Threat detection and defense device, system and method for industrial control system

Abstract

The invention discloses a threat detection and defense device, system and method for an industrial control system. The threat detection and defense device, system and method is used for protecting safety of the industrial control system. The threat detection and defense device comprises a threat detection module and an exception handling module, wherein the threat detection module is used for intercepting and capturing a communication data message, identifying message field information in the communication data message, judging whether the communication data message is the malicious message according to the message field information, judging whether malicious act against a local upper computer or malicious act initiated by the local upper computer exists according to the message field information and message field information in a communication massage recorded in a local communication log database and detecting whether malicious operation against a control program in the local upper computer exists; the exception handling module is used for triggering and performing corresponding safety operation according to safety configuration files if one or more of the malicious message, the malicious act against the local upper computer, the malicious act initiated by the local upper computer and the malicious operation against the control program in the local upper computer exist.

Description

technical field [0001] The invention relates to the technical field of industrial control systems, in particular to a threat detection and defense device, system and method for an industrial control system. Background technique [0002] In the context of industrialization and informatization, more and more industrial control systems used for production in modern industrial enterprises are connected to the Internet to give full play to the integration benefits of information systems, but the accompanying network security problems It is also becoming more and more obvious. [0003] Because the industrial control system network does not pay enough attention to network security in the initial stage of design or deployment, in the existing technology, in the security protection of different types of control systems, firewalls, network gates and other equipment are mainly used for security protection. It can be deployed between the industrial control system and the upper informat...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the present invention provides an industrial control system threat detection and defense device, system and method to solve the technical problem that the security protection means in the prior art cannot effectively protect the industrial control system

Images