Intrusion detection system specific to programmable logic controller (PLC) control system

Abstract

The invention provides an intrusion detection system specific to a programmable logic controller (PLC) control system. The intrusion detection system comprises an operation data acquisition module, adata-driven intrusion detection module, a network data acquisition module, a network communication protocol intrusion detection module, an intrusion response output module and a monitoring server. A normal network communication protocol model is built by capturing and parsing a network data packet, analyzing a network data feature influence factor and extracting a network data feature value, so that network communication protocol intrusion detection is realized. Meanwhile, field operation data are acquired to build a steady operation prediction model, and residual assessment is performed on the practical output of the control system and the output of model prediction, thereby realizing data-driven intrusion detection. When intrusion is found, braking processing is performed on a controller, and an alarm is made. The intrusion detection system is suitable for the technical field of industrial control system information safety, can effectively realize the intrusion detection of the PLC control system under the condition of not intruding an industrial control system, and improves the safety guarantee capability of the industrial control system.

Description

technical field [0001] The invention relates to the technical field of PLC control systems, in particular to an intrusion detection system for PLC control systems. Background technique [0002] In recent years, with the in-depth integration of industrialization and informatization, the field of cyberspace security is no longer what it used to be. Industrial control systems have become the main battlefield in cyberspace. PLC control systems have been widely used in industrial automation, so exposure to There are more and more PLC devices on the Internet. Due to the security flaws originally designed by PLC, the openness of communication and the increasingly discovered loopholes, the PLC control system has become no longer mysterious and independent, and intruders can better investigate the PLC control system. security structure to achieve intrusion. In addition, there are more and more intrusion and attack tools open on the Internet, which lowers the threshold for people to ...

AI Technical Summary

Problems solved by technology

[0004] The technical problem to be solved by the present invention is to provide an intrusion detection system for PLC control systems, solve the problem of lack of protection schemes for PLC control systems in the prior art, realize the protection of PLC control systems, and improve the safety of PLC control systems. Guarantee the safe operation of the PLC control system

Images