A control code abnormality detection method and device

Abstract

The embodiment of the invention discloses a control code anomaly detection method and device. The method includes the following steps that: a real-time control code extraction request is transmitted to an industrial control computer; real-time control codes transmitted by the industrial control computer are received, and the real-time control codes are compared with pre-stored control codes, if the real-time control codes are mismatched with the pre-stored control codes, the pre-stored control codes are transmitted to the industrial control computer, so that the industrial control computer replaces the real-time control codes with the pre-stored control codes. With the control code anomaly detection method and device of the invention adopted, attacks can be disabled when attack modes cannot be identified or attacks exist in a system, and therefore, the safety of the industrial control computer can be improved.

Description

technical field [0001] The invention relates to the field of industrial control, in particular to a control code abnormality detection method and device. Background technique [0002] Under the background of industrialization and informationization, more and more control systems used by modern industrial enterprises for production have been connected to the Internet to play the integration benefits of information systems. But the accompanying network security problems are also becoming more and more obvious. And because the industrial control system network does not pay enough attention to network security in the early stage of design or deployment, it also exacerbates the network security problem of the industrial control system. Once a security problem occurs, there will be greater losses than information network security incidents. For example, the famous "stuxnet" virus is a network attack on Siemens control system. [0003] Industrial control computer (referred to as ...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the technical defects existing in the prior art that affect the security of industrial control computers due to the inability to detect the attacks within the system or the inability to identify unknown and new network attack methods, the present invention provides a control code anomaly detection method And the device can disable the attack even if the attack method cannot be identified or there is an attack inside the system, which improves the security of the industrial control computer

Images