Plc runtime attack detection method and system for industrial control system

Abstract

The application provides a PLC runtime attack detection method and system of an industrial control system, and belongs to the field of industrial control.The method comprises the following steps: obtaining initial control logic of a PLC, and performing binary static insertion of the initial control logic to obtain rewritten control logic; constructing a control flow graph according to the control logic, wherein the control logic comprises the initial control logic or the rewritten control logic; running the rewritten control logic, and obtaining an execution path of a first control flow instruction in a running process; the rewritten control logic comprises the first control flow instruction, and the first control flow instruction comprises a first indirect function call instruction and a first function return instruction; and when the execution path of the first control flow instruction is included in a valid path of the control flow graph, it is determined that the PLC is not attacked.The application can effectively detect whether the PLC program is attacked by a control flow hijacking attack during running, improve the security protection level of the PLC, and ensure the safety of the industrial control system.

Description

Technical Field

[0001] This invention relates to the field of industrial control technology, and in particular to a method and system for detecting PLC runtime attacks in industrial control systems. Background Technology

[0002] Currently, in sectors such as water conservancy, chemical engineering, energy, and power, over 80% of infrastructure relies on Industrial Control Systems (ICS) for automated operations. With the rise of Industry 4.0, the increased connectivity of industrial control equipment via the internet has led to a significant increase in ICS vulnerability exploitation and a broader attack surface. ICS has become a major target, and protecting its security is one of the most pressing international issues.

[0003] Programmable Logic Controllers (PLCs) are the core control devices in industrial control systems, controlling physical processes in critical infrastructure and playing a vital role in these systems. Engineers program PLCs to control physical processes by developing control programs. However, the high real-time and high availability requirements of PLC control processes, along with the limited storage resources and computing power of PLCs, render many assumptions underlying general-purpose computer security technologies invalid in PLCs. This makes PLCs vulnerable to hacking attacks, allowing attackers to manipulate target processes.

[0004] Attackers exploit PLC vulnerabilities and weaknesses to launch attacks, manipulating target processes through complex, advanced, and covert techniques. This causes physical processes to malfunction, resulting in unplanned factory shutdowns, disruptions to critical infrastructure services, equipment damage, social panic, and even casualties. Attackers can carry out runtime hijacking attacks by manipulating PLC program memory. Currently, there are no mature research results or application demonstrations for real-time detection of PLC runtime hijacking attacks. Summary of the Invention

[0005] This invention provides a method and system for detecting PLC runtime attacks in industrial control systems, which can detect in a timely and effective manner whether the PLC program is subjected to hijacking attacks during runtime, thereby ensuring the security of the industrial control system.

[0006] This invention provides a method for detecting runtime attacks on PLCs in industrial control systems, comprising:

[0007] Obtain the initial control logic of the PLC and perform binary static instrumentation on the initial control logic to obtain the rewritten control logic;

[0008] A control flow graph is constructed based on the control logic, which includes the initial control logic or the rewritten control logic.

[0009] The rewritten control logic is executed, and the execution path of the first control flow instruction during the execution is obtained; the rewritten control logic includes the first control flow instruction, which includes a first indirect function call instruction and a first function return instruction.

[0010] When the execution path of the first control flow instruction is included in the valid path of the control flow graph, it is determined that the PLC has not been attacked.

[0011] Optionally, the step of running the rewritten control logic and obtaining the execution path of the first control flow instruction during the running process includes:

[0012] The rewritten control logic is executed, and the target address of the first control flow instruction during the execution process is transmitted to the shared memory in real time.

[0013] Based on the shared memory, the target address of the first control flow instruction during the operation is obtained, and the execution path of the target address is traced.

[0014] Optionally, the binary static instrumentation of the initial control logic includes:

[0015] Obtain the indirect function call instructions and function return instructions of all subroutines in the initial control logic;

[0016] Trampoline commands are used to replace the indirect function call commands and function return commands.

[0017] Optionally, the binary static instrumentation of the initial control logic further includes:

[0018] Assembly code for static instrumentation of the initial control logic in shared memory.

[0019] Optionally, the binary static instrumentation of the initial control logic further includes:

[0020] The code that transmits the starting address of the static instrumentation program for the initial control logic.

