Intrusion detection method and intrusion detection system for industrial control system based on communication model

Abstract

The invention provides an intrusion detection method and an intrusion detection system for an industrial control system based on a communication model. The accuracy of intrusion detection is improved to the maximum degree while the practicability is guaranteed. The intrusion detection method comprises the steps of firstly establishing a communication model and communication rules of the industrial control system, wherein the communication model comprises node information and communication connection information; generating a legal communication rule set on the basis of the communication model after the communication model of the industrial control system is established, learning in an installation and debugging stage and a stage before an attack happens of the industrial control system, and establishing a communication model and a communication rule set; then deploying detectors in an industrial control network, capturing a datagram, analyzing and extracting the communication connection information through the datagram, comparing the communication connection information with the generated legal communication rule set, and giving out an alarm when communication connection which violates the legal communication rule set exists; and calling a system response module to adopt corresponding response strategies if intrusion is discovered, and carrying out analysis and learning again if actual detection is wrong.

Description

technical field [0001] The invention discloses an intrusion detection method and system of an industrial control system based on a communication model, belonging to the field of information security. Background technique [0002] Industrial control systems are widely used in electric power, water conservancy, sewage treatment, oil, natural gas, chemical, transportation, pharmaceutical and large-scale manufacturing industries, and are an important part of industrial automation and key infrastructure. Modern industrial control systems achieve automatic control of industrial production processes by deeply embedding computing intelligence, communication and automatic control capabilities in physical systems, and with the help of new sensors and actuators. Its core components include data acquisition and monitoring system (SCADA), distributed control system (DCS), programmable logic controller (PLC), remote terminal (RTU), intelligent electronic device (IED), various sensors and ...

AI Technical Summary

Problems solved by technology

The existing method of detecting industrial control system intrusion from IT system components follows the idea of ​​IT system intrusion detection, which fails to fully consider the real-time and periodic characteristics of industrial control communication networks, and fails to fully consider the master-slave relationship between industrial control equipment. Not only the false alarm rate and false alarm rate are high, but also affect the control accuracy of the original control system, and even reduce the availability of the original control system

However, the existing method of detecting industrial control system intrusion from the monitored physical system needs to establish an approximate mathematical model of the control system, but the establishment of an approximate mathematical model of the control system itself is a difficult task, and many control processes in actual industrial production cannot use mathematical models. Indicates, and it is impossible to judge whether the abnormality is caused by an attack or by physical noise, which lacks practicability

Images