Intrusion detection method and system for networked control system based on ontology model

Abstract

The invention discloses a networked control system intrusion detection method and system based on an ontology model. According to the method, the networked control system ontology model is built; intrusion detection is carried out based on the ontology model; and after decision is weighed, the final detection result is obtained. The system comprises a master node, a plurality of slave nodes and an industrial communication network responsible for message transmission. The master node is responsible for finishing the collection of host activity audit data of itself, collection of all network messages, detection of control closed circulation corresponding to the master node, control object detection, detection of host activity audit data of all nodes in the whole system, network activity detection and detection result coordination. Each slave node is responsible for completing detection of control closed circulation corresponding to the slave node and uploading the detection result to the master node as well as collecting the host activity audit data of the node itself and uploading the host activity audit data to the master node. According to the intrusion detection method and system, the intrusion detection can be performed in resource-constrained environments efficiently, comprehensively and in real time, thereby reducing industrial network control system safety reconstruction cost.

Description

technical field [0001] The invention relates to the field of information security defense of industrial control systems, and more specifically, to an intrusion detection method and system for networked control of industrial control systems. Background technique [0002] With the rapid development of computer technology, network communication technology and automatic control technology, the networked control system (Networked Control System, NCS) has realized the management, monitoring and control of a wide area, breaking the deadlock of traditional automation system information islands. The core and key of management and control integration has been widely used in national key infrastructure construction and industrial control fields. However, the open nature of the NCS network also makes it face various information security issues. For example, the "Gigafactory Virus" attacked Iran's Bushehr Nuclear Power Plant in 2010, seriously threatening the safe operation of nuclear re...

AI Technical Summary

Problems solved by technology

[0007] The purpose of the present invention is to solve the above-mentioned problems when the existing network intrusion detection method is used in a master-slave single network segment networked control system, and to provide an ontology model-based networked control system intrusion detection method and system, the purpose of which is to be able to Real-time, efficient, and comprehensive networked control system intrusion detection in resource-constrained environments

Images