IEC60870-5-104 Protocol-based SCADA (supervisory control and data acquisition) network intrusion detection method and system

Abstract

The invention discloses an IEC60870-5-104 Protocol-based SCADA (supervisory control and data acquisition) network intrusion detection method and system. According to the method, the detection processes of the method include a feature-based intrusion detection process and a model-based intrusion detection process. According to the feature-based intrusion detection process, matching is performed on a message to be detected and a rule database of attack features, if the message to be detected is matched with the rule database of attack features, a corresponding alarm is generated and stored in a log file. According to the model-based intrusion detection process, models that characterize specific protocol expected behaviors are established, if it is detected that the message violates the models, a corresponding alarm is generated and is stored in the log file. With the IEC60870-5-104 Protocol-based SCADA (supervisory control and data acquisition) network intrusion detection method and system of the invention adopted, the network security of an IEC / 104 protocol-based SCADA system can be improved.

Description

technical field [0001] The invention relates to the technical field of industrial control system network information security, in particular to a SCADA network intrusion detection method and system based on the IEC60870-5-104 protocol. Background technique [0002] Supervisory Control and Data Acquisition System (SCADA) is a computer-based production process control and scheduling automation system, which can monitor and control on-site operating equipment and play an important role in industrial control systems of key infrastructure such as electric power, petroleum, and chemical industry. play an important role. As industrial SCADA systems continue to grow in complexity and interconnectivity, so does the possibility of malicious cyber attacks. Industrial control networks that follow traditional communication protocols are often designed with insufficient consideration of network security threats. Evolving SCADA systems can be targeted by malicious actors or disgruntled i...

AI Technical Summary

Problems solved by technology

[0006] Due to the limited computing resources in traditional systems, and the lack of built-in security considerations, traditional IT security solutions may fail in SCADA systems using IEC / 104. Currently, traditional industrial control SCADA systems lack network security intrusion detection systems

Images