A traffic security analysis modeling method and system

Abstract

The present invention provides a traffic security analysis and modeling method and system. The method includes: importing traffic into a protocol pool corresponding to a bypass traffic mirror according to different protocols, and compressing the traffic in the protocol pool and putting it into a cache The traffic distribution is used for threat analysis. The threat analysis includes analyzing the content and frequency of the traffic packets to form a traffic threat model after unpacking the traffic. The trusted computing component encrypts and decrypts the traffic threat model. The method realizes traffic transmission, and at the same time extracts the characteristic information of abnormal traffic, adopts the method of machine learning and immunity to model the current and future abnormal traffic characteristic information to form a traffic security model. Based on this method, a traffic safety analysis and modeling system is also proposed. The present invention adopts the N-Tier method for layering, and in the network traffic transmission process using the industrial control protocol, based on the network traffic mirror bypass system, non-invasive mirroring of the network traffic is realized.

Description

technical field [0001] The invention belongs to the technical field of industrial control network security, in particular to a flow security analysis modeling method and system. Background technique [0002] During the operation of the industrial control production system, the firmware of various types of equipment communicates with each other through inherent protocols. Generally, common industrial control protocols contain a large number of command words, such as reading and writing data. The characteristics of the industrial control protocol are command-oriented, function-oriented, and polling-response. Attackers only need to master the protocol construction method and access the industrial control network to tamper with any data of the target device through the protocol. However, the custom functions agreed by advanced protocols often bring more threats to user safety. For example, the slave diagnosis command of the Modbus protocol will cause the slave device to switch t...

AI Technical Summary

Problems solved by technology

In the security detection of the industrial control industry, there are two common practices in the industry. One is to directly connect to the network equipment of the industrial control production system for intrusive detection and physical examination, which brings great security risks to the operation of production equipment. The traffic analysis is based on the statistical characteristics of the traffic to explain the periodicity. It does not go deep into the fields of the data packets and the memory and cache models stored in the fields to explore the security characteristics of the industrial control traffic.

Images