Function security attack detection method and device for security instrument system

Abstract

The invention provides a functional security attack detection method and device for a security instrumentation system (SIS), and the method comprises the steps: generating a candidate rule based on a SIS controller code; verifying the candidate rules, and determining effective rules in the candidate rules; and performing functional security attack detection on the SIS based on a sensor value of a basic process control system (BPCS) and the effective rule. According to the functional security attack detection method and device of the security instrument system provided by the invention, the functional security attack detection of the security instrument system can be effectively realized, the attack detection accuracy is improved, and the detection efficiency of the data injection attack is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control systems, and in particular to a functional safety attack detection method and device for a safety instrument system. Background Art

[0002] Industrial Control Systems (ICS) cover the fields of petroleum, chemical industry, electric power, metallurgy, etc., and are vital to the national economy and national security. ICS relies on the coordination of Safety Instrumented System (SIS) and Basic Process Control System (BPCS) to ensure and maintain the safe and stable operation of industrial processes.

[0003] For a critical plant, both SIS and BPCS continuously monitor the same process conditions. However, BPCS continuously monitors system parameters according to predefined setpoints, uses control algorithms to adjust control variables and changes actuator actions accordingly. This continuous adjustment facilitates the real-time dynamic stability of the system and ensures optimal operating conditions. In contrast, SIS is only used to intervene in emergency situations caused by equipment failure or functional damage. After detecting these dangerous conditions, SIS activates its safety functions and triggers interlock protection actions, including shutting down the operation of the industrial process. This mechanism is crucial to avoid potential dangerous events and thus ensure process safety.

[0004] The emergence of Industry 4.0 and the advancement of the Industrial Internet have transformed ICS into a more networked and intelligent system. Although this transformation has improved the efficiency and flexibility of ICS, it has also brought significant cybersecurity risks, especially in terms of control system controllers. Attackers can tamper with the control logic of programmable logic controllers (PLCs) so that industrial processes cannot run as expected.

[0005] The existing technical solutions do not take into account the characteristics of SIS safety functions when implementing PLC attack detection, and the PLC control logic obtained by default is normal logic. However, in order to ensure the functional safety of ICS, the SIS safety controller allows online hot update of controller logic. Attackers can still use this function to tamper with the safety control logic and attack the safety function of SIS, causing the safety function to be triggered early or delayed. Summary of the invention

[0006] The present invention provides a functional safety attack detection method and device for a safety instrument system, which is used to solve the defect in the prior art that after the SIS safety controller hot updates the controller logic online, attackers can still attack the safety function of the SIS, resulting in premature or delayed triggering of the safety function, so as to achieve more reliable monitoring of attacks within the SIS and improve the accuracy of attack detection.

[0007] The present invention provides a method for detecting functional safety attacks on a safety instrumented system, comprising the following steps: Generate candidate rules based on the safety instrumented system SIS controller code; Verifying the candidate rules to determine valid rules among the candidate rules; Based on the sensor values ​​of the basic process control system BPCS and the effective rules, functional safety attack detection is performed on the SIS.

[0008] According to a functional safety attack detection method for a safety instrumented system provided by the present invention, generating candidate rules based on the safety instrumented system SIS controller code includes: Link the binary code of the SIS controller with the assembly instructions based on reverse engineering to establish a mapping database; Based on the mapping database, decompiling the SIS controller code into assembly code; The assembly code is structurally analyzed to extract candidate rules.

[0009] According to a functional safety attack detection method for a safety instrumented system provided by the present invention, the candidate rules include candidate control logic rules and / or candidate register address rules; The verifying the candidate rules to determine valid rules among the candidate rules includes: Determine whether the candidate control logic of the SIS controller can be simplified, and if the candidate control logic can be simplified, determine the candidate control logic rule as an invalid rule; if the candidate control logic cannot be simplified, determine the candidate control logic rule as a valid rule; When the candidate control logic rule is valid, the candidate register address rule corresponding to the candidate control logic rule is determined to be a valid rule; when the candidate control logic rule is invalid, the candidate register address rule corresponding to the candidate control logic rule is determined to be an invalid rule.

