Network hijacking determination system
By designing a network hijacking determination system, using the network hijacking determination device to obtain and detect the engineering parameters of the operator station and the industrial control network, the problem of the inability to promptly detect the operator station hijacking in the prior art is solved, and automatic Testing and timely prevention avoid serious losses to the company.
Patent Information
- Application Number
- CN202311048778.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-08-18
- Publication Date
- 2025-02-21
AI Technical Summary
In the prior art, by manually detecting the logical operation relationship between the engineering parameters of the operator station and the engineering parameters of the process control station, it is impossible to detect the problem of the operator station being hijacked in a timely manner, resulting in the enterprise being susceptible to serious losses.
Design a network hijacking determination system, including an operator station, a network hijacking determination device and a process control station. The network hijacking determiner performs detection by obtaining the first engineering parameters of the target operator station and the second engineering parameters of the industrial control network. If the detection result is different from the preset result, it is determined that the target operator station is hijacked.
Automatic detection of the operator station is realized, processing efficiency is improved, and the problem of the operator station being hijacked is timely discovered, so as to avoid serious losses from the enterprise.
Smart Images
Figure CN119496629A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of information security technology, and in particular to a system for determining network hijacking. Background Art
[0002] Normally, relevant personnel issue instructions to the process control station through the operator station of the industrial control network. However, after the operator station is hijacked, the hijacker can also issue instructions to the process control station through the operator station, and then launch a network attack, causing serious losses to the relevant companies.
[0003] In the related art, the logical operation relationship between the engineering parameters of the operator station and the engineering parameters of the process control station is manually detected to determine whether the operator station is hijacked. However, this method requires manual detection, which is not only inefficient, but also unable to detect the hijacking of the operator station in time, which can easily cause serious losses to the enterprise. Summary of the invention
[0004] In view of this, the present application provides a network hijacking determination system that can automatically determine whether a network site has been hijacked, thereby preventing the enterprise from suffering serious losses.
[0005] Specifically, the following technical solutions are included:
[0006] In a first aspect, an embodiment of the present application provides a network hijacking determination system, the system comprising: at least one operator station, a network hijacking determination device and at least one process control station,
[0007] The at least one operator station is connected to the at least one process control station via an industrial control network;
[0008] The at least one operator station includes a target operator station, the target operator station is connected to the network hijacking determination device, and the network hijacking determination device is connected to the industrial control network;
[0009] The network hijacking determination device is configured to obtain a first engineering parameter of a target operator station; obtain a second engineering parameter of an industrial control network; detect the first engineering parameter and the second engineering parameter to obtain a detection result; and in response to the detection result being different from a preset result, determine that the target operator station is hijacked.
[0010] In some embodiments, the network hijacking determination device includes a first acquisition module, a second acquisition module and a detection module.
[0011] The first acquisition module and the second acquisition module are both connected to the detection module;
[0012] The first acquisition module is also connected to the target operator station, and the second acquisition module is connected to the industrial control network.
[0013] In some embodiments, the second acquisition module includes a connected parameter acquisition submodule and a parameter analysis submodule.
[0014] The parameter acquisition submodule is connected to the industrial control network, and the parameter analysis submodule is connected to the detection module.
[0015] In some embodiments, the first acquisition module is connected to an image output interface of the target operator station, and / or the first acquisition module is connected to a data interface of the target operator station.
[0016] In some embodiments, the system further comprises an engineer station,
[0017] The engineer station is connected to the at least one process control station via the industrial control network.
[0018] In a second aspect, an embodiment of the present application further provides another network hijacking determination system, the system comprising: at least one operator station, a network hijacking determination device and at least one process control station,
[0019] The at least one operator station is connected to the at least one process control station via an industrial control network;
[0020] The at least one operator station includes a target operator station, the network hijacking determination device is located at one side of the target operator station and is configured to obtain a first engineering parameter of the target operator station; the network hijacking determination device is connected to the industrial control network;
[0021] The network hijacking determination device is configured to obtain a first engineering parameter of a target operator station; obtain a second engineering parameter of an industrial control network; detect the first engineering parameter and the second engineering parameter to obtain a detection result; and in response to the detection result being different from a preset result, determine that the target operator station is hijacked.
