Industrial control network access rule construction method and training system

Abstract

The invention provides an industrial control network access rule construction method and a training system. The method comprises steps of by analyzing protocol message data in an industrial control network, constructing a network topological structure, and extracting protocol characteristics in the message data; determining the type of communication equipment, determining an access list between the equipment through the transmission direction of protocol messages, determining an access instruction through deep analysis of protocol message contents, associating the access instruction with an industrial control protocol instruction library to construct an access instruction list between the industrial control equipment, and finally constructing a complete security access rule through the access list and the instruction list.

Description

technical field [0001] The invention relates to a construction method and training system for industrial control network access rules. Background technique [0002] Industrial firewalls, auditing systems, and intrusion detection systems have become essential infrastructure for protecting network security in industrial control networks. However, in the industrial control network, different manufacturers and different types of industrial control equipment coexist in the same network, and the instructions of different industrial control equipment are different. Facing the complex industrial control network environment, configuring security access rules for industrial firewalls and audit systems has become a task. It is a daunting task. The administrator not only needs to understand the configuration information (such as MAC address, IP address, and port) and network topology of each device, but also needs to understand the protocol format and command format of industrial contro...

AI Technical Summary

Problems solved by technology

However, in the industrial control network, different manufacturers and different types of industrial control equipment coexist in the same network, and the instructions of different industrial control equipment are different. Facing the complex industrial control network environment, configuring security access rules for industrial firewalls and audit systems has become a task. It is a daunting task. The administrator not only needs to understand the configuration information (such as MAC address, IP address, and port) and network topology of each device, but also needs to understand the protocol format and command format of industrial control equipment from different manufacturers. It takes a lot of time to configure security access rules. Time-consuming and error-prone

Images