[0010] According to a functional safety attack detection method for a safety instrumented system provided by the present invention, the candidate rules include candidate value range rules; The verifying the candidate rules to determine valid rules among the candidate rules includes: Based on the critical state setting value of the BPCS, it is determined whether the candidate value range rule is a valid rule.

[0011] According to a functional safety attack detection method for a safety instrumented system provided by the present invention, the critical state setting value based on the BPCS is used to determine whether the candidate value range rule is a valid rule, including: determining a difference between a critical state value of the candidate control logic and a critical state set value of the BPCS; When the ratio of the difference to the critical state setting value of the BPCS is less than 10% and greater than 5%, the candidate value range rule is determined to be a valid rule; otherwise, the candidate value range rule is determined to be an invalid rule.

[0012] According to a functional safety attack detection method for a safety instrumented system provided by the present invention, the functional safety attack detection of the SIS is performed based on the sensor value of the basic process control system BPCS and the effective rule, including: Detecting abnormal behavior of the SIS based on the sensor values ​​of the BPCS and the effective rules; and / or, An active detection engine is used to monitor the industrial process of the SIS in real time based on the sensor values ​​of the BPCS and the effective rules.

[0013] The present invention also provides a functional safety attack detection device for a safety instrumented system, comprising the following modules: A generation module, used for generating candidate rules based on a safety instrumented system SIS controller code; A verification module, used to verify the candidate rules and determine valid rules among the candidate rules; The detection module is used to perform functional safety attack detection on the SIS based on the sensor value of the basic process control system BPCS and the effective rules.

[0014] According to a functional safety attack detection device for a safety instrumented system provided by the present invention, generating candidate rules based on the safety instrumented system SIS controller code includes: Link the binary code of the SIS controller with the assembly instructions based on reverse engineering to establish a mapping database; Based on the mapping database, decompiling the SIS controller code into assembly code; The assembly code is structurally analyzed to extract candidate rules.

[0015] According to a functional safety attack detection device for a safety instrumented system provided by the present invention, the candidate rules include candidate control logic rules and / or candidate register address rules; The verifying the candidate rules to determine valid rules among the candidate rules includes: Determine whether the candidate control logic of the SIS controller can be simplified, and if the candidate control logic can be simplified, determine the candidate control logic rule as an invalid rule; if the candidate control logic cannot be simplified, determine the candidate control logic rule as a valid rule; When the candidate control logic rule is valid, the candidate register address rule corresponding to the candidate control logic rule is determined to be a valid rule; when the candidate control logic rule is invalid, the candidate register address rule corresponding to the candidate control logic rule is determined to be an invalid rule.

[0016] According to a functional safety attack detection device for a safety instrumented system provided by the present invention, the candidate rule includes a candidate value range rule; The verifying the candidate rules to determine valid rules among the candidate rules includes: Based on the critical state setting value of the BPCS, it is determined whether the candidate value range rule is a valid rule.

[0017] According to a functional safety attack detection device for a safety instrumented system provided by the present invention, the critical state setting value based on the BPCS is used to determine whether the candidate value range rule is a valid rule, including: determining a difference between a critical state value of the candidate control logic and a critical state set value of the BPCS; When the ratio of the difference to the critical state setting value of the BPCS is less than 10% and greater than 5%, the candidate value range rule is determined to be a valid rule; otherwise, the candidate value range rule is determined to be an invalid rule.

[0018] According to a functional safety attack detection device for a safety instrumented system provided by the present invention, the functional safety attack detection for SIS is performed based on the sensor value of the basic process control system BPCS and the effective rule, including: Detecting abnormal behavior of the SIS based on the sensor values ​​of the BPCS and the effective rules; and / or, An active detection engine is used to monitor the industrial process of the SIS in real time based on the sensor values ​​of the BPCS and the effective rules.

[0019] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a functional safety attack detection method for a safety instrument system as described in any one of the above is implemented.

[0020] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a functional safety attack detection method for a safety instrument system as described in any one of the above.

[0021] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method for detecting functional safety attacks on a safety instrumented system as described above is implemented.

