Industrial control system control behavior detection and protection method and system

Abstract

The invention discloses a control behavior detection and protection method and system of an industrial control system. The detection and protection method includes receiving at least one data packet being transmitted on the communication network of the industrial control system; A control behavior associated with at least one data packet is detected by a plurality of characteristics; corresponding to at least one data packet being transmitted and the detected control behavior, at least one protection rule is determined; a protection operation is performed on the data packet, and the data packet is the corresponding One of several data packets of a protection rule, and the protection operation includes one or more of the following operations: allow data packet transmission, block data packet transmission, require user authentication, and record data packets. The invention can detect internal or external illegal operation attempts that violate the control behavior norms on the basis of the pre-established control behavior norms.

Description

technical field [0001] The present invention relates to the technical field of industrial control security, in particular to a control behavior detection and protection method and system for an industrial control system. Background technique [0002] Industrial control systems allow remote supervision by operators, engineers or analysts analyze based on the data obtained, and then decide to send commands or trigger alarms. Industrial control systems include programmable logic controllers (PLCs) and sometimes process automation controllers ( PAC), PLC / PAC is a computing device that executes a preset logic program. It controls the output of the execution device based on the data input by the sensor. The logic program controls the behavior of the PLC, which is called control logic. Users can change the control logic through the engineer workstation. [0003] In the industrial control system, the related PLC maintenance work can be done manually or automatically by the machine, ...

AI Technical Summary

Problems solved by technology

[0004] Since a typical modern industrial control system is based on a standard embedded system platform, various standard devices are applied, such as routers and demodulators, and often use or partially use off-the-shelf software, such as Ethernet, TCP / IP, HTTP and Windows, These standard hardware and software save costs, improve usability, and facilitate remote monitoring. However, the defects that come with it come from network-based attacks, which worsen the vulnerability of industrial control systems in terms of network security. Malicious programs Once infiltrated into the control network, it is possible to modify the control logic and configuration parameters of the PLC / PAC, eventually causing serious consequences

Images