A monitoring method for industrial control network information security based on funnel whitelist

Abstract

The invention relates to an industrial control network information security monitoring method based on a funnel type white list. The industrial control network information security monitoring method comprises the following steps that (1) industrial communication data are deeply parsed; (2) a credible framework is established for legal operation in an industrial control network; and (3) a white list funnel is established based on the credible framework. The beneficial effects of the industrial control network information security monitoring method are that reductive analysis is performed on multiple industrial communication protocols so that abnormal monitoring of the production control behavior can be realized; and the credible framework is established through combination of the industrial control network environment so that the white list funnel with the industrial characteristics is generated, filtering precision is high and the communication behavior in the industrial control network is monitored in real time, early warning time for perception of the unknown threat is enhanced, and thus the industrial control information system environment is stabilized as the core guiding thought and a monitoring system is constructed.

Description

technical field [0001] The invention relates to the field of industrial control network information security, in particular to an industrial control network information security monitoring method based on a funnel-type white list. Background technique [0002] With the promotion of informatization and the acceleration of industrialization, more and more computer and network technologies are applied to industrial control systems, which makes industrial control systems highly integrated with traditional enterprise networks, and has greatly promoted industrial production. At the same time, it also brings security problems such as Trojan horses, viruses, and network attacks. [0003] According to the statistics of RISI, the industrial security incident information database, as of 2011, there have been more than 200 major attacks on industrial control systems in the world, especially after 2000, with the development of common protocols, general hardware and general software in in...

AI Technical Summary

Problems solved by technology

Although there are many network monitoring products now, due to the limitations of these products, most of them are oriented to traditional information networks, and they cannot completely solve the widespread Ethernet monitoring and management problems, especially most industrial protocols in the field of industrial control. At the same time, many system suppliers adopt a large number of private protocols. Therefore, the network information security technology with industrial control characteristics for the field of industrial control is gradually deepening.

Images