[0022] In some embodiments, the network hijacking determination device includes a first acquisition module, a second acquisition module and a detection module.
[0023] The first acquisition module and the second acquisition module are both connected to the detection module;
[0024] The first acquisition module is also connected to the target operator station, and the second acquisition module is connected to the industrial control network.
[0025] In some embodiments, the first acquisition module includes a camera located on a side of a display screen of the target operator station.
[0026] In some embodiments, the second acquisition module includes a connected parameter acquisition submodule and a parameter analysis submodule.
[0027] The parameter acquisition submodule is connected to the industrial control network, and the parameter analysis submodule is connected to the detection module.
[0028] In some embodiments, the system further comprises an engineer station,
[0029] The engineer station is connected to the at least one process control station via the industrial control network.
[0030] The beneficial effects of the technical solution provided by the embodiments of the present application include at least:
[0031] The network hijacking determination system provided by the embodiment of the present application, since at least one operator station is connected to at least one process control station through the industrial control network, the operator station can send instructions to the process control station through the industrial control network. At the same time, since the network hijacking determination device is connected to the target operator station and connected to the industrial control network, the network hijacking determination device can obtain the first engineering parameter from the target operator station and the second engineering parameter from the industrial control network, and then can detect the first engineering parameter and the second engineering parameter, and obtain the detection result. If the detection result is different from the preset result, it is determined that the target operator station is hijacked. The network hijacking determination system provided by the embodiment of the present application replaces the process of detecting whether the operator station is hijacked by manual detection in the related art, and can automatically determine whether the network site is hijacked, thereby preventing the enterprise from suffering serious losses. BRIEF DESCRIPTION OF THE DRAWINGS
[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0033] Figure 1 A schematic diagram of the structure of a network hijacking determination system provided in an embodiment of the present application;
[0034] Figure 2 A schematic diagram of the structure of a network hijacking determination device in a network hijacking determination system provided in an embodiment of the present application;
[0035] Figure 3A schematic diagram of the structure of a network hijacking determination device in a network hijacking determination system provided in an embodiment of the present application;
[0036] Figure 4 A schematic diagram of the structure of another network hijacking determination system provided in an embodiment of the present application;
[0037] Figure 5 A schematic diagram of the structure of a network hijacking determination device in another network hijacking determination system provided in an embodiment of the present application;
[0038] Figure 6 A schematic diagram of the structure of a network hijacking determination device in another network hijacking determination system provided in an embodiment of the present application.
[0039] The reference numerals in the figures represent respectively:
[0040] 100-network hijacking determination system, 101-operator station, 1011-target operator station, 102-network hijacking determination device, 1021-first acquisition module, 1022-second acquisition module, 10221-parameter acquisition submodule, 10222-parameter analysis submodule, 1023-detection module, 103-process control station, 104-industrial control network, 105-engineer station, 106-target device,
[0041] 200-network hijacking determination system, 201-operator station, 2011-target operator station, 202-network hijacking determination device, 2021-first acquisition module, 20211-camera, 2022-second acquisition module, 20221-parameter acquisition submodule, 20222-parameter analysis submodule, 2023-detection module, 203-process control station, 204-industrial control network, 205-engineer station, 206-target device. DETAILED DESCRIPTION
[0042] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0043] The directional nouns involved in the embodiments of the present application, such as "upper", "lower", "side", etc., are generally represented by Figure 1 The relative relationship of the orientation shown in the figure is used as the basis, and these orientation terms are used only to more clearly describe the relationship between structures, not to describe absolute orientation. When the product is placed in different postures, the orientation may change, for example, "up" and "down" may be interchangeable.
