A threat detection method and security device based on fusion verification of key parameters

Abstract

The invention relates to a threat detection method based on key parameter fusion verification and an industrial control system safety device for realizing the method. According to the method, aiming at characteristics of a hierarchical structure of an industrial control system, a method for fusion verification of key parameters between vertical layers is employed. The threat detection method includes: firstly, threat detection of each layer of the industrial control system including a fieldbus layer is conducted; and then based on layered detection, vertical fusion verification of key parameters of the industrial control system such as key technological parameters, control parameters, and control instructions etc. is performed in order to overcome the defect of the layered detection method. According to the method, safety detection bugs caused by insufficient data fusion in defense in depth of the conventional industrial control system is solved, the personalized requirement of a threat detection device for the industrial control system is met, comprehensive threat detection for the safety of the industrial control system is realized, the safety of the industrial control system is improved, and safe and stable operation of a controlled process is guaranteed.

Description

technical field [0001] The invention belongs to the field of industrial control systems, and mainly relates to a threat detection method and safety device based on fusion verification of key parameters. Background technique [0002] The information security of industrial control systems, especially industrial control systems of critical infrastructure, is an important part of national security. In recent years, frequent network intrusions not only seriously threaten the safe and stable operation of key infrastructure, but also may cause loss of people's lives and property. It has important theoretical and practical significance to strengthen the intrusion detection of industrial control system to improve the system information security level. [0003] Due to the complexity of industrial control systems, it is difficult to ensure the information security of industrial control systems with a single protection strategy. In view of the structural characteristics of industrial ...

AI Technical Summary

Problems solved by technology

Existing schemes ignore the verification of data consistency at different levels;

[0007] (3) The core of the industrial control network data flow is the process production data, operation instructions, control parameters, equipment status information and control equipment configuration parameters, etc., which is obviously different from the information flow on the traditional IT system network, and the existing solutions are not sufficient. Use this feature to carry out security detection and protection;

Images