A Situation Assessment Method for Industrial Control Network

Abstract

The invention discloses a method for evaluating the situation of an industrial control network. The industrial control network equipment involved includes: a safety gateway, a programmable logic controller, a field sensor device, a safety management platform, and an engineer station; the method includes the following steps: S1: engineer station To configure and run the industrial control system, the PLC in each area identifies the controlled devices connected to its IO modules, matches the controlled device information list, and forms a periodic communication mode between the master station and the slave station; S2: PLC transfers the data The information is fed back to the security gateway in real time, and the data packet deep analysis system of the security gateway extracts data features, removes redundant attribute features, and only leaves features related to system behavior patterns, including data features based on communication protocols and programmable logic controllers. Status information, industrial control network system status information, and network traffic characteristics; S3: The industrial control network situation assessment model evaluates the situation of the system and forms an assessment result.

Description

technical field [0001] The invention relates to the technical field of industrial control systems, in particular to an industrial control network situation assessment method. Background technique [0002] Due to the widespread use of common software, hardware and network facilities in industrial control systems, as well as the integration with enterprise management information systems, industrial control systems have become more and more open, and data exchange has occurred with enterprise intranets and even with the Internet. That is to say, the relative closeness of the industrial control system in the physical environment and the specificity of the software and hardware of the industrial control system will be broken. It will be possible to obtain more detailed information about the relevant industrial control system through the Internet or the intranet, and then In addition, the security awareness of enterprises operating industrial control systems is generally poor, whi...

AI Technical Summary

Problems solved by technology

The main disadvantages are as follows: 1) Due to the large number of equipment vendors in ICS, there is a lack of unified system hardware, operating software, application software, and protocol specification standards, resulting in its own vulnerability in ICS configuration

2) The widely used Modbus TCP protocol in this system lacks authentication and authorization mechanisms, and the data is transmitted in plain text. It is only possible to protect the data collected at the field device layer through the security gateway in the network, while the traditional security protection methods mainly It is a filtering technology based on the packet format matching of the communication protocol. This rule configuration method is difficult to intercept the attacks of many malicious attackers, such as constructing packets that conform to the protocol specifications to attack

3) In the field device layer, the value of the device register is easily tampered by the attacker, but the data packet format still conforms to the protocol specification. This attack is not easy to be detected, which makes the enterprise manager make wrong decisions

In the face of endless unknown network attack methods, it is impossible to block all attacks outside the defense through traditional intrusion detection systems, industrial firewalls, white lists and other passive security defense methods

Images