[0021] Optionally, constructing the control flow graph based on the control logic includes:

[0022] Obtain the code segment, data segment, and symbol table information of all subroutines in the control logic;

[0023] The target address and execution path of the second control flow instruction are determined based on the code segment, data segment, and symbol table information; the second control flow instruction includes a second indirect function call instruction and a second function return instruction.

[0024] A control flow graph is constructed based on the target address and execution path of the second control flow instruction.

[0025] Optionally, it also includes:

[0026] The process of detecting whether the valid path of the control flow graph includes the execution path of the first control flow instruction is executed separately from the process of running the rewritten control logic and obtaining the execution path of the first control flow instruction during the running process.

[0027] This invention also provides a PLC runtime attack detection system for industrial control systems, comprising:

[0028] The static instrumentation module is used to obtain the initial control logic of the PLC and perform binary static instrumentation on the initial control logic to obtain the rewritten control logic.

[0029] A control flow graph construction module is used to construct a control flow graph based on control logic, wherein the control logic includes the initial control logic or the rewritten control logic.

[0030] The execution module is used to run the rewritten control logic and obtain the execution path of the first control flow instruction during the execution process; the rewritten control logic includes the first control flow instruction, which includes a first indirect function call instruction and a first function return instruction;

[0031] An attack detection module is used to determine that the PLC is not under attack when the execution path of the control flow instruction is included in the valid path of the control flow graph.

[0032] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the PLC runtime attack detection method of the industrial control system.

[0033] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the PLC runtime attack detection method for the industrial control system.

[0034] This invention provides a method and system for detecting runtime attacks on a PLC in an industrial control system. The method involves acquiring the initial control logic of the PLC and performing binary static instrumentation on it to obtain a rewritten control logic. A control flow graph is constructed based on this control logic, which includes either the initial control logic or the rewritten control logic. The rewritten control logic is then run, and the execution path of a first control flow instruction during execution is obtained. The rewritten control logic includes the first control flow instruction, which comprises a first indirect function call instruction and a first function return instruction. When the valid path in the control flow graph includes the execution path of the first control flow instruction, it is determined that the PLC is not under attack. This invention can determine whether the PLC is under attack by detecting whether the valid path in the control flow graph includes the execution path of the first control flow instruction during operation. When the valid path in the control flow graph includes the execution path of the first control flow instruction, it is determined that the PLC is not under attack. Therefore, this invention can effectively detect whether a PLC program is subjected to control flow hijacking attacks during runtime, ensuring the security of the industrial control system. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0036] Figure 1 This is a flowchart of the PLC runtime attack detection method for industrial control systems provided by the present invention;

[0037] Figure 2 This is a schematic diagram of the PLC runtime attack detection method for industrial control systems provided by the present invention.

[0038] Figure 3 This is a block diagram of the PLC runtime attack detection system for industrial control systems provided by the present invention;

[0039] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0041] The following is combined Figures 1-4 This invention describes a PLC runtime attack detection method and system for industrial control systems. In general, the invention comprises two main stages: offline analysis and online detection. The first stage performs offline analysis and control flow instruction binary instrumentation on the initial control logic binary program of the PLC to obtain the rewritten control logic. Then, based on the initial or rewritten control logic, it extracts the target addresses and execution paths of complete and legitimate second control flow instructions and constructs a control flow graph (CFG) as a detection baseline. The second stage involves online attack detection during runtime. The PLC runs the rewritten control logic, transmitting the target addresses of the first control flow instructions to shared memory in real time during dynamic operation. An asynchronous control flow integrity (CFI) checker obtains the target addresses of the first control flow instructions in shared memory to trace the program's execution path and compares this execution path with the execution path in the second control flow instructions, thereby detecting whether there is malicious control flow hijacking or deviation from normal program execution.

[0042] Specifically, Figure 1 The flowchart of the PLC runtime attack detection method for industrial control systems provided by this invention is as follows: Figure 2 This is a schematic diagram of the PLC runtime attack detection method for industrial control systems provided by the present invention, wherein the execution subject of the method of the present invention can be a computer device.

