transmission method according to claim 1, wherein the step of converging the log data and the full-flow data and then sending the collected log data and the full-flow data to a factory-level analysis platform located outside a local area network to which a DCS system belongs, includes:

after compressing the full-flow data, sending the full-flow data to a factory-level analysis platform;

the log data is sent to the factory level analysis platform in the form of Syslog.

5. The data collection and transmission method according to claim 1, wherein the analyzing the log data and the full-flow data by the factory-level analysis platform to obtain a first analysis result includes:

mining network characteristics of the log data and the full-flow data;

based on the network characteristics and a preset white list rule, carrying out association analysis by combining a preset threat library so as to judge whether abnormal data traffic exists;

if abnormal data flow exists, generating alarm information according to the abnormal data flow;

identifying assets which send out abnormal data traffic according to the alarm information;

and performing traceability analysis based on the asset sending out the abnormal data flow to obtain a first analysis result, wherein the first analysis result is used for representing whether abnormal data exists or not and the occurrence reason of the abnormal data.

6. The data acquisition and transmission method of claim 1, further comprising:

and visually displaying the log data through a factory-level analysis platform.

7. The data acquisition and transmission method of claim 1, wherein the intelligent collector is communicatively connected to an intra-lan analysis platform, the method further comprising:

the intelligent collector sends the log data and the full-flow data to the local area network analysis platform;

and analyzing the log data and the full flow data through the local area network analysis platform to obtain a second analysis result.

8. A data acquisition and transmission system, comprising:

the connection establishment module is used for establishing communication connection between the intelligent collector and the DCS system;

the data acquisition module is used for acquiring log data and full flow data of the DCS through the intelligent acquisition device;

the data transmission module is used for converging the log data and the full flow data and then sending the log data and the full flow data to a plant-level analysis platform outside a local area network to which the DCS system belongs;

and the data analysis module is used for analyzing the log data and the full flow data through the factory-level analysis platform to obtain a first analysis result.

9. A machine-readable storage medium having instructions stored thereon, which when executed by a processor cause the processor to be configured to perform the data acquisition transmission method of any one of claims 1 to 7.

10. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that the processor implements the data acquisition transmission method of any one of claims 1 to 7 when the computer program is executed by the processor.