Intrusion detection device and intrusion detection method

Abstract

The invention provides an intrusion detection device and method. The intrusion detection device is suitable for an industrial-grade serial sequence agreement. The intrusion detection device comprisesa connection interface and a processor. The processor receives a plurality of first packets through the connection interface. The processor is used for obtaining network protocol data and industrial control data of each first packet, respectively marking a first operation role of a first internet protocol address and a second operation role of a second internet protocol address in the network protocol data; obtaining an association group of the first internet protocol address; and establishing a rule list, wherein the rule list comprises the first operation role, the first internet protocol address, the second internet protocol address and the content of the associated group. Therefore, according to the scheme, external hacker invasion and internal deliberate damage of internal ghost can be prevented at the same time, and the effect of more comprehensive information security protection is achieved.

Description

technical field [0001] This case relates to a detection device and a detection method, and in particular to a network packet intrusion detection device and an intrusion detection method. Background technique [0002] General industrial control systems often adopt a master-slave architecture (such as the industrial serial serial protocol (Modbus)), and the characteristics of the master-slave architecture lead to loopholes in the information security of the system. For example, as long as a hacker pretends to be a master device, a masquerading packet can be successfully transmitted to a slave device, causing the slave device and multiple industrial devices connected to it to be compromised. [0003] However, the current enterprise-type intrusion detection system (intrusion detection system, IDS) only defines the detection rules for the protocol content of the third and fourth layers of the Open System Interconnection Reference Model (OSI), As a result, the industrial control ...

AI Technical Summary

Problems solved by technology

[0002] General industrial control systems often adopt a master-slave architecture (such as industrial-grade serial serial protocol (Modbus)), and the characteristics of the master-slave architecture lead to loopholes in the information security of the system

For example, as long as a hacker pretends to be a master device, he can successfully transmit a masquerading packet to a slave device, causing the slave device and multiple industrial devices connected to it to be compromised

[0003] However, the current enterprise-type intrusion detection system (intrusion detection system, IDS) only defines the detection rules for the protocol content of the third and fourth layers of the Open System Interconnection Reference Model (OSI), As a result, the industrial control system using the Modbus protocol cannot be protected by information security at all

Images