[0043] Furthermore, since most PLCs use ARM processors, this invention specifically focuses on PLC devices based on the ARM (Acorn RISC Macachine) architecture. In the program execution flow of ARM-based systems, attackers can hijack the control flow primarily through two methods: first, by modifying register values ​​during the execution of indirect function call instructions; and second, by modifying the return address before the function return instruction is executed. Based on this, this invention provides a method for detecting runtime attacks on PLCs in industrial control systems, such as... Figure 1 and Figure 2 As shown, it includes:

[0044] Step 101: Obtain the initial control logic of the PLC and perform binary static instrumentation on the initial control logic to obtain the rewritten control logic.

[0045] In a specific embodiment, before performing binary static instrumentation on the initial control logic, the initial control logic of the PLC needs to be disassembled (this embodiment of the invention uses the open-source tool CapStone to implement this). Based on the disassembly results, indirect function call instructions (e.g., mov pc,r8) and function return instructions (e.g., ldmdb fp,{fp,sp,pc}) are located and instrumented. The instrumentation locations are: indirect function call instructions (e.g., BL R8 / BLX R8 / MovPC,R8 / LDR PC,R8, etc.) and function return instructions (e.g., LDMDB FP,{FP,SP,PC} / POP{R11,PC}, etc.).

[0046] In a specific embodiment, step 101 specifically includes: obtaining the indirect function call instructions and function return instructions of all subroutines in the initial control logic; and using trampoline instructions to replace the indirect function call instructions and function return instructions.

[0047] The above embodiments of the present invention replace branch instructions (indirect function call instructions and function return instructions) with trampoline instructions, enabling direct branching to unused trampoline regions. Once the instrumented trampoline region completes its task, program control returns to the original region. Therefore, the trampoline-based instrumentation strategy in this invention requires no source code and does not change the relative positions of the code.

[0048] In one specific embodiment, the primary function of the trampoline region is to transfer the target address of the first control flow instruction to shared memory. The instrumentation code is a set of lightweight ARM assembly instructions that, in addition to transferring the addresses of indirect function call instructions and return functions to shared memory, also needs to instrument the assembly code that creates the shared memory before the rewritten control logic runs.

[0049] In a specific embodiment, when the CodeSys Runtime (PLC application layer runtime environment) loads the rewritten control logic, its program entry address is randomized. Therefore, it is necessary to instrument the code at the program start address (i.e., the program entry address of PLC_PRG) in advance to deal with address randomization.

[0050] In one specific embodiment, the present invention may also update CFG according to the offset of the PLC_PRG function base address when running the rewritten control logic in step 103, so that CFG is more accurate.

[0051] In one specific embodiment, the present invention may further perform verification and calculation on the rewritten control logic code segment and data segment to replace the verification information in the rewritten control logic (.PRG file), and then execute step 103.

[0052] Step 102: Construct a control flow graph based on the control logic, which includes the initial control logic or the rewritten control logic.

[0053] The control flow graph can be constructed based on either the initial control logic or the rewritten control logic.

[0054] In one specific embodiment, a control flow graph is constructed based on control logic, including:

[0055] Obtain the code segment, data segment, and symbol table information of all subroutines in the control logic;

[0056] The target address and execution path of the second control flow instruction are determined based on the code segment, data segment, and symbol table information; the second control flow instruction includes a second indirect function call instruction and a second function return instruction; a control flow graph is constructed based on the target address and execution path of the second control flow instruction.

[0057] In one specific embodiment, this invention utilizes ICSREF (an open-source industrial control system reverse engineering framework) to parse binary control logic files (.PRG format), thereby obtaining the code segments, data segments, and symbol table information of all subroutines of the control logic, providing a basis for subsequent CFG construction. Then, based on the code segment, data segment, and symbol table information of the control logic, the CFG is constructed by finding and parsing the target address and execution path of the second control flow instructions.

[0058] Furthermore, the CFG constructed in this invention is lightweight, focusing only on indirect branches while ignoring direct branches. This is because direct branches statically specify targets, making them unusable by attackers, while indirect branches are dynamic instructions, making them easy for attackers to exploit for PLC attacks. However, indirect branches rely on register or memory values ​​to specify targets at runtime. Therefore, a challenge in constructing a complete CFG lies in determining the targets of indirect branches. This invention solves this problem by parsing the .PRG file and reconstructing the symbol table to determine the targets of indirect branches.

