Industrial control operation system active defense method with self-learning characteristic

Abstract

The invention discloses an active defense method for an industrial control operating system with self-learning characteristics, which includes the following steps: step 1, judge whether the program can be executed according to the credible strategy, and if it is executable, monitor the business behavior, and access the program according to the detected subject and object Operation; step 2, according to step 1, monitor the logs generated by business calls, and realize non-deterministic security policy learning; step 3, monitor the behavior of system calls at the Linux kernel layer, collect corresponding system call information, according to steps 1 and 2 The generated security policy judges whether the system call is allowed or denied; Step 4, according to Step 1 and Step 2, based on the self-learning system mandatory access control, assisted by the application of trustworthiness measurement, to build the active defense system of the industrial control operating system. The present invention can realize that it can still be immune to attacks in the case of defects and loopholes, and has the characteristics of automatic learning, simple application, and small business impact.

Description

technical field [0001] The invention relates to the technical field of industrial control operating system security, in particular to an active defense method for an industrial control operating system with self-learning characteristics. Background technique [0002] Operating system security is the foundation of information security. Attacks and threats to computer systems often take the operating system as the main target. Security products, if not built on top of a security operating system, are like buildings built on sand. Although business applications often have their own security measures such as identity authentication and access control, due to the lack of strict formal design, the security mechanism cannot ensure security. If application security integrates the security mechanism of the operating system that has undergone certain formal verification on the basis of its own security guarantee, it will fundamentally solve the problem of information security to a ce...

AI Technical Summary

Problems solved by technology

For the security requirements of industrial control operating systems, although SELinux is powerful, it is not suitable for industrial control environments, especially microkernel scenarios, due to its large overall architecture and large performance impact.

In addition, the security model is responsible and the business adaptability is poor

It is relatively difficult to update the patch of the industrial control system, and it is necessary to introduce active defense

Images