Industrial control environment security defense method and system based on business instruction model

Abstract

The invention provides an industrial control environment security defense method and system based on a business instruction model. The method comprises the steps of collecting previous logs in an industrial control environment, obtaining global information of the industrial control environment, obtaining information of executable instructions in the industrial control environment according to theglobal information of the industrial control environment, and establishing the business instruction model according to the information of executable instructions; intercepting an instruction when a terminal in the industrial control environment issues the instruction to an industrial control device, judging the security of the intercepted instruction according to the business instruction model, releasing the instruction if the intercepted instruction is secure, otherwise, reporting the instruction to a server for a manager to acknowledge; and forming a log based on a security judgment result and a processing behavior of the intercepted instruction and reporting the log to the server. According to the method and the system, global instruction control over the industrial control environmentis realized through the business instruction model, an abnormal instruction can be effectively prevented from being executed, a normal instruction can be judged rapidly, and industrial control business is not influenced.

Description

technical field [0001] The invention relates to the technical field of industrial control security, in particular to an industrial control environment security defense method and system based on a business instruction model. Background technique [0002] Industrial control systems are widely used in many modern industries such as electric power, water conservancy, sewage treatment, petrochemical, metallurgy, automobiles, aerospace, etc. Due to the importance of industrial control systems, they have become the target of many unscrupulous elements. For example, in the Ukrainian power incident, hackers obtained the authority to use the operator's account and remotely shut down the power supply system through legal means, causing heavy losses. [0003] At present, the defense difficulties faced by industrial computer terminal security are as follows: [0004] 1. There are many devices and complex models, so it is difficult to install anti-malware software uniformly; [0005] 2...

AI Technical Summary

Problems solved by technology

[0004] 1. There are many devices and complex models, so it is difficult to install anti-malware software uniformly;

[0005] 2. The traditional anti-virus method is not suitable for industrial control equipment, which is easy to cause manslaughter and affect business stability;

[0006] 3. Most of the equipment adopts an isolated network, and the numbe...

Images