Non-intrusive PLC abnormality detection method based on power consumption analysis

Abstract

The invention discloses a non-intrusive PLC abnormality detection method based on power consumption analysis. The method comprises the following steps: connecting a resistor in series between the power module of a PLC and the CPU module of the PLC, acquiring a voltage drop across the resistor by using a data acquisition device to obtain the power consumption information of the PLC in operation; subjecting the acquired power consumption to sample division, and extracting an appropriate feature set from each sample to form a characteristic value sample; training a neural network model based on a long short term memory unit according to the characteristic value sample during the normal operation of the PLC, and comparing a newly acquired to-be-tested power consumption characteristic value sample with the characteristic value information predicted by a LSTM network in order to determine whether the sample to be tested is an abnormal sample and thus determine whether the PLC is attacked. The method does not need to modify PLC hardware and software configuration, is non-invasive relative to an original industrial control system, can monitor the PLC in real time, and can detect the attack without the need to acquire the abnormal sample during the attack on the PLC.

Description

technical field [0001] The invention relates to the security field of industrial control systems, in particular to a detection and defense method for PLC attacks in the industrial control system, and specifically discloses a non-invasive PLC abnormality detection method based on power consumption analysis. Background technique [0002] The industrial control system is an important infrastructure of a country, which plays an important role in meeting the material needs of the people, ensuring sustainable economic development and maintaining social stability. If the industrial control system is damaged by malicious attackers, it may affect the normal development of the national economy and even cause social unrest. Therefore, it is of great significance to study the safety monitoring technology related to the industrial control system, which is closely related to the national economy and the people's livelihood. [0003] The original industrial control system operated in an i...

AI Technical Summary

Problems solved by technology

Due to the limitations of hardware structure and software system, many proprietary devices in industrial control systems cannot apply traditional security protection methods, and cannot withstand frequent vulnerability scanning due to resource constraints; on the other hand, intrusive security protection methods such as installing the first Third-party software is likely to bring new potential risks to industrial control systems, and even short downtime or interruptions cannot be tolerated during the operation of industrial control systems

Therefore, traditional security protection methods cannot be well applied in practice, and a non-invasive security protection method is particularly necessary

As the key equipment in the industrial control system, PLC is directly connected with on-site sensors and actuators to control the implementation process of the industrial site. Once its operating instructions are maliciously tampered with, it will cause a huge disaster. This year, the attacks on PLC have increased significantly. , and currently there is no effective security protection method designed for PLC characteristics

Images