[0044] Unless otherwise defined, all technical terms used in the embodiments of the present application have the same meanings as those generally understood by those of ordinary skill in the art. Some technical terms appearing in the embodiments of the present application are explained below.
[0045] In the embodiments of the present application, the “operator station” referred to generally refers to an operation terminal connected to an industrial control network for relevant personnel to send instructions.
[0046] The "process control station" involved generally refers to a control terminal connected between the industrial control network and related equipment, which is used to receive instructions and control the operation mode of related equipment.
[0047] In order to make the technical solutions and advantages of the present application more clear, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.
[0048] Industrial control networks are composed of measurement and control instruments with digital communication functions and scattered in large numbers at production sites as network nodes. Industrial control networks can achieve interoperability of information transmission and communication between interconnected devices and systems, and are therefore widely used in related industries. Usually, relevant personnel use operator stations connected to the industrial control network to issue instructions to process control stations connected to the industrial control network, thereby controlling the equipment connected to the process control stations. However, when the operator station is hijacked, the hijacker can also issue instructions to the process control station through the operator station, and then launch a network attack by controlling the operation of the equipment, which will cause serious losses to related companies.
[0049] In the related art, the logical operation relationship between the engineering parameters of the operator station and the engineering parameters of the process control station is detected by manual detection to determine whether the operator station is hijacked. However, this method requires manual calculation for detection, which is not only inefficient, but also unable to detect the hijacking of the operator station in time, which can easily cause serious losses to the enterprise.
[0050] In order to solve the technical problems existing in the related technology, the embodiment of the present application provides a device for determining network hijacking, which can realize automatic detection of the logical operation relationship between the engineering parameters of the operator station and the engineering parameters of the process control station, improve processing efficiency, and then promptly discover the problem of operator station hijacking to avoid serious losses to the enterprise.
[0051] Figure 1 A schematic diagram of the structure of a network hijacking determination system provided in an embodiment of the present application. Figure 1The network hijacking determination system 100 includes: at least one operator station 101, a network hijacking determination device 102 and at least one process control station 103.
[0052] At least one operator station 101 is connected to at least one process control station 103 via an industrial control network 104 , so that each operator station 101 can send instructions to the process control station 103 via the industrial control network 104 .
[0053] At least one operator station 101 includes a target operator station 1011, and the target operator station 1011 is connected to the network hijacking determination device 102, so that the network hijacking determination device 102 can obtain a first engineering parameter from the target operator station 1011; the network hijacking determination device 102 is connected to the industrial control network 104, so that the network hijacking determination device 102 can obtain a second engineering parameter from the industrial control network 104.
[0054] The network hijacking determination device 102 is configured to obtain a first engineering parameter of a target operator station 1011; obtain a second engineering parameter of an industrial control network 104; detect the first engineering parameter and the second engineering parameter to obtain a detection result; and in response to the detection result being different from a preset result, determine that the target operator station 1011 is hijacked.
[0055] It can be understood that the second engineering parameter comes from the process control station 103 , and the second engineering parameter generated by the process control station 103 can be transmitted to the industrial control network 104 .
[0056] Therefore, the network hijacking determination system provided by the embodiment of the present application, since at least one operator station 101 is connected to at least one process control station 103 through the industrial control network 104, the operator station 101 can send instructions to the process control station 103 through the industrial control network 104, and at the same time, the network hijacking determination device 102 is connected to the target operator station 1011 and connected to the industrial control network 104, so that the network hijacking determination device 102 can obtain the first engineering parameter from the target operator station 1011 and the second engineering parameter from the industrial control network 104, and then the first engineering parameter and the second engineering parameter can be detected, and the detection result can be obtained. If the detection result is different from the preset result, it is determined that the target operator station 1011 is hijacked. The network hijacking determination system provided by the embodiment of the present application replaces the process of detecting whether the operator station is hijacked by manual detection in the related art, and can automatically determine whether the network site is hijacked, thereby avoiding serious losses to the enterprise.
