A method, device, and related equipment for identifying network vulnerabilities in industrial control systems

Abstract

The present invention disclosed a network vulnerability identification method, device and related equipment of the industrial control system. This method includes the establishment of a service fingerprint feature library, communication protocol feature library, and vulnerability feature library; static asset information acquisition; equipment information acquisition; traffic information acquisition; Asset identification; service identification; vulnerability identification; vulnerability confirmation; this device includes basic information management modules, information collection modules, asset identification modules, service identification modules and vulnerabilities recognition modules;During the identification process, the risks of the industrial control system are too large and downtime.

Description

technical field [0001] The invention relates to a network vulnerability identification method and device of an industrial control system and related equipment, belonging to the technical field of information security. Background technique [0002] With the development of computer technology, more and more information technology is used in industrial production, which brings more and more safety problems. Safety problems can cause production accidents, and serious ones can even cause personal injury. Vulnerabilities are defects in the specific implementation of hardware, software, protocols or system security policies, which can enable attackers to access or destroy the system without authorization, which is one of the important causes of security problems. Vulnerability identification and vulnerability repair are the main work steps to eliminate vulnerabilities. Vulnerability repair is mainly carried out by hardware and software product suppliers, while vulnerability identi...

AI Technical Summary

Problems solved by technology

However, in the industrial control system network, there are not only traditional information systems, but also a large number of industrial control system equipment such as PLC. The industrial control system equipment is a real-time system, which requires high network quality. Concurrency and other characteristics often cause risks such as excessive load and downtime of industrial control systems

At the same time, the protocol of industrial control equipment is also different from that of traditional information systems, and the use of general vulnerability signature databases cannot accurately identify vulnerabilities.

Images