A network intrusion detection method for industrial control system based on improved suricata engine

Abstract

The invention discloses an industrial control system network intrusion detection method based on an improved Suricata engine. The method is to first establish an attack mathematical model, then construct network attack data packets and filter them, then formulate intrusion detection rules, and then perform regular decomposition on the regular expressions of the intrusion detection rules. By improving the Suricata engine, the decomposed pattern string The storage structure of the industrial control system is reconstructed, and the check hash table is obtained and sent to the matching process; then the network communication traffic of the industrial control system is captured, decoded and hashed by improving the Suricata engine, and the hash operation result is passed to the matching process. During the process, the matching process will send the verification hash table and the hash operation result to multiple threads, improve the HashTries algorithm for matching, and finally output the detection result. The invention combines the improved HashTries algorithm with the intrusion detection engine Suricata to obtain the improved Suricata engine, which not only saves space resources, but also speeds up the matching processing speed of hardware and greatly reduces the system loss.

Description

technical field [0001] The invention relates to the field of network security, in particular to an industrial control system network intrusion detection method based on an improved Suricata engine. Background technique [0002] With the development of network informatization, the amount of information pouring into the network has increased significantly, which has brought great security risks to the security of the network management system, and the industrial control system is crucial to the country's key infrastructure. In the background, timely and effective detection of network intrusions of industrial control systems is the key to ensuring the network security of industrial control systems. Unlike passive anti-virus software, intrusion detection in network management systems is the Pre-set templates are matched and compared to complete the detection of unsafe information. Since all network access information needs to be checked, it takes a long time, consumes a lot of r...

AI Technical Summary

Problems solved by technology

Its disadvantages are: the libpcap and DPDK packet capture framework used cannot reduce the CPU usage of the hardware system, so the system loss is relatively large; at the same time, in the payload load identification analysis of the TCP message, it uses the DEC process To analyze the protocol data, the restoration library of this process is based on the traditional AC algorithm, which has great defects in detection speed and memory consumption, so it cannot meet the real-time transmission requirements of network data in industrial control systems

In addition, its application scenarios can be network traffic monitoring and spam identification, but there is a lack of protocol identification methods in industrial control systems, so there are great shortcomings in the application of industrial control systems

Images