Risk identification method and device for industrial control system

Abstract

Embodiments of the invention disclose a risk identification method and device for an industrial control system. The method comprises the following steps of capturing a protocol message which is sent in a network communication process of a monitored industrial control system; extracting feature values of the protocol message; comparing the feature values of the protocol message with features in a protocol message feature library and determining a message type of the protocol message; determining a message communication sequence of the protocol message; comparing the message communication sequence with message communication sequences in a protocol message communication sequence library, and determining a protocol version corresponding to the protocol message; determining a host type corresponding to the protocol message according to the message type of the protocol message; and determining the risk of the industrial control system according to the host type and the protocol version. The host type and the protocol version which are corresponding to the protocol message can be determined according to the protocol message, so that the risk of the industrial control system is determined according to the host type and the protocol version, and thus a purpose of carrying out effective risk identification on the industrial control system is realized.

Description

technical field [0001] The invention relates to the technical field of industrial control system information security, in particular to a risk identification method and device for an industrial control system. Background technique [0002] Industrial control systems are widely used in important infrastructure in various fields in our country and are an important part of national production. After several generations of innovations, the industrial control system has made full use of the advanced technology of traditional information systems. At the same time, the information security issues of industrial control systems have been gradually exposed in the process of industrial informatization and network development, and there have been special industrial control systems. System malicious code and attack program. [0003] At present, industrial control systems have already had preliminary explorations in safety monitoring and protection technology, but there are certain limit...

AI Technical Summary

Problems solved by technology

First of all, the industrial control system is a key physical security system, so traditional information security protection methods cannot be directly applied. At the same time, due to the real-time requirements of industrial communication protocols and data interaction, it is not suitable to directly block the system. Therefore, more The safe application method of safety monitoring and emergency response; secondly, due to the long life cycle of industrial control systems, the data of many control systems cannot be obtained due to the long deployment time

Images