[0059] Specifically, the .PRG binary file contains only indirect jumps from one subroutine to another or a dynamically linked function, and the locations of all such indirect branch targets are fully contained within this binary file. The specific process of parsing a .PRG file is as follows: the instruction sequence for an indirect jump from a subroutine to a dynamically linked function is ldr r8,[0x00002e58], ldr r8,[r8], mov lr,pc, mov pc,r8, where the jump target [0x00002e58] is contained in the symbol table, which can be recovered by analyzing the .PRG file. Based on this, the present invention can extract and parse all second control flow instructions, thereby obtaining a complete and robust CFG.

[0060] In one specific embodiment, steps 101 and 102 are performed on the host computer to minimize the use of the PLC's internal resources.

[0061] Step 103: Run the rewritten control logic and obtain the execution path of the first control flow instruction during the operation; the rewritten control logic includes the first control flow instruction, which includes a first indirect function call instruction and a first function return instruction.

[0062] The first control flow instruction is obtained during the execution of the rewritten control logic, making its acquisition a dynamic process. The second control flow instruction, on the other hand, is used to construct the control flow graph. It is obtained by parsing the initial or rewritten control logic and does not involve the program's execution process; this is the key difference between the first and second control flow instructions. However, they also share similarities: since the second control flow instruction is derived from the initial or rewritten control logic, and the first control flow instruction is obtained during the execution of the rewritten control logic (which is statically instrumented from the initial control logic), both are related to the initial control logic. This is the basis for determining whether a PLC is under attack based on the effective paths of the control flow graph and the execution paths of the first control flow instruction.

[0063] In one specific embodiment, step 103 includes:

[0064] The rewritten control logic is executed, and the target address of the first control flow instruction during the execution process is transmitted to the shared memory in real time. Based on the shared memory, the target address of the first control flow instruction during the execution process is obtained, and the execution path of the target address is tracked. The execution path is the execution path of the first control flow instruction, which ensures that the normal operation of the PLC is not affected.

[0065] In an optional embodiment, the asynchronous CFI checker obtains the execution path of the first control flow instruction during the operation based on the shared memory, which can ensure real-time online detection of attacks.

[0066] In one specific embodiment, the present invention further includes:

[0067] The process of detecting whether the valid path of the control flow graph includes the execution path of the first control flow instruction is performed separately from step 103. This process communicates with step 103 via shared memory. Both processes access the same fixed-size memory region (shared memory) to achieve data sharing and interaction. During the operation of the rewritten control logic, the target address of the first control flow instruction is pushed to the shared memory, and its execution path is tracked. This ensures accurate and real-time detection without affecting the normal operation of the PLC.

[0068] In an optional embodiment, the asynchronous CFI checker detects whether a valid path in the control flow graph includes the execution path of the first control flow instruction.

[0069] In an optional embodiment, detecting whether a valid path in the control flow graph includes the execution path of the first control flow instruction includes:

[0070] Obtain the valid paths in the control flow graph and the execution path of the first control flow instruction;

[0071] Determine whether the execution path of the first control flow instruction belongs to one of the valid paths in the control flow graph.

[0072] Step 104: When the effective path of the control flow graph includes the execution path of the first control flow instruction, it is determined that the PLC has not been attacked.

[0073] In one specific embodiment, the core of CFI in this invention is to ensure that program execution only follows approved execution paths obtained through the CFG. To achieve this, the destination address of each indirect jump instruction and return instruction is checked to determine whether it follows a valid path in the CFG.

[0074] In one specific embodiment, the CFI verification process is as follows: The function base address (equivalent to the main function address) of the PLC-PRG is read from shared memory, and the previously constructed CFG (mainly used to update the second function return instruction) is updated based on the offset information of the base address. The updated CFG serves as the baseline for CFI detection. Then, the execution path of the first control flow instruction in shared memory is read sequentially, and the target addresses of the first indirect function call instruction and the first function return instruction are checked to see if they are within the valid path of the CFG. If both the target addresses of the first indirect function call instruction and the first function return instruction are within the valid path of the CFG, then the PLC has not been attacked.