[0022] The present invention provides a method and device for detecting functional safety attacks on a safety instrument system. The method generates candidate rules based on the SIS controller code, verifies the candidate rules, determines the valid rules therein, and finally performs functional safety attack detection on the SIS based on the sensor values ​​of the BPCS and the valid rules. The method and device can effectively realize functional safety attack detection on the safety instrument system, improve the accuracy of attack detection, and enhance the detection efficiency of data injection attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 It is a flow chart of a functional safety attack detection method for a safety instrument system provided by the present invention.

[0025] Figure 2 It is a schematic diagram of the solution process architecture provided by the present invention.

[0026] Figure 3 It is a schematic diagram of the relationship between the SIS and BPCS provided by the present invention.

[0027] Figure 4 It is a structural schematic diagram of a functional safety attack detection device for a safety instrument system provided by the present invention.

[0028] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] Figure 1 FIG. 1 is a flow chart of a functional safety attack detection method for a safety instrument system provided by the present invention, such as Figure 1 As shown, the method comprises the following steps: Step 100: Generate candidate rules based on the safety instrumented system SIS controller code.

[0031] Step 101: Verify the candidate rules to determine valid rules among the candidate rules.

[0032] Step 102: Perform functional safety attack detection on the SIS based on the sensor values ​​and effective rules of the basic process control system BPCS.

[0033] Specifically, in the embodiment of the present invention, potential security attack detection rules are first extracted from the code of the safety instrumented system controller as candidate rules. These candidate rules will be used to monitor abnormal behaviors during system operation and assist in identifying possible security function attacks.

[0034] SIS controller code is the SIS controller program used for industrial control, which contains a specific set of instructions to execute the control process. The code contains elements such as contacts, coils, and function blocks, which define the system's behavior, state, and interaction with external sensors or actuators.

[0035] After generating candidate rules based on the safety instrumented system controller code, the next key step is to verify these candidate rules and select effective rules from them. This process is to ensure that the rules can not only reflect the actual behavior of the system, but also effectively detect potential attacks or system failures.

[0036] BPCS is a core component in industrial control systems, responsible for real-time monitoring and control of various sensors and actuators in industrial processes. Sensor values ​​(such as temperature, pressure, flow, etc.) are key data sources for detecting system safety.

[0037] Therefore, in the embodiment of the present invention, the determined effective rules are combined with the sensor values ​​obtained from the BPCS to monitor the behavior of the SIS system in real time and detect potential safety function attacks, which can effectively discover attacks or system failures and ensure the safety of the industrial automation system.

[0038] The functional safety attack detection method for a safety instrument system provided by the present invention generates candidate rules based on the SIS controller code, then verifies the candidate rules, determines the valid rules therein, and finally performs functional safety attack detection on the SIS based on the sensor values ​​of the BPCS and the valid rules. This can effectively realize functional safety attack detection on the safety instrument system, improve the accuracy of attack detection, and enhance the detection efficiency of data injection attacks.

[0039] According to a functional safety attack detection method for a safety instrumented system provided by the present invention, candidate rules are generated based on the safety instrumented system SIS controller code, including: Link the binary code of the SIS controller with the assembly instructions based on reverse engineering to establish a mapping database; Decompile SIS controller code into assembly code based on the mapping database; Perform structural analysis on the assembly code and extract candidate rules.

[0040] Specifically, in the process of generating candidate rules based on the SIS controller code, the binary code of the SIS controller can first be mapped to the corresponding assembly instructions through reverse engineering, and a mapping database can be constructed to store these mapping relationships.

[0041] After obtaining the mapping database, the binary code of the SIS controller can be converted into assembly code. This process can convert the original machine language code into assembly language so as to analyze its logic and structure.

[0042] After obtaining the assembly code, the assembly code can be structurally analyzed. The analysis is performed in two stages: instruction analysis and functional analysis. The reversed assembly instructions are checked one by one to understand the function of each instruction and its impact on the control logic. By analyzing the functional blocks in the SIS controller, its behavior patterns are identified, and possible attack features are extracted through these behavior patterns as candidate rules.

[0043] Optionally, the candidate rules may include candidate register address rules, candidate value range rules, and candidate control logic rules.

