Non-contact type static loophole detection system and detection method for industrial control system or device

Abstract

The invention discloses a non-contact type static loophole detection system and detection method for an industrial control system or device, and relates to the technical field of information security of industrial control systems. The detection system comprises an asset management unit, a loophole detection engine unit, a loophole library management unit, a report management unit and a system management unit; the asset management unit transmits information of assets to be tested to the loophole detection engine unit; the loophole detection engine unit compares the information of the assets to be tested with loophole information in the loophole library management unit to detect loopholes and sends a detection result to the report management unit to be recorded; the system management unit conducts setting and updating management on each unit of the detection system to conduct non-contact type static detection of equipment loopholes on the industrial control system, so that the requirement is met that the information security detection of the industrial control system is conducted without assessing an industrial control network and affecting actual running of the industrial control system.

Description

technical field [0001] The invention relates to the technical field of industrial control system information security, in particular to a non-contact industrial control system or equipment static loophole detection system and detection method. Background technique [0002] my country's industrial control system has developed rapidly, and industrial production has gradually developed from traditional manual inspections to automated industrial control systems. Industrial control systems are widely used in various fields such as petroleum and petrochemical, water conservancy and electric power, food processing and sewage treatment. The development of industry has brought about the wide application of industrial equipment, and the sharp increase in the scope and quantity of use at any time. The information security of industrial control systems is also increasingly concerned by more groups. The potential security vulnerabilities of industrial control systems or equipment informa...

AI Technical Summary

Problems solved by technology

The advantage of the present invention is that the proposed vulnerability detection system does not need to develop attack codes. Compared with the MBSA vulnerability detection system developed by Microsoft, the detection speed is fast and the accuracy is high, which can well meet the high stability and high real-time requirements of industrial control systems. It is suitable for administrators to evaluate the security status of the entire industrial control system without affecting the stable operation of the industrial control system. This technical solution checks the files and applications of the tested system or equipment by accessing the tested industrial control network. Software, running services, configuration information and other characteristics realize the scanning and matching of known vulnerabilities. However, this kind of contact vulnerability detection will not only occupy the bandwidth of the industrial control network and affect the real-time communication in the network, but also the detected system needs to Scanning responds, thereby occupying its own resources, resulting in delays in signal acquisition and control. Therefore, it is difficult to detect vulnerabilities in industrial control systems in operation with contact-type industrial control system vulnerability detection methods. At the same time, vulnerability detection devices and systems have vulnerability databases. The need for regular updates. Therefore, no matter whether you use a USB flash drive or access the Internet to update the vulnerability database, it will increase the probability of the vulnerability detection device or system itself being illegally invaded. Once the contact vulnerability detection device or system is implanted with malware , by connecting to the industrial control network, the industrial control system and equipment in the network will face a great threat to information security

Images