Method for preventing suspicious data package from attacking PLC via industrial Ethernet

Abstract

Provided is a method for preventing a suspicious data package from attacking a PLC via an industrial Ethernet. The method comprises the following steps that a protecting device is arranged between a user computer and the PLC; the data package in a network of the industrial Ethernet is intercepted and analyzed by the protecting device; an analysis result is compared with a preset rule in the protecting device, and a corresponding depth defense module is searched; a specific analysis is carried out on a protocol by the depth defense module; based on the judgment of the depth defense module, passing of the data package is prevented or allowed. The method is based on a deep package inspection technology, an in-depth analysis and an inspection are carried out on application layer content of the data package which tries to access the PLC, and the suspicious data package is blocked, so that attacking behaviors targeting a PLC register are prevented. Once the suspicious data package is intercepted, beside from rejecting the suspicious data package from entering a protected area, a TCP connection can be reset, or a data package which shows an error is sent to an upper computer, and the attacking behaviors are alerted, so that attacks from hackers or viruses are effectively intercepted, and the safety of data in the PLC is protected.

Description

technical field [0001] The invention relates to the technical field of industrial Ethernet security, in particular to a method for preventing suspicious data packets from attacking PLC through the industrial Ethernet. Background technique [0002] With the advent of the network information age, my country's industrial model has undergone earth-shaking changes, completely breaking the "information island" model. Enterprises are fully connected to the Internet, and production data can be easily aggregated and analyzed. This not only improves production efficiency, but also promotes the national strategy of energy conservation and emission reduction. . The beneficial changes that informatization has brought to the industry are obvious, but the subsequent network information security issues make people panic. [0003] A commercial firewall is a relatively common network security device, and it is the most commonly used protection facility on the network border. These functions ...

AI Technical Summary

Problems solved by technology

If hackers or viruses invade the computer and try to destroy the data in the PLC, it will cause a production accident, which is a malicious attack

Images