[0044] Among them, the candidate register address rule identifies the addresses of key registers in the controller, which store key information of the system, such as status values, operation commands, etc.; the candidate value range rule sets a reasonable threshold range by analyzing the valid value domain of the registers in the controller (for example, the legal range of variables such as temperature, pressure, and flow). This range helps to detect whether the value exceeds the normal operating range, thereby determining whether the system has been tampered with or attacked; the candidate control logic rule indicates the allowed operation logic in the control logic. For example, the control logic may define certain conditions that trigger behaviors or state changes. Only when specific conditions are met will the system perform certain operations. If the triggering condition is abnormal, it can be considered that the system has been attacked.

[0045] According to a functional safety attack detection method for a safety instrumented system provided by the present invention, the candidate rules include candidate control logic rules and / or candidate register address rules; Verify the candidate rules and determine the valid rules among the candidate rules, including: Determine whether the candidate control logic of the SIS controller can be simplified. If the candidate control logic can be simplified, determine the candidate control logic rule as an invalid rule; if the candidate control logic cannot be simplified, determine the candidate control logic rule as a valid rule; When the candidate control logic rule is valid, the candidate register address rule corresponding to the candidate control logic rule is determined to be a valid rule; when the candidate control logic rule is invalid, the candidate register address rule corresponding to the candidate control logic rule is determined to be an invalid rule.

[0046] Specifically, in the embodiment of the present invention, the validity of the candidate control logic rule can be verified based on the simplicity feature of the SIS. The existence of the simplicity feature means that during normal operation, the system's operating logic, data flow and control process should be as simple and direct as possible, avoiding redundant, complex or superfluous operations.

[0047] The purpose of simplifying control logic is to remove unnecessary complexity, make it clearer and more efficient, and better judge whether it has been attacked or tampered with. If the candidate control logic can be simplified, it may indicate that it has been maliciously modified or tampered with, so the candidate control logic rule can be judged invalid; if the candidate control logic cannot be simplified, it means that it conforms to the original design logic, and the candidate control logic rule is considered valid.

[0048] Among them, judging whether the candidate control logic of the SIS controller can be simplified mainly involves analyzing its control process, logic complexity, and whether there is redundant or suspicious code structure.

[0049] It is understandable that if the candidate control logic is found to be valid, the candidate register address contained therein is also considered valid. Therefore, in the embodiment of the present invention, when the candidate control logic rule is valid, the candidate register address rule corresponding to the candidate control logic rule is determined to be a valid rule; when the candidate control logic rule is invalid, the candidate register address rule corresponding to the candidate control logic rule is determined to be an invalid rule.

[0050] According to a functional safety attack detection method for a safety instrumented system provided by the present invention, the candidate rules include candidate value range rules; Verify the candidate rules and determine the valid rules among the candidate rules, including: Based on the critical state setting value of the BPCS, it is determined whether the candidate value range rule is a valid rule.

[0051] Specifically, the critical state setting values ​​in the BPCS system refer to the safety upper and lower limits of various state variables. The critical state setting values ​​of the BPCS are often associated with the safety functions in the SIS control logic. Therefore, the value range of the control logic in the SIS should be configured to be higher than the upper limit of the state setting value in the BPCS, and lower than the lower limit of the state setting value in the BPCS. This means that the critical state setting values ​​in the BPCS can be used as a reference for determining the value range of the control logic in the SIS.

[0052] Therefore, in the embodiment of the present invention, it is possible to determine whether the candidate value range rule is a valid rule according to the critical state setting value of the BPCS. If the candidate value range rule can accurately match the normal value domain in the historical data, can accurately respond to the setting value of the BPCS, and can effectively detect abnormal behavior that exceeds the setting value, then the candidate value range rule is regarded as a valid rule; if the candidate value range rule cannot effectively match the normal value domain, or cannot accurately identify abnormal behavior in actual testing, or it is inconsistent with the critical setting value in the BPCS, then the candidate value range rule should be regarded as an invalid rule.

[0053] According to a functional safety attack detection method for a safety instrumented system provided by the present invention, based on a critical state setting value of a BPCS, determining whether a candidate value range rule is a valid rule comprises: determining a difference between a critical state value of the candidate control logic and a critical state set value of the BPCS; When the ratio of the difference value to the critical state setting value of the BPCS is less than 10% and greater than 5%, the candidate value range rule is determined to be a valid rule; otherwise, the candidate value range rule is determined to be an invalid rule.

