Physical intrusion equipment positioning method and system for multi-equipment cooperative wave transmission inspection

Abstract

The invention discloses a physical intrusion equipment positioning method and system for multi-equipment cooperative wave transmission inspection, and the method comprises the steps: transmitting a polling detection instruction through a bus controller in a serial communication bus network, transmitting a detection signal by slave station equipment in turn, carrying out the signal sampling analysis of a communication bus through network tail end monitoring equipment, the attenuation characteristics of detection signals sent at different positions are different due to the fact that illegal invasion equipment causes the attenuation characteristics at tail end monitoring equipment. Therefore, the characteristics of intrusion signals obtained after differential operation and weak signal extraction are performed on observation signals generated by different detection sources in the end equipment and standard signals stored in the equipment database have distinguishability; and an SVM (Support Vector Machine) multi-classifier is constructed by using the standard intrusion signal characteristics stored in the equipment database before the bus network is put into use so as to effectively position illegal intrusion equipment in the bus network. The technical problem that the security of illegal intrusion equipment in a serial communication bus network of an industrial control system cannot be effectively detected and positioned by using an existing network defense method is solved.

Description

technical field [0001] The invention belongs to the technical field of detecting and locating external illegal intrusion equipment in industrial control systems, and in particular relates to a method and system for locating physical intrusion equipment for multi-equipment cooperative wave inspection. Background technique [0002] In 2017, Dr. Staggs and his team from the University of Tulsa in the United States announced an attack against wind farms called "Windshark". The control and malicious operation of the internal system of the wind farm caused damage to both the turbines and the automation controller in the wind farm. It can be seen from this case that most of the current industrial control systems are not well protected against physical intrusion attacks, and attackers can even easily physically access communication devices in the serial communication bus network of the industrial control system terminal , use the access device to tamper with the communication signa...

AI Technical Summary

Problems solved by technology

[0004] The technical problem to be solved by the present invention is to provide a physical intrusion device location method and system for multi-device coordinated wave inspection to prevent the threat of illegal device intrusion attacks that the industrial control system may face, and It can effectively solve the security problem that traditional network intrusion prevention methods cannot effectively detect and locate malicious external devices in the industrial control system serial communication bus network

Images