[0057] The structure of the network hijacking determination system 100 provided in the embodiment of the present application is further described below:
[0058] Figure 2 A schematic diagram of a network hijacking determination device provided in an embodiment of the present application. Figure 2 In some embodiments, the network hijacking determination device includes a first acquisition module 1021 , a second acquisition module 1022 and a detection module 1023 .
[0059] Wherein, the first acquisition module 1021 and the second acquisition module 1022 are both connected to the detection module 1023;
[0060] The first acquisition module 1021 is also connected to the target operator station 1011 , and the second acquisition module 1022 is connected to the industrial control network 104 .
[0061] The first acquisition module 1021 is connected to the detection module 1023, so that the detection module 1023 can receive the first engineering parameter from the first acquisition module 1021; the second acquisition module 1022 is connected to the detection module 1023, so that the detection module 1023 can receive the second engineering parameter from the second acquisition module 1022; the first acquisition module 1021 is connected to the target operator station 1011, so that the first acquisition module 1021 can acquire the first engineering parameter from the target operator station 1011; at the same time, the second acquisition module 1022 is connected to the industrial control network 104, so that the second acquisition module 1022 can acquire the second engineering parameter from the industrial control network 104.
[0062] In some embodiments, the first engineering parameter and the second engineering parameter may be one or more.
[0063] For example, when the target device in the system is to control a motor, the first engineering parameter is the motor speed Y and the current X, and the second engineering parameter is the actual motor speed Y' and the actual current X'.
[0064] In some embodiments, the detection module 1023 includes a processor and a memory, wherein the memory stores a logical operation relationship, and the processor can substitute the received data into the logical operation relationship for operation processing.
[0065] After acquiring the first engineering parameter and the second engineering parameter, the detection module 1023 calls the logical operation relationship through the processor to perform operation processing on the received first engineering parameter and the second engineering parameter to determine whether the logical relationship between the first engineering parameter and the second engineering parameter satisfies the logical operation relationship. If not, it is determined that the target operator station 1011 is hijacked; if so, it is determined that the target operator station 1011 is not hijacked.
[0066] For example, when the target device in the system is to control a motor, the logical operation relationship is as follows:
[0067] Y'=F(X)=aX;
[0068] Y = φ(Y') = bX;
[0069] X = θ(X') = cX;
[0070] Y' = G(X') = dX;
[0071] Among them, a, b, c, and d are all constants.
[0072] When the logic operation relationship between the motor speed Y and current X and the real motor speed Y' and real current X' does not satisfy the above logic operation relationship, it is determined that the target operator station is hijacked; otherwise, it is determined that the target operator station is not hijacked.
[0073] In some embodiments, the logical operation relational expression may be input into the memory for storage by manual input or automatic parsing of the engineering configuration file.
[0074] In some embodiments, the first acquisition module 1021 is connected to an image output interface of the target operator station 1011 , and / or the first acquisition module 1021 is connected to a data interface of the target operator station 1011 .
[0075] When the first acquisition module 1021 is connected to the image output interface of the target operator station 1011, the first acquisition module 1021 can acquire the picture data of the display screen of the target operator station 1011, and then acquire the first engineering parameter by means of picture recognition; when the first acquisition module 1021 is connected to the data interface of the target operator station 1011, the first acquisition module 1021 can directly acquire the first engineering parameter of the target operator station 1011.
[0076] In some embodiments, the data interface is an application programming interface. Generally, an application programming interface generally refers to an interface for acquiring or transmitting various related data.
[0077] Figure 3 A schematic diagram of the structure of a second acquisition module in a network hijacking determination device provided in an embodiment of the present application. Figure 3 The second acquisition module 1022 includes a connected parameter acquisition submodule 10221 and a parameter parsing submodule 10222.
[0078] Among them, the parameter acquisition submodule 10221 is connected to the industrial control network 104, and the parameter analysis submodule 10222 is connected to the detection module 1023.
