Flow security analysis modeling method and system

Abstract

The invention provides a flow security analysis modeling method and system, and the method comprises: importing flow into a protocol pool corresponding to a bypass flow mirror image according to different protocols, compressing the flow in the protocol pool, and then putting the compressed flow into a cache; distributing flow to be used in threat analysis, wherein the threat analysis comprises that, after flow unpacking, flow packet content and flow packet frequency are respectively analyzed to form a flow threat model; and performing flow transmission on the flow threat model in an encryption and decryption manner through a trusted computing component, extracting feature information of abnormal flow, and performing model calculation on the feature information of current and future abnormal flow by adopting a machine learning and immunization method to form a flow security model. Based on the method, the invention also provides a flow security analysis modeling system. Layering is carried out in an N-Tier mode, and non-intrusive mirroring of the network flow is realized based on a network flow mirroring bypass system in a network flow transmission process using an industrial control protocol.

Description

technical field [0001] The invention belongs to the technical field of industrial control network security, in particular to a flow security analysis modeling method and system. Background technique [0002] During the operation of the industrial control production system, the firmware of various types of equipment communicates with each other through inherent protocols. Generally, common industrial control protocols contain a large number of command words, such as reading and writing data. The characteristics of the industrial control protocol are command-oriented, function-oriented, and polling-response. Attackers only need to master the protocol construction method and access the industrial control network to tamper with any data of the target device through the protocol. However, the custom functions agreed by advanced protocols often bring more threats to user safety. For example, the slave diagnosis command of the Modbus protocol will cause the slave device to switch t...

AI Technical Summary

Problems solved by technology

In the security detection of the industrial control industry, there are two common practices in the industry. One is to directly connect to the network equipment of the industrial control production system for intrusive detection and physical examination, which brings great security risks to the operation of production equipment. The traffic analysis is based on the statistical characteristics of the traffic to explain the periodicity. It does not go deep into the fields of the data packets and the memory and cache models stored in the fields to explore the security characteristics of the industrial control traffic.

Images