A Deep Packet Inspection Platform Based on Industrial Scada System

Abstract

Disclosed is an industrial SCADA system-based deep packet inspection platform. The inspection platform is capable of inspecting the system state for the common protocol environment of Modbus / Tcp and IEC 60870-5-104 of an electric power system, and comprises an industrial SCADA system simulation platform, a deep packet parsing module, an abnormality detection module, and an intrusion module. The inspection platform simulates the normal network data stream in the electric power system on the basis of a typical cyclic polling interaction mode in the SCADA system, detects the system exception state, and performs comprehensive simulation on the corresponding network data stream by means of protocol vulnerability analysis and packet mutation.Feature analysis and extraction is performed on packet field information, and a system state model is created by a machine learning method so as to comprehensively and deeply detect the system state.

Description

technical field [0001] The present invention relates to the field of industrial control systems, in particular to protocol analysis and anomaly detection in the communication environment of industrial SCADA systems, constructing positive / abnormal data sets based on protocol formats and vulnerabilities, and detecting system states through machine learning methods platform. Background technique [0002] The industrial control system is composed of various automation control components and process control components for collecting and monitoring real-time data. It is a business process control system that ensures the automatic operation, process control and monitoring of industrial technical facilities. Its core components include data collection and Monitoring system (SCADA), distributed control system (DCS), programmable logic controller (PLC), remote terminal (RTU), intelligent electronic device (IED) and the interface technology to ensure the communication of each component,...

AI Technical Summary

Problems solved by technology

The deep packet inspection methods currently used in most research work have high requirements for the application target scene and protocol environment. A small number of commonly used fields are analyzed on the network data stream or the existing field information is directly used as the data set. The information is directly used as the characteristics of the network data flow to establish a system state model, which lacks a complete feature analysis and extraction of the information contained in the network data flow, and can only have a relatively ideal effect when the abnormal behavior involves commonly used fields.

In addition, most of the existing research work modifies and destroys the system state through several known common attacks, and constructs corresponding data sets. There is almost no work that can well simulate various abnormal states that may occur in the field scene, and the detection effect has certain limitations

Images