Industrial control system monitoring method, device and system, and computer-readable medium

A monitoring device for an industrial control system, comprising:

• at least one memory, configured to store a computer-readable instruction;
• a first interface;
• a second interface;
• at least one processor, coupled with the at least one memory and upon the computer-readable instruction being executed, configured to
• obtain first network traffic transmitted in the industrial control system through the first interface in a passive monitoring manner;
• determine whether it is necessary to monitor the industrial control system in an active probe manner according to characteristics of industrial devices in the industrial control system in the first network traffic;
• and
• upon determining that it is necessary to monitor the industrial control system in an active probe manner,
• determine a target industrial device according to the characteristics of the industrial devices in the industrial control system in the first network traffic,
• send third network traffic to the target industrial device determined through the second interface, and
• obtain, through the second interface, second network traffic sent by the target industrial device in response to the third network traffic.

A non-transitory computer-readable medium, storing a computer-readable instruction, wherein upon invoking the computer-readable instruction, the processor is configured to perform the at least:

• obtaining first network traffic transmitted in the industrial control system in a passive monitoring manner;
• determining whether it is necessary to monitor the industrial control system in an active probe manner according to characteristics of industrial devices in the industrial control system in the first network traffic;
• and
• upon determining that it is necessary to monitor the industrial control system in an active probe manner,
• determining a target industrial device according to the characteristics of the industrial devices in the industrial control system in the first network traffic,
• sending third network traffic to the target industrial device determined, and
• obtaining second network traffic sent by the target industrial device in response to the third network traffic.

The computer-readable medium of 11, wherein when invoking the computer-readable instruction and determining whether it is necessary to monitor the industrial control system in an active probe manner according to characteristics of industrial devices in the industrial control system in the first network traffic, the processor is configured to perform:

• determining it is necessary to adopt an active probe manner for the industrial control system to obtain second network traffic transmitted in the industrial control system upon determining that the characteristics of the industrial devices in the industrial control system are changed according to the characteristics of the industrial devices in the industrial control system in the first network traffic;
• and
• wherein when invoking the computer-readable instruction and determining a target industrial device, the processor is configured to perform:
• using the industrial device whose characteristics are changed as the target industrial device.