Industrial control system anomaly detection method based on dual-contour model

Abstract

The invention relates to an industrial control system anomaly detection method based on a dual-contour model. Involved industrial control network equipment comprises a security gateway, a programmable logic controller (PLC), onsite sensor equipment, a security management platform, and an engineer station. The method comprises the following steps of S1, the engineer station configures and operates a system, the PLC of each region discriminates controlled equipment connected to an IP module of the PLC, an information list is distributed to the controlled equipment, and a periodic communication mode is formed for master and slave stations; S2, the PLC timely feeds back data information to the security gateway, a data packet deep analysis system of the security gateway extracts data features and eliminates superfluous attribute features, and only features related to a system behavior mode are left, wherein the features related to the system behavior mode comprises protocol features, data packet transmission direction features and register value variation rules based on the communication frequency; and S3, an anomaly detection subsystem carries out anomaly detection and sends an alarm to the security management platform for an abnormal result.

Description

technical field [0001] The invention belongs to the technical field of industrial control systems, and relates to an abnormality detection method of an industrial control system based on a double-contour model. Background technique [0002] Due to the widespread use of common software, hardware and network facilities in industrial control systems, as well as the integration with enterprise management information systems, industrial control systems have become more and more open, and data exchange has occurred with enterprise intranets and even with the Internet. That is to say, the relative closeness of the industrial control system in the physical environment and the specificity of the software and hardware of the industrial control system will be broken. It will be possible to obtain more detailed information about the relevant industrial control system through the Internet or the intranet, and then In addition, the security awareness of enterprises operating industrial co...

AI Technical Summary

Problems solved by technology

That is to say, the relative closeness of the industrial control system in the physical environment and the specificity of the software and hardware of the industrial control system will be broken. It will be possible to obtain more detailed information about the relevant industrial control system through the Internet or the intranet, and then In addition, the security awareness of enterprises operating industrial control systems is generally poor, which creates opportunities for hostile governments, terrorist organizations, commercial espionage, internal criminals, and external illegal intruders.

[0003] There are the following disadvantages in ICS (Industrial Control System): 1) Due to the large number of equipment manufacturers in ICS, there is a lack of unified system hardware, operating software, application software, and protocol specification standards, which leads to its own vulnerability in ICS configuration

2) The widely used Modbus TCP protocol in this system lacks authentication and authorization mechanisms, and the data is transmitted in plain text. It is only possible to protect the data collected at the field device layer through the security gateway in the network, while the traditional security protection methods mainly It is a filtering technology based on protocol data packet format matching. This rule configuration method is difficult to intercept the attacks of many malicious attackers, such as constructing data packets that conform to the protocol specifications to attack

3) In the field device layer, the value of the device register is easily tampered by the attacker, but the format of the data packet still conforms to the protocol specification. This attack is not easy to be detected, which makes the enterprise management make wrong decisions

Images