[0054] Specifically, in an embodiment of the present invention, the difference between the critical state value of the candidate control logic and the critical state setting value of the BPCS can be calculated first. It can be understood that the difference between the critical state upper limit value of the candidate control logic and the critical state setting upper limit value of the BPCS, and the difference between the critical state lower limit value of the candidate control logic and the critical state setting lower limit value of the BPCS can be calculated respectively.

[0055] In order to evaluate the relative size of the difference, the ratio of the difference to the BPCS critical state setting value can be calculated, such as the ratio between the difference between the upper critical state value of the candidate control logic and the upper critical state setting value of the BPCS and the upper critical state setting value of the BPCS, and the difference between the lower critical state value of the candidate control logic and the lower critical state setting value of the BPCS and the lower critical state setting value of the BPCS. The difference ratio reflects the degree of deviation between the candidate control logic and the BPCS critical state setting value.

[0056] When the difference ratio is between 5% and 10%, the candidate value range rule is determined to be a valid rule. This means that the critical state value of the candidate control logic is very close to the critical state setting value of the BPCS, is within the normal fluctuation range, and meets the design expectations.

[0057] Invalid rule: When the difference ratio is less than 5% or greater than 10%, the candidate value range rule is determined to be an invalid rule. If the difference ratio is too small, it means that the critical state value of the candidate control logic is too close to the set value of BPCS, and sufficient safety margin may not be considered, which is easily affected by slight system fluctuations; if the difference ratio is too large, it means that the critical state value of the candidate control logic deviates too far from the set value of BPCS, and may not be able to reflect the real safety boundary in time, which poses a greater risk.

[0058] According to a functional safety attack detection method for a safety instrumented system provided by the present invention, functional safety attack detection is performed on the SIS based on sensor values ​​and effective rules of a basic process control system BPCS, including: Detect abnormal behavior of the SIS based on sensor values ​​and valid rules of the BPCS; and / or, An active detection engine is used to monitor the industrial process of SIS in real time based on the sensor values ​​and effective rules of BPCS.

[0059] Specifically, in the process of detecting functional safety attacks on SIS based on the sensor values ​​and effective rules of BPCS, the sensor values ​​and effective rules of BPCS can be combined to perform real-time anomaly detection on SIS to identify whether the SIS system has encountered functional safety attacks, such as illegal address access and injection of forged data in the SIS controller. These detections are achieved by non-intrusive monitoring of SIS and BPCS.

[0060] In the process of functional safety attack detection of SIS based on BPCS sensor values ​​and effective rules, it is also possible to introduce an active detection engine similar to ShadowPLC to conduct deeper attack detection. The core of this method is to simulate and predict changes in system status, compare it with the actual status, and identify potential safety threats.

[0061] The functional safety attack detection method for a safety instrumented system provided by the present invention is further explained below through embodiments in specific application scenarios.

[0062] This embodiment proposes an innovative solution for a safety instrumented system to detect safety function attacks, called SecureSIS. Figure 2 It is a schematic diagram of the solution process architecture provided by the present invention, such as Figure 2 As shown, the scheme mainly includes three stages: candidate detection rule generation, rule verification and attack detection. This embodiment first uses the SIS controller code to generate candidate rules. Subsequently, this embodiment verifies the candidate rules. Finally, this embodiment combines valid rules and BPCS process values ​​to detect attacks.

[0063] In the first step, this embodiment extracts candidate rules through SIS controller code reverse engineering and structural analysis.

[0064] The controller code contains a comprehensive and complete representation of the control process, including elements such as contacts, coils, and function blocks. These elements include constant values ​​and register addresses, which act as variables in the control logic. Through a comprehensive analysis of the SIS controller code, this embodiment can accurately extract elements such as register addresses, ranges of allowed values, and control logic. These elements together constitute the candidate IDS signature set.

[0065] To derive candidate rules, the present embodiment builds a mapping database that links the SIS controller binary code to the corresponding assembly instructions. This is accomplished through reverse engineering. The present embodiment then uses the mapping database to decompile the SIS controller program binary code into assembly code. After profiling the functional blocks, the present embodiment performs a thorough analysis in two phases: instruction analysis and functional analysis. Through a comprehensive examination, the present embodiment extracts key components such as candidate register address rules, candidate value range rules, and candidate control logic rules.

