Industrial control honeypot safety protection device and method

Abstract

The invention relates to the technical field of industrial safety, in particular to an industrial control honeypot safety protection device and method. A shadow system comprises an IP simulation module, a flow transfer redirection module, virtual switch software and a plurality of virtual machine systems; a honeynet system comprises a general protocol simulation module, an industrial protocol simulation module and a honeypot management configuration module; an industrial control equipment interface provides access to a PLC module, a DSC module, an RTU module, an OPC service, SCADA equipment and HMI man-machine interaction system industrial control equipment; and a safety protection system comprises a log acquisition and analysis module, a flow acquisition and analysis module, an abnormal behavior analysis module, a traceability evidence obtaining analysis module, a system management module and a system database module. The beneficial effects are that the device does not need to connecta network in series, does not need to configure a port flow mirror image in a bypass manner, does not change the physical network structure of a user, does not affect the network operation environment of the user, achieves the flexible deployment of the environment, and achieves plug-and-play.

Description

technical field [0001] The invention relates to the technical field of industrial safety, in particular to an industrial control honeypot safety protection device and method. Background technique [0002] Industrial Control Systems (ICS) are composed of various automation control components and process control components for real-time data acquisition and monitoring. Its components include Supervisory Control and Data Acquisition System (SCADA), Distributed Control System (DCS), Programmable Logic Controller (PLC), Remote Terminal Unit (RTU), Intelligent Electronic Devices (IED), and the interfaces that ensure the communication of each component technology. ICS system is widely used in petroleum, petrochemical, metallurgy, electric power, gas, coal mine, tobacco and municipal and other fields to control the operation of key production equipment. Once the industrial control system in these fields is damaged, it will not only affect the sustainable development of the industr...

AI Technical Summary

Problems solved by technology

[0007] 2. Since there are no real business hosts and services on the honeypot, any behavior of accessing the honeypot can be considered a highly credible threat

Although detection of an intrusion requires only camouflage using a low-interaction honeypot, the TTP used by the threat cannot be identified

Images