[0079] By connecting the parameter acquisition submodule 10221 to the industrial control network 104, the second engineering parameter can be obtained from the industrial control network 104; after the parameter parsing submodule 10222 performs protocol parsing on the second engineering parameter, the parameter parsing submodule 10222 can send the second engineering parameter after protocol parsing to the detection module 1023 for further detection.
[0080] In some embodiments, the parameter parsing submodule 10222 may be a deep packet inspection module. Generally, a deep packet inspection module generally refers to a module for receiving binary data and performing protocol parsing on the binary data.
[0081] Since the second engineering parameters acquired by the parameter acquisition submodule 10221 from the industrial control network 104 are all binary data, the parameter parsing submodule 10222 needs to perform protocol parsing on these binary data. After the parsing, the detection module 1023 can identify these second engineering parameters and then perform the detection process.
[0082] In some embodiments, see Figure 1 The network hijacking determination system provided in the embodiment of the present application also includes an engineer station 105.
[0083] The engineering station 105 is connected to at least one process control station 103 via the industrial control network 104 .
[0084] Among them, the engineer station 105 is a special operator station, which has greater control authority than other operator stations 101. Therefore, the network hijacking determination system provided in the embodiment of the present application can also detect the engineer station 105 to determine whether the engineer station 105 is hijacked.
[0085] In some embodiments, see Figure 1 For any process control station 103 , the network hijacking determination system provided by the embodiment of the present application also includes at least one target device 106 .
[0086] At least one target device 106 is connected to the process control station 103 .
[0087] That is, each process control station 103 is connected to at least one target device 106 , and after receiving instructions from the operator station 101 , the process control station 103 controls the operation mode or working mode of the target device 106 connected to itself.
[0088] The embodiment of the present application also provides another system for determining network hijacking. Figure 4 A schematic diagram of the structure of another network hijacking determination system provided in an embodiment of the present application. Figure 4The network hijacking determination system 200 includes: at least one operator station 201, a network hijacking determination device 202 and at least one process control station 203.
[0089] At least one operator station 201 is connected to at least one process control station 203 via an industrial control network 204 , so that each operator station 201 can send instructions to the process control station 203 via the industrial control network 204 .
[0090] At least one operator station includes a target operator station 2011, and the network hijacking determination device 202 is located on one side of the target operator station 2011 and is configured to obtain a first engineering parameter of the target operator station 2011; the network hijacking determination device 202 is connected to the industrial control network 204, so that the network hijacking determination device 202 can obtain a second engineering parameter from the industrial control network 204.
[0091] The network hijacking determination device 202 is configured to obtain a first engineering parameter of the target operator station 2011; obtain a second engineering parameter of the industrial control network 204; detect the first engineering parameter and the second engineering parameter to obtain a detection result; in response to the detection result being different from a preset result, determine that the target operator station 2011 is hijacked.
[0092] Therefore, another network hijacking determination system provided by the embodiment of the present application is that since at least one operator station 201 is connected to at least one process control station 203 through the industrial control network 204, the operator station 201 can send instructions to the process control station 203 through the industrial control network 204. At the same time, the network hijacking determination device 202 is located on one side of the target operator station 2011 and is configured to obtain the first engineering parameter of the target operator station 2011, and is connected to the industrial control network 204 at the same time, so that the network hijacking determination device 202 can obtain the first engineering parameter from the target operator station 2011 and the second engineering parameter from the industrial control network 204, and then the first engineering parameter and the second engineering parameter can be detected, and the detection result can be obtained. If the detection result is different from the preset result, it is determined that the target operator station 2011 is hijacked. The network hijacking determination system provided by the embodiment of the present application replaces the process of detecting whether the operator station is hijacked by manual detection in the related art, and can automatically determine whether the network site is hijacked, thereby avoiding serious losses to the enterprise.
