Computer virus detection system without depending on antivirus software

Abstract

The invention relates to a computer virus detection system without depending on antivirus software, which comprises an abnormal data sample acquisition module for acquiring an abnormal sample from an abnormal data sample source and recording the abnormal sample; the data acquisition module is used for acquiring operation data in the industrial control network system; and the detection module is used for comparing the similarity between the operation data in the industrial control network system and the recorded abnormal sample, and marking the industrial control network equipment where the operation data with the similarity exceeding a preset value is located as abnormal industrial control network equipment. By comparing the similarity between the operation data and the abnormal sample in the industrial control network system, the overall security of the industrial control network system can be improved, and the method does not depend on the support of a virus library in antivirus software, so that the industrial control network system has higher adaptability when facing novel viruses.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a system for detecting computer viruses without relying on anti-virus software. Background Art

[0002] With the increasing adoption and promotion of intelligent and digitally intelligent equipment, and the increasing use of edge computing and real-time databases in industrial control, information security issues within industrial control networks have become increasingly prominent. First, antivirus software is often not installed on industrial control systems. Second, even if antivirus software is installed, virus databases often cannot be updated because most industrial control systems lack internet connectivity. Using removable storage media for offline updates also presents the risk of virus infection. Viruses can hide in the system, making them difficult to detect and troubleshoot, leading to intermittent communication and even disrupting production control, resulting in reduced product quality and output. Once an industrial control system is infected with a virus, the impact on production is significant, making research on reliable and effective virus detection within the system a top priority. Summary of the Invention

[0003] To solve the above problems, an object of the embodiments of the present invention is to provide a system for detecting computer viruses without relying on anti-virus software.

[0004] A system for detecting computer viruses without relying on anti-virus software, comprising:

[0005] The abnormal data sample acquisition module is used to obtain abnormal samples from the abnormal data sample source and record them;

[0006] Data acquisition module, used to obtain operating data in the industrial control network system;

[0007] The detection module is used to compare the similarity between the operating data in the industrial control network system and the recorded abnormal samples, and mark the industrial control network devices where the operating data with similarity exceeding a preset value is located as abnormal industrial control network devices.

[0008] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0009] The present invention relates to a system for detecting computer viruses without relying on antivirus software. Compared with the existing technology, the present invention not only improves the overall security of the industrial control network system by comparing the similarity between operating data and abnormal samples in the industrial control network system, but also does not rely on the support of the virus library in the antivirus software, making the industrial control network system more adaptable when facing new viruses.

[0010] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0012] Figure 1 This is a schematic diagram of a system for detecting computer viruses without relying on anti-virus software in an embodiment provided by the present invention. DETAILED DESCRIPTION

[0013] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like to indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0014] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature identified as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0015] In the present invention, unless otherwise expressly specified or limited, the terms "mounted," "connected," "connect," "fixed," etc. should be understood broadly. For example, they may refer to fixed, detachable, or integral connections; mechanical or electrical connections; direct or indirect connections through an intermediary; or internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0016] A system for detecting computer viruses without relying on anti-virus software, comprising:

[0017] The abnormal data sample acquisition module is used to obtain abnormal samples from the abnormal data sample source and record them;

[0018] Data acquisition module, used to obtain operating data in the industrial control network system;

[0019] The detection module is used to compare the similarity between the operating data in the industrial control network system and the recorded abnormal samples, and mark the industrial control network devices where the operating data with similarity exceeding a preset value is located as abnormal industrial control network devices.

[0020] like Figure 1 As shown, the present invention first uses an abnormal data sample acquisition module 10 to regularly acquire samples from a specific abnormal data sample source 11 and record them in an abnormal sample recording unit 12. Then, an abnormal data analysis module 20 is used to perform analysis. First, the data acquisition module 21 is used to obtain sufficient operating data from the industrial control network system. Then, the detection module 22 is used to detect and compare the data in the abnormal sample recording unit 12 to detect abnormal industrial control network devices.

[0021] In practical applications, this method first analyzes security incidents such as illegal outbound malicious IP addresses or domain names, Trojan attacks involving abnormal port access, and mining, as reported in network security advisories issued by trusted organizations, and records any abnormal data. A separate computer is then installed with network packet acquisition and analysis software, connected to the industrial control system's switch, and configured with the appropriate IP address. The packet acquisition and analysis software is used to capture all data forwarded by the switch. After a period of acquisition, all data is recorded. Once abnormal behavior is detected, the device can be determined to be infected with a virus.

[0022] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0023] 1. The present invention provides a technology for detecting computer viruses without relying on anti-virus software. It is easy to operate, novel in design, and versatile. It can adapt to all systems that use network devices without making any changes to the original system. At the same time, since the present invention only performs network monitoring, it will not cause an increase in the load on software and hardware devices such as computers, servers, and switches. When needed, it is only necessary to connect the network cable to the spare port of the switch of the corresponding device, start the network data packet acquisition and analysis software for a period of time, save the records, and compare them with the threat information released by the trusted organization. It solves the problem of difficulty in finding viruses in industrial control systems. The results are clear and concise, which effectively guarantees the stable operation of the industrial control system.

[0024] 2. The present invention has a simple structure, is easy to operate, has low cost, and has good applicability. It is applicable to various private networks and solves the complex problem of virus detection in control systems in industrial production, reducing implementation costs and improving work efficiency. If a virus breaks out on a production line, it is difficult to detect and recover from it. Roughly speaking, if there are three downtimes per year, each lasting 30 minutes, each production line can reduce downtime by more than 90 minutes per year. Large factories generally have at least 10 production lines, so this can reduce downtime by more than 900 minutes. Based on the single production line of thick and wide plates, it can create a profit of approximately 10 million yuan per year, which is a very considerable benefit.

[0025] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technical solution that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A system for detecting computer viruses without relying on anti-virus software, characterized in that: include: The abnormal data sample acquisition module is used to obtain abnormal samples from the abnormal data sample source and record them; A data acquisition module is used to acquire operation data in the industrial control network system; The detection module is used to compare the similarity between the operating data in the industrial control network system and the recorded abnormal samples, and mark the industrial control network devices where the operating data with similarity exceeding a preset value is located as abnormal industrial control network devices.

Images