Modbus protocol-oriented data flow anomaly analysis method

Abstract

The invention discloses an industrial control network Modbus protocol-oriented data flow anomaly analysis method. The method comprises the following steps of 1, an initialization phase, wherein a Modbus protocol data flow anomaly analysis model is generated; 2, an initialization phase, wherein a Modbus protocol self-learning normal behavior model is generated; 3, a run phase, wherein the run state of Modbus protocol data flow is judged; 4, a run phase, wherein the normal / abnormal behavior state of Modbus protocol data messages is judged; 5, representing, wherein the results in the step 3 and the step 4 are visibly represented. The method is designed on the basis of deeply knowing the Modbus protocol and the anomaly analysis technology, good comprehensiveness and practicality are achieved, the efficiency of anomaly analysis can be effectively improved, and Modbus abnormal data flow existing in an industrial control system can be efficiently found through the method.

Description

technical field [0001] The invention in this paper belongs to the field of security technology of industrial control systems, and specifically relates to an abnormal analysis method of data flow oriented to industrial control network Modbus protocol. Background technique [0002] More than 80% of the critical infrastructure in the industrial field relies on industrial control systems to automate operations. In recent years, network security incidents targeting industrial control systems have occurred frequently. For example: in 2010, the "Stuxnet" virus carried out a "ferry" attack on Iran's Bushehr nuclear power plant, resulting in the scrapping of 20% of centrifuges and the leakage of toxic radioactive substances; The "flame" virus attacked the energy industry in the Middle East and collected a large amount of key information on the Iranian oil industry, intending to attack the economic lifeline of the oil country; in 2016, the "dark force" attacked the Ukrainian smart gri...

AI Technical Summary

Problems solved by technology

In recent years, network security incidents targeting industrial control systems have occurred frequently. For example: in 2010, the "Stuxnet" virus carried out a "ferry" attack on Iran's Bushehr nuclear power plant, resulting in the scrapping of 20% of centrifuges and the leakage of toxic radioactive substances; The "flame" virus attacked the energy industry in the Middle East and collected a large amount of key information on the Iranian oil industry, intending to attack the economic lifeline of the oil country; in 2016, the "dark force" attacked the Ukrainian smart grid industrial control system, resulting in a large-scale interruption of household power supply

These milestone security incidents indicate that the security of industrial control systems has begun to affect the national economy and people's livelihood. Once it is damaged, the losses caused will be immeasurable

[0003] As the traditional simple attack methods against industrial control systems have evolved into Advanced Persistent Threat (APT), which has caused serious security threats to national key infrastructure, APT has complexity, sustainability, and concealment. and other characteristics, there is no effective defense method at present. The only way is to find "0-day" vulnerabilities before the attackers master the "0-day" vulnerabilities, and patch and upgrade the field device vulnerabilities.

Images