Modbus protocol-oriented data flow anomaly analysis method

Abstract

The invention discloses an industrial control network Modbus protocol-oriented data flow anomaly analysis method. The method comprises the following steps of 1, an initialization phase, wherein a Modbus protocol data flow anomaly analysis model is generated; 2, an initialization phase, wherein a Modbus protocol self-learning normal behavior model is generated; 3, a run phase, wherein the run state of Modbus protocol data flow is judged; 4, a run phase, wherein the normal/abnormal behavior state of Modbus protocol data messages is judged; 5, representing, wherein the results in the step 3 and the step 4 are visibly represented. The method is designed on the basis of deeply knowing the Modbus protocol and the anomaly analysis technology, good comprehensiveness and practicality are achieved, the efficiency of anomaly analysis can be effectively improved, and Modbus abnormal data flow existing in an industrial control system can be efficiently found through the method.

Description

technical field [0001] The invention in this paper belongs to the field of security technology of industrial control systems, and specifically relates to an abnormal analysis method of data flow oriented to industrial control network Modbus protocol. Background technique [0002] More than 80% of the critical infrastructure in the industrial field relies on industrial control systems to automate operations. In recent years, network security incidents targeting industrial control systems have occurred frequently. For example: in 2010, the "Stuxnet" virus carried out a "ferry" attack on Iran's Bushehr nuclear power plant, resulting in the scrapping of 20% of centrifuges and the leakage of toxic radioactive substances; The "flame" virus attacked the energy industry in the Middle East and collected a large amount of key information on the Iranian oil industry, intending to attack the economic lifeline of the oil country; in 2016, the "dark force" attacked the Ukrainian smart gri...

AI Technical Summary

Problems solved by technology

In recent years, network security incidents targeting industrial control systems have occurred frequently. For example: in 2010, the "Stuxnet" virus carried out a "ferry" attack on Iran's Bushehr nuclear power plant, resulting in the scrapping of 20% of centrifuges and the leakage of toxic radioactive substances; The "flame" virus attacked the energy industry in the Middle East and collected a large amount of key information on the Iranian oil industry, intending to attack the economic lifeline of the oil country; in 2016, the "dark force" attacked the Ukrainian smart grid industrial control system, resulting in a large-scale interruption of household power supply

These milestone secur

Images