[0075] The PLC runtime attack detection system for industrial control systems provided by the present invention will be described below. The PLC runtime attack detection system for industrial control systems described below can be referred to in correspondence with the PLC runtime attack detection method for industrial control systems described above.

[0076] Figure 3 This invention provides a PLC runtime attack detection system for industrial control systems, such as... Figure 3 As shown, it includes:

[0077] The static instrumentation module 301 is used to obtain the initial control logic of the PLC and perform binary static instrumentation on the initial control logic to obtain the rewritten control logic.

[0078] The control flow graph construction module 302 is used to construct a control flow graph based on control logic, wherein the control logic includes the initial control logic or the rewritten control logic.

[0079] The execution module 303 is used to run the rewritten control logic and obtain the execution path of the first control flow instruction during the execution process; the rewritten control logic includes the first control flow instruction, which includes a first indirect function call instruction and a first function return instruction.

[0080] The attack detection module 304 is used to determine that the PLC has not been attacked when the effective path of the control flow graph includes the execution path of the control flow instruction.

[0081] In one specific embodiment, the running module 303 is used to:

[0082] The rewritten control logic is executed, and the target address of the first control flow instruction during the execution process is transmitted to the shared memory in real time.

[0083] Based on the shared memory, the target address of the first control flow instruction during the operation is obtained, and the execution path of the target address is traced.

[0084] In one specific embodiment, the static instrumentation module 301 is used for:

[0085] Obtain the indirect function call instructions and function return instructions of all subroutines in the initial control logic;

[0086] Trampoline commands are used to replace the indirect function call commands and function return commands.

[0087] In one specific embodiment, the static instrumentation module 301 is also used for:

[0088] Assembly code for static instrumentation of the initial control logic in shared memory.

[0089] In one specific embodiment, the static instrumentation module 301 is also used for:

[0090] The code that transmits the starting address of the static instrumentation program for the initial control logic.

[0091] In one specific embodiment, the control flow graph construction module 302 is used for:

[0092] Obtain the code segment, data segment, and symbol table information of all subroutines in the control logic;

[0093] The target address and execution path of the second control flow instruction are determined based on the code segment, data segment, and symbol table information; the second control flow instruction includes a second indirect function call instruction and a second function return instruction.

[0094] A control flow graph is constructed based on the target address and execution path of the second control flow instruction.

[0095] In one specific embodiment, the attack detection module 304 is further configured to:

[0096] The system detects whether the valid path of the control flow graph includes the execution path of the first control flow instruction; wherein, the processes in the running module 303 and the attack detection module 304 are executed separately; the running module 303 and the attack detection module 304 communicate through shared memory.

[0097] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call logic instructions in the memory 430 to execute a PLC attack detection method for an industrial control system, including:

[0098] Obtain the initial control logic of the PLC and perform binary static instrumentation on the initial control logic to obtain the rewritten control logic.

[0099] A control flow graph is constructed based on the control logic, which includes the initial control logic or the rewritten control logic.

[0100] The rewritten control logic is executed, and the execution path of the first control flow instruction during the execution is obtained; the rewritten control logic includes the first control flow instruction, which includes a first indirect function call instruction and a first function return instruction.

[0101] When the execution path of the first control flow instruction is included in the valid path of the control flow graph, it is determined that the PLC has not been attacked.

[0102] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0103] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium, wherein when the computer program is executed by a processor, the computer is capable of executing a PLC runtime attack detection method for an industrial control system, comprising:

[0104] Obtain the initial control logic of the PLC and perform binary static instrumentation on the initial control logic to obtain the rewritten control logic.

[0105] A control flow graph is constructed based on the control logic, which includes the initial control logic or the rewritten control logic.

[0106] The rewritten control logic is executed, and the execution path of the first control flow instruction during the execution is obtained; the rewritten control logic includes the first control flow instruction, which includes a first indirect function call instruction and a first function return instruction.

[0107] When the execution path of the first control flow instruction is included in the valid path of the control flow graph, it is determined that the PLC has not been attacked.