[0066] The second step is to verify the candidate control logic and candidate value range.

[0067] If the candidate control logic is found to be valid, the candidate register address contained therein is also deemed valid. Subsequently, after verifying the candidate control logic, the present embodiment continues to verify the candidate value range. To solve this problem, the present embodiment utilizes the simplicity feature of SIS and the relationship between SIS and BPCS.

[0068] For verifying the control logic, if it is found during the test process that the control logic, although initially complex, can be simplified, this embodiment considers that the control logic has been tampered with.

[0069] Regarding the verification value range, this embodiment studies the relationship between SIS and BPCS. Figure 3 It is a schematic diagram of the relationship between the SIS and BPCS provided by the present invention. The value range of the control logic in the SIS should be configured to be higher than the upper limit of the state setting value in the BPCS and lower than the lower limit of the state setting value in the BPCS. This means that the critical state setting value in the BPCS can be used as a reference for determining the value range of the control logic in the SIS. Generally speaking, the safety limit range should be wide enough to avoid the initiation of safety measures during normal operation, but should be narrow enough to ensure that these measures can be initiated in time when facing potential risks. Taking this into account, the safety value range is usually set to a difference with the state setting value in the BPCS and a ratio of the state setting value in the BPCS that is less than 10% and greater than 5%. If it falls outside the range of 5% to 10%, it is considered abnormal.

[0070] The third step is to detect attacks by combining effective rules and BPCS process values.

[0071] The final stage of the method in this embodiment involves using sensor values ​​from the BPCS and validated rules to detect safety function attacks. The first part focuses on detecting abnormal behavior, such as illegal address access and injection of forged data within the SIS controller. These detections are achieved through non-intrusive monitoring of the SIS and BPCS. The second part is similar to ShadowPLC, using an active detection engine to monitor the industrial process in real time to detect any signs of abnormality.

[0072] The system uses information from the security attributes of the BPCS and SIS to verify automatically extracted candidate detection rules. By verifying these rules, SecureSIS establishes a powerful and reliable mechanism to detect attacks within the SIS. Using verified rules to detect attacks on safety functions, combined with process values ​​from the BPCS as supplementary information, enhances the detection efficiency of data injection attacks.

[0073] This example uses TriconSIS controllers, S7-300PLCs, and Schneider PLCs deployed on a natural gas pipeline network platform to evaluate the solution. The experiment shows that the detection accuracy of data infection attacks and control logic injection attacks can reach 97.4% and 96.0%, respectively.

[0074] This embodiment also delves into multiple attack scenarios. The first is a data injection attack, which is implemented by injecting incorrect data (attacksets_1) into important registers that may trigger safety functions prematurely and injecting normal data (attacksets_2) to evade safety functions. This may involve forcing a write operation to a register address to overwrite the current value of the register. The second is an illegal address access attack, which is implemented by randomly reading input and output registers and intermediate registers. The third is a value range injection attack, the implementation method of which involves tampering with function block (FB) parameters to modify the value range that triggers safety-related functions. The fourth is a control logic infection attack, which is implemented using the Triton tool to download malicious control code to the PLC and respond to historical data to confuse the control center during these attacks. This type of attack aims to infect the original code, such as inserting or deleting FBs, replacing operators in equations, modifying control flow determinants, etc.

[0075] In the first experiment, the method of this embodiment (SecureSIS) was compared with RNN, LSTM, GRU and Transformer methods. These four methods are methods based on physical processes to detect attacks. This embodiment implements these methods using Keras with a single layer of 50 units. The detailed results are summarized in Table 1, and the results show that this method has the highest detection rate for data injection attacks. This embodiment uses the root mean square error (RMSE) as the loss function to train the prediction model and determine the abnormal threshold. The above four methods have a high detection rate for attacksets_1, but a low detection rate for attacksets_2. This difference can be attributed to their reliance on detecting attacks based on the residual between the predicted value and the actual value, which makes them ineffective in detecting attacksets_2. Detection methods based on physical processes can prevent abnormal process data, but they bring potential challenges. These methods may inadvertently interfere with the normal operation of the SIS protection process under abnormal conditions. On the other hand, compared with the method of this embodiment, these methods are insufficient in correctly identifying data.

