Power grid industrial control security collaborative monitoring method and device based on deep protocol analysis

Abstract

The invention provides a power grid industrial control security collaborative monitoring method and device based on deep protocol analysis. The power grid industrial control security collaborative monitoring method comprises the steps of collecting a plurality of data packets in a power grid industrial control system; establishing a strategy library composed of rules for known attacks and scripts for unknown attacks; carrying out protocol analysis on the plurality of data packets to generate protocol abnormity events; aggregating the protocol abnormity events to generate aggregated alarm groups; and generating a security threat assessment result according to the strategy library and the aggregated alarm groups. According to the method and the device, security threats is effectively identified, positioned and assessed; comprehensive protection is realized; the security monitoring precision of the power grid industrial control system is improved; and the security monitoring expandability is improved.

Description

technical field [0001] The invention relates to the field of information security, in particular to a method and device for collaborative monitoring of power grid industrial control security based on in-depth analysis of protocols. Background technique [0002] In recent years, power grid industrial control systems are suffering from more and more serious security threats, and attacks are becoming more frequent and systematic. Compared with the traditional Internet attack methods, the attack methods against the power grid industrial control system are generally APT (Advanced Persistent Threat) attacks. Attackers exploit the loopholes in the software and hardware of the industrial control system and the unsound management and control during operation and maintenance debugging, etc., through hidden channels or encrypted channels. , using unknown Trojan horse programs to launch attacks, threatening the safe and stable operation of the power grid. [0003] In order to build a c...

AI Technical Summary

Problems solved by technology

[0006] In view of the above analysis, the present invention proposes a power grid industrial control security collaborative monitoring method and device based on protocol depth analysis, to solve the problem that existing intrusion detection technology is difficult to find application layer attack events, and the feature matching algorithm calculation of existing intrusion detection mechanism The problem of large volume and high mis-assignment rate

Images