Industrial control network situation assessment method

A situation assessment, industrial control network technology, applied in the direction of instruments, character and pattern recognition, electrical components, etc., can solve the wrong decision of enterprise managers, the attack is not easy to be detected, the lack of system hardware, operating software and application software protocol specification standards, etc. problem, to achieve the effect of accurate security situation and improve accuracy rate

CN109981583AActive Publication Date: 2019-07-05CHONGQING UNIV OF POSTS & TELECOMM
5 Cites 10 Cited by

Patent Information

Authority / Receiving Office
CN · China
Current Assignee / Owner
Publication Date
2019-07-05

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention discloses an industrial control network situation assessment method. The related industrial control network equipment comprises a security gateway, a programmable logic controller, fieldsensor equipment, a security management platform and an engineer station, the method comprises the following steps that: S1: an engineer station configures and operates an industrial control system,PLCs (Programmable Logic Controller) in each area identify controlled equipment connected with IO (Input / Output) modules of the PLCs, and match an information list of the controlled equipment to forma periodic communication mode of a master station and a slave station; S2, the PLC feeds data information back to the security gateway in real time; a data packet deep analysis system of the securitygateway extracts data characteristics, removes redundant attribute characteristics, and only leaves characteristics related to a system behavior mode, including data characteristics based on a communication protocol, state information of a programmable logic controller, industrial control network system state information and network flow characteristics; and S3, the industrial control network situation assessment model carries out situation assessment on the system and forms an assessment result.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The invention relates to the technical field of industrial control systems, in particular to an industrial control network situation assessment method. Background technique

[0002] Due to the widespread use of common software, hardware and network facilities in industrial control systems, as well as the integration with enterprise management information systems, industrial control systems have become more and more open, and data exchange has occurred with enterprise intranets and even with the Internet. That is to say, the relative closeness of the industrial control system in the physical environment and the specificity of the software and hardware of the industrial control system will be broken. It will be possible to obtain more detailed information about the relevant industrial control system through the Internet or the intranet, and then In addition, the security awareness of enterprises operating industrial control systems is generally poor, whi...

Examples

Embodiment Construction

[0037] The present invention will be described in detail below in conjunction with accompanying drawing and specific embodiment:

[0038] The present invention aims at the Modbus TCP protocol characteristic in the industrial control system, according to the controller command interval, the controller gain, the controller cycle time increment, the controller gain increment, the address of the slave station, the data packet cycle check code, the data length, The function code, command or response, and the transmission direction of the data packet are used to construct the eigenvector based on the system state characteristics such as the communication behavior frequency, and the industrial control network situation assessment model based on the improved multi-class support vector machine is established. Use the normal state and various typical attack states to establish a situation value correspondence table, substitute the situation value in this situation table into the support ...