[0076] Table 1 Comparison results of various methods for data injection attacks

[0077] In the second experiment, the detection effect of the method of this embodiment on the control program attack was verified. The experimental results show that the method of this embodiment (SecureSIS) achieved a comprehensive and highest detection effect. The detailed results are summarized in Table 2. This embodiment uses PLC_VBS to obtain consistent detection results for control logic injection attacks. The detection accuracy of this method is 0.96. Due to the use of simplicity, this embodiment can understand the reason why the control logic is attacked. SecureSIS has obvious advantages for relatively hidden attacks such as value range injection attacks, especially the detection accuracy of value range injection attacks can reach 1.00, while the best detection results of other methods are very poor. This attack scenario is relatively hidden, and it is very difficult to identify for detection methods that rely heavily on safety functions, so the detection efficiency of ShadowPLC and PLC_VBS is not good.

[0078] Table 2 Comparison results of various methods for attacking control programs

[0079] The functional safety attack detection device for a safety instrument system provided by the present invention is described below. The functional safety attack detection device for a safety instrument system described below and the functional safety attack detection method for a safety instrument system described above can be referenced to each other.

[0080] Figure 4 is a schematic diagram of the structure of the functional safety attack detection device of the safety instrument system provided by the present invention, such as Figure 4 As shown, the device includes the following modules: A generating module 400, for generating candidate rules based on a safety instrumented system SIS controller code; A verification module 410 is used to verify the candidate rules and determine the valid rules among the candidate rules; The detection module 420 is used to perform functional safety attack detection on the SIS based on the sensor values ​​and effective rules of the basic process control system BPCS.

[0081] According to a functional safety attack detection device for a safety instrumented system provided by the present invention, candidate rules are generated based on a safety instrumented system SIS controller code, including: Link the binary code of the SIS controller with the assembly instructions based on reverse engineering to establish a mapping database; Decompile SIS controller code into assembly code based on the mapping database; Perform structural analysis on the assembly code and extract candidate rules.

[0082] According to a functional safety attack detection device for a safety instrumented system provided by the present invention, the candidate rules include candidate control logic rules and / or candidate register address rules; Verify the candidate rules and determine the valid rules among the candidate rules, including: Determine whether the candidate control logic of the SIS controller can be simplified. If the candidate control logic can be simplified, determine the candidate control logic rule as an invalid rule; if the candidate control logic cannot be simplified, determine the candidate control logic rule as a valid rule; When the candidate control logic rule is valid, the candidate register address rule corresponding to the candidate control logic rule is determined to be a valid rule; when the candidate control logic rule is invalid, the candidate register address rule corresponding to the candidate control logic rule is determined to be an invalid rule.

[0083] According to a functional safety attack detection device for a safety instrumented system provided by the present invention, the candidate rules include candidate value range rules; Verify the candidate rules and determine the valid rules among the candidate rules, including: Based on the critical state setting value of the BPCS, it is determined whether the candidate value range rule is a valid rule.

[0084] According to a functional safety attack detection device for a safety instrumented system provided by the present invention, based on a critical state setting value of a BPCS, determining whether a candidate value range rule is a valid rule comprises: determining a difference between a critical state value of the candidate control logic and a critical state set value of the BPCS; When the ratio of the difference value to the critical state setting value of the BPCS is less than 10% and greater than 5%, the candidate value range rule is determined to be a valid rule; otherwise, the candidate value range rule is determined to be an invalid rule.

[0085] According to a functional safety attack detection device of a safety instrumented system provided by the present invention, functional safety attack detection is performed on SIS based on sensor values ​​and effective rules of a basic process control system BPCS, including: Detect abnormal behavior of the SIS based on sensor values ​​and valid rules of the BPCS; and / or, An active detection engine is used to monitor the industrial process of SIS in real time based on the sensor values ​​and effective rules of BPCS.

