Method for preventing Stuxnet attacks

Abstract

The invention relates to a method for preventing Stuxnet attacks, which comprises the following steps: step 1, a safety device is arranged in network communication, and the safety device is stored with a characteristic code; step 2, all data packets passing through the safety device are filtered and analyzed, and compared with the characteristic code; and step 3, the data packet is intercepted if the data packet is matched with the characteristic code. The method realizes a purpose of preventing attacks of Stuxnet through preventing downloading data packets of programs, analyzes the data packets passing through, intercepts the data packets which are matched with the characteristic code, terminates a download behavior of a PLC project, allows the data packets which are not matched with the characteristic code to pass through, realizes normal network communication, and ensures safe operation of an industrial Ethernet.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for preventing stuxnet attacks in the information industry. Background technique [0002] With the advent of the network information age, my country's industrial model has undergone earth-shaking changes, completely breaking the "information island" model. Enterprises are fully connected to the Internet, and production data can be easily aggregated and analyzed. This not only improves production efficiency, but also promotes the national strategy of energy conservation and emission reduction. . The beneficial changes that informatization has brought to the industry are obvious, but the subsequent network information security issues make people panic. [0003] The Stuxnet worm (commonly known as "Stocknet", "Twins") began to break out in July 2010. It exploits at least 4 vulnerabilities in the Microsoft operating system, including 3 new zero-day vulnerabilities;...

AI Technical Summary

Problems solved by technology

However, Stuxnet is an "instantaneous attack". Even if the IDS discovers the attack and notifies the firewall, the attack is over and the firewall is helpless

[0008] Intrusion Prevention System (IPS) is a supplement to anti-virus software and firewalls. It can effectively prevent the spread and attack of known viruses in the IPS virus database, but the Stuxnet virus will mutate. Once the virus mutates, the IPS virus database must be upgraded to detect Otherwise, the mutant virus can still abuse the network. Once wincc or step7 is infected, it will modify the PLC program. The modified PLC does not have virus characteristics. At this time, even the virus database upgraded by IPS cannot detect and Intercept the modified PLC program

Images