[0093] The structure of the network hijacking determination system 200 provided in the embodiment of the present application is further described below:
[0094] See also Figure 5In some embodiments, the network hijacking determination device includes a first acquisition module 2021 , a second acquisition module 2022 and a detection module 2023 .
[0095] Wherein, the first acquisition module 2021 and the second acquisition module 2022 are both connected to the detection module 2023;
[0096] The first acquisition module 2021 is also connected to the target operator station 2011 , and the second acquisition module 2022 is connected to the industrial control network 204 .
[0097] The first acquisition module 2021 is connected to the detection module 2023, so that the detection module 2023 can receive the first engineering parameter from the first acquisition module 2021; the second acquisition module 2022 is connected to the detection module 2023, so that the detection module 2023 can receive the second engineering parameter from the second acquisition module 2022; the first acquisition module 2021 is connected to the target operator station 2011, so that the first acquisition module 2021 can acquire the first engineering parameter from the target operator station 2011; at the same time, the second acquisition module 2022 is connected to the industrial control network 204, so that the second acquisition module 2022 can acquire the second engineering parameter from the industrial control network 204.
[0098] In some embodiments, the first engineering parameter and the second engineering parameter may be one or more.
[0099] For example, when the target device in the system is to control a motor, the first engineering parameter is the motor speed Y and the current X, and the second engineering parameter is the actual motor speed Y' and the actual current X'.
[0100] In some embodiments, the detection module 2023 includes a processor and a memory, wherein the memory stores a logical operation relationship, and the processor can substitute the received data into the logical operation relationship for operation processing.
[0101] After acquiring the first engineering parameter and the second engineering parameter, the detection module 2023 calls the logical operation relationship through the processor to perform operation processing on the received first engineering parameter and the second engineering parameter to determine whether the logical relationship between the first engineering parameter and the second engineering parameter satisfies the logical operation relationship. If not, it is determined that the target operator station 2011 is hijacked; if so, it is determined that the target operator station 2011 is not hijacked.
[0102] For example, when the target device in the system is to control a motor, the logical operation relationship is as follows:
[0103] Y'=F(X)=aX;
[0104] Y = φ(Y') = bX;
[0105] X = θ(X') = cX;
[0106] Y' = G(X') = dX;
[0107] Among them, a, b, c, and d are all constants.
[0108] When the logic operation relationship between the motor speed Y and current X and the real motor speed Y' and real current X' does not satisfy the above logic operation relationship, it is determined that the target operator station is hijacked; otherwise, it is determined that the target operator station is not hijacked.
[0109] In some embodiments, the logical operation relational expression may be input into the memory for storage by manual input or automatic parsing of the engineering configuration file.
[0110] See also Figure 6 In some embodiments, the first acquisition module includes a camera 20211 , which is located on one side of a display screen of the target operator station 2011 .
[0111] Since the first acquisition module includes camera 20211, and camera 20211 is located on one side of the display screen of the target operator station 2011, the first acquisition module can shoot the screen image on the display screen of the target operator station 2011 through camera 20211, and then obtain the first engineering parameter in the screen image through image recognition.
[0112] This acquisition method does not require the first acquisition module to be directly connected to the target operator station 2011, and can be applied to the situation where it is inconvenient for the network hijacking determination device to be directly connected to the target operator station 2011.
[0113] See also Figure 6 In some embodiments, the second acquisition module includes a connected parameter acquisition submodule 20221 and a parameter parsing submodule 20222.
[0114] Among them, the parameter acquisition submodule 20221 is connected to the industrial control network 204, and the parameter analysis submodule 20222 is connected to the detection module 2023.
[0115] In some embodiments, see Figure 4 The network hijacking determination system provided in the embodiment of the present application also includes an engineer station 205.
[0116] The engineering station 205 is connected to at least one process control station 203 via the industrial control network 204 .
[0117] Among them, the engineer station 205 is a special operator station, which has greater control authority than other operator stations 201. Therefore, the network hijacking determination system provided in the embodiment of the present application can also detect the engineer station 205 to determine whether the engineer station 205 is hijacked.