[0086] Figure 5 A schematic diagram of the structure of an electronic device provided by the present invention, such as Figure 5 As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communications interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the functional safety attack detection method of the safety instrument system provided by the above methods, and the method includes: Generate candidate rules based on the safety instrumented system SIS controller code; Verify the candidate rules and determine the valid rules among the candidate rules; Functional safety attack detection is performed on SIS based on the sensor values ​​and effective rules of the basic process control system BPCS.

[0087] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0088] On the other hand, the present invention further provides a computer program product, the computer program product comprising a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the functional safety attack detection method of the safety instrumented system provided by the above methods, the method comprising: Generate candidate rules based on the safety instrumented system SIS controller code; Verify the candidate rules and determine the valid rules among the candidate rules; Functional safety attack detection is performed on SIS based on the sensor values ​​and effective rules of the basic process control system BPCS.

[0089] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to perform the functional safety attack detection method of the safety instrument system provided by the above methods, the method comprising: Generate candidate rules based on the safety instrumented system SIS controller code; Verify the candidate rules and determine the valid rules among the candidate rules; Functional safety attack detection is performed on SIS based on the sensor values ​​and effective rules of the basic process control system BPCS.

[0090] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0091] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0092] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A functional safety attack detection method for a safety instrumented system, characterized in that: include: Generate candidate rules based on the safety instrumented system SIS controller code; Verifying the candidate rules to determine valid rules among the candidate rules; Based on the sensor values ​​of the basic process control system BPCS and the effective rules, functional safety attack detection is performed on the SIS.

2. The functional safety attack detection method of the safety instrumented system according to claim 1 is characterized in that: The method of generating candidate rules based on the safety instrumented system SIS controller code includes: Link the binary code of the SIS controller with the assembly instructions based on reverse engineering to establish a mapping database; Based on the mapping database, decompiling the SIS controller code into assembly code; The assembly code is structurally analyzed to extract candidate rules.

3. The functional safety attack detection method of the safety instrumented system according to claim 1, characterized in that: The candidate rules include candidate control logic rules and / or candidate register address rules; The verifying the candidate rules to determine valid rules among the candidate rules includes: Determine whether the candidate control logic of the SIS controller can be simplified, and if the candidate control logic can be simplified, determine the candidate control logic rule as an invalid rule; if the candidate control logic cannot be simplified, determine the candidate control logic rule as a valid rule; When the candidate control logic rule is valid, the candidate register address rule corresponding to the candidate control logic rule is determined to be a valid rule; when the candidate control logic rule is invalid, the candidate register address rule corresponding to the candidate control logic rule is determined to be an invalid rule.

4. The functional safety attack detection method of a safety instrumented system according to claim 1, characterized in that: The candidate rules include candidate value range rules; The verifying the candidate rules to determine valid rules among the candidate rules includes: Based on the critical state setting value of the BPCS, it is determined whether the candidate value range rule is a valid rule.

5. The functional safety attack detection method of the safety instrumented system according to claim 4, characterized in that: The determining whether the candidate value range rule is a valid rule based on the critical state setting value of the BPCS includes: determining a difference between a critical state value of the candidate control logic and a critical state set value of the BPCS; When the ratio of the difference to the critical state setting value of the BPCS is less than 10% and greater than 5%, the candidate value range rule is determined to be a valid rule; otherwise, the candidate value range rule is determined to be an invalid rule.

6. The functional safety attack detection method of a safety instrumented system according to claim 1, characterized in that: The method of performing functional safety attack detection on the SIS based on the sensor value of the basic process control system BPCS and the effective rule includes: Detecting abnormal behavior of the SIS based on the sensor values ​​of the BPCS and the effective rules; and / or, An active detection engine is used to monitor the industrial process of the SIS in real time based on the sensor values ​​of the BPCS and the effective rules.

7. A functional safety attack detection device for a safety instrument system, characterized in that: include: A generation module, used for generating candidate rules based on a safety instrumented system SIS controller code; A verification module, used to verify the candidate rules and determine valid rules among the candidate rules; The detection module is used to perform functional safety attack detection on the SIS based on the sensor value of the basic process control system BPCS and the effective rules.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the functional safety attack detection method for the safety instrumented system according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the functional safety attack detection method for a safety instrumented system according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the functional safety attack detection method for a safety instrumented system according to any one of claims 1 to 6 is implemented.

Images