Industrial control operation system active defense method with self-learning characteristic

Abstract

The invention discloses an industrial control operation system active defense method with a self-learning characteristic. The method comprises the following steps of: 1, judging whether a program is executable or not according to a credible strategy, and if the program is executable, monitoring a business behavior and accessing an operation according to a detected subject and a detected object; 2, monitoring a log generated via business call according to the step 1 so as to realize uncertain security policy learning; 3, monitoring a behavior of system call in a Linux kernel layer, collecting corresponding system call information, and judging whether the system call is allowed or rejected according to security policies generated in the steps 1 and 2; and 4, constructing an industrial control operation system active defense system by taking self-learning system forced access control as basis and utilizing application credibility measurement according to the steps 1 and 2. The method is still immune to attacks under the condition that loopholes exist, and has the characteristics of being automatic in learning, simple to apply and low in business influence.

Description

technical field [0001] The invention relates to the technical field of industrial control operating system security, in particular to an active defense method for an industrial control operating system with self-learning characteristics. Background technique [0002] Operating system security is the foundation of information security. Attacks and threats to computer systems often take the operating system as the main target. Security products, if not built on top of a security operating system, are like buildings built on sand. Although business applications often have their own security measures such as identity authentication and access control, due to the lack of strict formal design, the security mechanism cannot ensure security. If application security integrates the security mechanism of the operating system that has undergone certain formal verification on the basis of its own security guarantee, it will fundamentally solve the problem of information security to a ce...

AI Technical Summary

Problems solved by technology

For the security requirements of industrial control operating systems, although SELinux is powerful, it is not suitable for industrial control environments, especially microkernel scenarios, due to its large overall architecture and large performance impact.

In addition, the security model is responsible and the business adaptability is poor

It is relatively difficult to update the patch of the industrial control system, and it is necessary to introduce active defense

Images