[0108] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a PLC runtime attack detection method for an industrial control system, comprising:

[0109] Obtain the initial control logic of the PLC and perform binary static instrumentation on the initial control logic to obtain the rewritten control logic.

[0110] A control flow graph is constructed based on the control logic, which includes the initial control logic or the rewritten control logic.

[0111] The rewritten control logic is executed, and the execution path of the first control flow instruction during the execution is obtained; the rewritten control logic includes the first control flow instruction, which includes a first indirect function call instruction and a first function return instruction.

[0112] When the execution path of the first control flow instruction is included in the valid path of the control flow graph, it is determined that the PLC has not been attacked.

[0113] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0114] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A PLC runtime attack detection method of an industrial control system, characterized by, include: Obtain the initial control logic of the PLC and perform binary static instrumentation on the initial control logic to obtain the rewritten control logic; A control flow graph is constructed based on the control logic, which includes the initial control logic or the rewritten control logic. The rewritten control logic is executed, and the execution path of the first control flow instruction during the execution is obtained; the rewritten control logic includes the first control flow instruction, which includes a first indirect function call instruction and a first function return instruction; When the execution path of the first control flow instruction is included in the valid path of the control flow graph, it is determined that the PLC has not been attacked; The process of running the rewritten control logic and obtaining the execution path of the first control flow instruction during operation includes: The rewritten control logic is executed, and the target address of the first control flow instruction during the execution process is transmitted to the shared memory in real time. Based on the shared memory, the target address of the first control flow instruction during the operation is obtained, and the execution path of the target address is traced.

2. The PLC runtime attack detection method of the industrial control system according to claim 1, characterized in that, The binary static instrumentation of the initial control logic includes: Obtain the indirect function call instructions and function return instructions of all subroutines in the initial control logic; Trampoline commands are used to replace the indirect function call commands and function return commands.

3. The method for detecting PLC runtime attacks in an industrial control system according to claim 2, characterized in that, The binary static instrumentation of the initial control logic further includes: Assembly code for static instrumentation of the initial control logic in shared memory.

4. The PLC runtime attack detection method of the industrial control system according to claim 2, characterized by, The binary static instrumentation of the initial control logic further includes: The code that transmits the starting address of the static instrumentation program for the initial control logic.

5. The method of claim 1-4, wherein the method is characterized by, The construction of the control flow graph based on the control logic includes: Obtain the code segment, data segment, and symbol table information of all subroutines in the control logic; The target address and execution path of the second control flow instruction are determined based on the code segment, data segment, and symbol table information; the second control flow instruction includes a second indirect function call instruction and a second function return instruction. A control flow graph is constructed based on the target address and execution path of the second control flow instruction.

6. The method for detecting PLC runtime attacks in an industrial control system according to claim 1, characterized in that, Also includes: The process of detecting whether the valid path of the control flow graph includes the execution path of the first control flow instruction is executed separately from the process of running the rewritten control logic and obtaining the execution path of the first control flow instruction during the running process. The process that detects whether the valid path of the control flow graph includes the execution path of the first control flow instruction and the process that runs the rewritten control logic and obtains the execution path of the first control flow instruction during the running process communicate through shared memory.

7. A PLC runtime attack detection system for an industrial control system, characterized in that, include: The static instrumentation module is used to obtain the initial control logic of the PLC and perform binary static instrumentation on the initial control logic to obtain the rewritten control logic. A control flow graph construction module is used to construct a control flow graph based on control logic, wherein the control logic includes the initial control logic or the rewritten control logic. The execution module is used to run the rewritten control logic and obtain the execution path of the first control flow instruction during the execution process; the rewritten control logic includes the first control flow instruction, which includes a first indirect function call instruction and a first function return instruction; An attack detection module is used to determine that the PLC is not under attack when the execution path of the control flow instruction is included in the valid path of the control flow graph. The operating module is used for: The rewritten control logic is executed, and the target address of the first control flow instruction during the execution process is transmitted to the shared memory in real time. Based on the shared memory, the target address of the first control flow instruction during the operation is obtained, and the execution path of the target address is traced.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the PLC runtime attack detection method for industrial control systems as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the PLC runtime attack detection method for industrial control systems as described in any one of claims 1 to 6.

Images