Industrial control network security warning method and system

Abstract

The present disclosure relates to an industrial control network security early warning method and system, wherein the industrial control network security early warning method includes: obtaining security-related data of control events of the industrial control network; performing CEP analysis on the security-related data; and according to the CEP analysis results Carrying out security analysis of control events; wherein, the CEP analysis includes: statistically summarizing the security-related data in a fixed time window to determine the relevant attributes of the control events; and combining the relevant attributes of the control events with a preset rule engine to Correlation analysis is performed on control events to obtain the correlation among control events. The industrial control network security early warning method and system of the embodiments of the present disclosure can be deployed in industrial control sites with limited resources, and is suitable for a single node or multiple node deployment environment. The deployment method is more flexible, and the network delay is reduced, and the risk early warning capability is improved. .

Description

technical field [0001] The present disclosure relates to the field of industrial control networks, in particular to an early warning method and system for industrial control network security. Background technique [0002] With the continuous integration of industrial control systems and the Internet, industrial control systems are inevitably exposed to network security threats, making the security and stability of industrial control networks increasingly uncontrollable. According to statistics, 70% of the networked devices in the current industrial control network have security vulnerabilities, and it is expected that 90% of the software and hardware devices connected to the Internet of Things will have a certain degree of security risks in the future. Therefore, the security issues of industrial control networks need to be resolved urgently. [0003] At present, for industrial control network security, the solutions of most manufacturers are to filter industrial control dat...

AI Technical Summary

Problems solved by technology

[0005] 1) Industrial control sites generally lack a large data center and cannot support the deployment of large cluster servers;

[0006] 2) The network structure of the industrial control site is relatively simple and single, which cannot meet the complex, large-scale, and high-speed data transmission requirements;

[0007] 3) The real-time data processing of the industrial control network generally requires a response time of about 50 milliseconds, and the above-mentioned secure big data platform has a large network delay due to the complex network structure, which cannot meet the requirements of real-time data processing;

[0008] 4) The algorithm model of the above-mentioned secure big data platform is relatively simple, and the processing capacity is limited

Images