Security detection method based on Ethernet IP industrial control protocol

Abstract

The invention relates to a security detection method based on an Ethernet IP industrial control protocol. The detection method comprises the following steps: 1, establishing a network data packet capture module; 2, establishing a data analysis module; 3, establishing a data learning module; 4, establishing a behavior legality judgment module; 5, establishing a behavior abnormality response module.According to the technical scheme, related commands and function calls are deeply analyzed according to protocol characteristics of Ethernet IP, and analysis results can be directly processed by somevisual tools, so that a user can have intuitive feeling on circulating content in an industrial control network.

Description

technical field [0001] The invention relates to a detection method, in particular to a safety detection method based on the Ethernet IP industrial control protocol, and belongs to the technical field of general network safety detection. Background technique [0002] With the advent of the era of Industry 4.0, the use of general network technology for industrial control commands and industrial data transmission, especially the use of Ethernet for communication, is becoming more and more widespread in industrial production, and related industrial equipment also supports this Class transmission, and due to the needs of industrial automation, industrial enterprises (such as energy, electricity, etc.) also rely heavily on general network technology for remote control, which brings the following problems: [0003] 1. Generally speaking, industrial control protocols are transmitted in plain text, and encryption algorithms are seldom or hardly used, so it is very easy to forge. Atta...

AI Technical Summary

Problems solved by technology

[0003] 1. Generally speaking, industrial control protocols are transmitted in plain text, and encryption algorithms are seldom or hardly used, so it is very easy to forge. Attackers can usually use the "middleman" method to send data packets, thereby destroying the operating system;

[0004] 2. There is a lack of necessary monitoring means for industrial control protocol data. Although most industrial control protocols have been made public, mainstream security devices generally do not provide support for relevant industrial control protocols. Therefore, when encountering related industrial control attacks, It is impossible to distinguish, let alone respond to threats;

[0005] 3. For industrial control protocols, especially complex industrial control protocols, such as Ethernet IP, there is a lack of in-depth decoding and understanding. When threats occur and trace back, most of them seem powerless, so they cannot provide strong support for enterprise users. Not to mention security protection

Images