[0118] In some embodiments, see Figure 4 For any process control station 203 , the network hijacking determination system provided by the embodiment of the present application also includes at least one target device 106 .
[0119] At least one target device 206 is connected to the control station 203 .
[0120] That is, each process control station 203 is connected to at least one target device 206 , and after receiving instructions from the operator station 201 , the process control station 203 controls the operation mode or working mode of the target device 206 connected to itself.
[0121] It should be noted that the "several" and "at least one" mentioned in this article refer to one or more, and "multiple" and "at least two" refer to two or more. "And / or" describes the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.
[0122] In the description of the embodiments of the present application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection; it can be directly connected or indirectly connected through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.
[0123] In the present application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance. The term "plurality" refers to two or more than two, unless otherwise clearly defined.
[0124] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the present application disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only.
[0125] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.
Claims
1. A network hijacking determination system, characterized in that: The system comprises: at least one operator station, a network hijacking determination device and at least one process control station, The at least one operator station is connected to the at least one process control station via an industrial control network; The at least one operator station includes a target operator station, the target operator station is connected to the network hijacking determination device, and the network hijacking determination device is connected to the industrial control network; The network hijacking determination device is configured to obtain a first engineering parameter of a target operator station; obtain a second engineering parameter of an industrial control network; detect the first engineering parameter and the second engineering parameter to obtain a detection result; and in response to the detection result being different from a preset result, determine that the target operator station is hijacked.
2. The network hijacking determination system according to claim 1, characterized in that: The network hijacking determination device comprises a first acquisition module, a second acquisition module and a detection module. The first acquisition module and the second acquisition module are both connected to the detection module; The first acquisition module is also connected to the target operator station, and the second acquisition module is connected to the industrial control network.
3. The network hijacking determination system according to claim 2, characterized in that: The second acquisition module includes a connected parameter acquisition submodule and a parameter analysis submodule. The parameter acquisition submodule is connected to the industrial control network, and the parameter analysis submodule is connected to the detection module.
4. The network hijacking determination system according to claim 2, characterized in that: The first acquisition module is connected to an image output interface of the target operator station, and / or the first acquisition module is connected to a data interface of the target operator station.
5. The network hijacking determination system according to claim 1, characterized in that: The system also includes an engineer station, The engineer station is connected to the at least one process control station via the industrial control network.
6. A network hijacking determination system, characterized in that: The system comprises: at least one operator station, a network hijacking determination device and at least one process control station, The at least one operator station is connected to the at least one process control station via an industrial control network; The at least one operator station includes a target operator station, the network hijacking determination device is located at one side of the target operator station and is configured to obtain a first engineering parameter of the target operator station; the network hijacking determination device is connected to the industrial control network; The network hijacking determination device is configured to obtain a first engineering parameter of a target operator station; obtain a second engineering parameter of an industrial control network; detect the first engineering parameter and the second engineering parameter to obtain a detection result; and in response to the detection result being different from a preset result, determine that the target operator station is hijacked.
7. The network hijacking determination system according to claim 6, characterized in that: The network hijacking determination device comprises a first acquisition module, a second acquisition module and a detection module. The first acquisition module and the second acquisition module are both connected to the detection module; The first acquisition module is also connected to the target operator station, and the second acquisition module is connected to the industrial control network.
8. The network hijacking determination system according to claim 7, characterized in that: The first acquisition module includes a camera, and the camera is located at one side of a display screen of the target operator station.
9. The network hijacking determination system according to claim 7, characterized in that: The second acquisition module includes a connected parameter acquisition submodule and a parameter analysis submodule. The parameter acquisition submodule is connected to the industrial control network, and the parameter analysis submodule is connected to the detection module.
10. The network hijacking determination system according to claim 6, characterized in that: The system also includes an engineer station, The engineer station is connected to the at least one process control station via the industrial control network.