A Modbus communication access control method based on self-learning rules

Abstract

The invention discloses a Modbus communication access control method based on self-learning rules. The method is based on the Netfilter / iptables technical framework, adopts the data packet deep analysis technology to realize the deep analysis of the Modbus communication protocol in the industrial control system, and completes the Modbus master station Access control of data communication with Modbus slave station; works on Modbus TCP / IP network, supports two transmission protocols of TCP and UDP; has self-learning rule function, realizes Modbus access control by setting self-learning time and self-learning threshold Automatic generation of rules. The invention can detect and prevent abnormal behavior in the Modbus communication process, and guarantee the reliability and safety of the industrial control system.

Description

technical field [0001] The invention relates to an access control method for Modbus communication, which can detect and prevent abnormal requests initiated by a Modbus master station to a Modbus slave station, and belongs to the field of industrial control network security. Background technique [0002] With the continuous integration of informatization and industrialization, information network technology has been widely used in industrial control systems. However, most of the existing industrial control systems do not consider network security factors. The explosive dissemination of information on such aspects has made it easier to implement information and network security attacks on industrial control systems, and the information security problems of industrial control systems have become increasingly severe. [0003] Access control technology is a method to achieve security between different networks or network security domains. It can enhance the security of internal n...

AI Technical Summary

Problems solved by technology

[0005] However, in industrial control systems, the Modbus protocol is an application layer protocol. The existing access control methods based on Netfilter / iptables can only complete the matching of the key fields of the network layer and the transport layer of the data packet, and lack data for the Modbus protocol. Packet in-depth analysis technology, unable to realize in-depth analysis and detection of Modbus application data

At the same time, the existing access control rules are only entered manually, and access control rules cannot be automatically generated based on the communication data captured in the network

Images