Industrial control security audit system based on protocol deep analysis and application thereof

Abstract

The invention relates to an industrial control safety audit system based on protocol deep analysis and an application thereof. The system comprises an on-site monitoring layer, a control layer, a physical layer, an industrial control safety audit module and a safety protection management platform, the industrial Ethernet and an on-site bus are located between the field monitoring layer and the physical layer, the on-site monitoring layer performs data transmission and behavior control on the control layer through the industrial Ethernet, the physical layer is connected with the on-site bus through a sensor, an actuator and the like, and the on-site monitoring layer is mainly used for abnormality detection of an industrial network; according to the invention, targeted detection of abnormalbehaviors can be carried out, the accuracy is high, a physical layer realizes effective physical blocking of malicious behaviors such as network attacks and illegal access in operation of industrial control system equipment by controlling an interface of an external control line, and loss is stopped in time; the industrial control system equipment terminal security protection method is good in compatibility, better in applicability, convenient in equipment increase and decrease, and capable of flexibly updating the alarm rule base and improving the protection capability.

Description

technical field [0001] The invention relates to the field of student education management, in particular to an industrial control safety audit system based on protocol depth analysis and its application. Background technique [0002] Modern industrial control enterprises include not only production control systems, but also information management systems such as production management and quality control. The integration of control systems and information systems has become the general trend, and the interconnection of production control systems and management information systems has become an important part of ICS. Basic structure; due to the emergence of hacker conferences, white hat communities, and open source communities, it is becoming easier and easier to obtain the attack methods of industrial control systems. These have greatly reduced the difficulty of network attacks against industrial control systems; and with the gradual promotion and application of industrial Et...

AI Technical Summary

Problems solved by technology

[0003] At present, the industrial control security audit system has the following deficiencies: First, it lacks the distinction between industrial Ethernet and industrial process behavior abnormalities, which reduces the accuracy of information processing; second, when analyzing known protocols, it is impossible to perform fast Identification wastes valuable processing time and computing power. Finally, the existing industrial control security audit system generally only monitors network traffic, ignoring the feature that can be monitored, such as the abnormal time series of network traffic of different devices, and the monitoring is not comprehensive enough.

Images