Industrial control network security dynamic defense system

Abstract

The invention discloses an industrial control network security dynamic defense system comprising a security monitoring module used for monitoring various activities and data traffic in an industrial control network in real time and discovering potential security threats in time; the dynamic strategy generation module can automatically generate dynamic defense strategies suitable for different safety conditions according to the information fed back by the safety monitoring module; the strategy execution module is responsible for executing the defense strategy generated by the dynamic strategy generation module so as to perform safety protection on the industrial control network; and the data storage module is used for storing the security monitoring data, the defense strategy and related data in the system operation process. According to the multi-dimensional monitoring, various activities and data traffic in the industrial control network are monitored in real time through a security monitoring module, multiple aspects such as network traffic, equipment states and user behaviors are covered, potential security threats can be found comprehensively and timely, and vulnerabilities possibly occurring in a single monitoring mode are effectively prevented.

Description

Technical Field

[0001] The present invention relates to dynamic security defense of industrial control network, and in particular to a dynamic security defense system of industrial control network. Background Art

[0002] With the continuous development of industrial automation and informatization, the importance of industrial control networks in industrial production has become increasingly prominent. However, industrial control networks are facing more and more security threats. Traditional industrial control network security protection methods often use a single monitoring method, such as only monitoring network traffic or only focusing on device status, which cannot fully and timely discover potential security threats. At the same time, traditional security protection strategies are usually static and difficult to adapt to the ever-changing security situation, resulting in limited system adaptability and protection capabilities.

[0003] In terms of threat response, traditional industrial control network security systems are not accurate enough in assessing security threats, making it difficult to determine the severity and type of threats, and thus unable to formulate targeted defense strategies. Moreover, strategy formulation often lacks scientificity, and cannot ensure that defense strategies match actual threats, making it difficult to effectively control security risks. In addition, traditional systems are slow in responding to security threats and are unable to take effective defense measures in a timely manner, which can easily lead to further spread of attacks and expansion of system failures.

[0004] In summary, the existing industrial control network security protection technology has many shortcomings and cannot meet the increasingly complex industrial control network security needs. Therefore, it is of great practical significance to develop an industrial control network security dynamic defense system that can achieve comprehensive security protection, precise threat response, and rapid response to threats. Summary of the invention

[0005] The technical problem to be solved by the present invention is to overcome the defects of the above-mentioned technologies and provide a dynamic defense system for industrial control network security.

[0006] To solve the above technical problems, the technical solution provided by the present invention is a dynamic defense system for industrial control network security: a security monitoring module is used to monitor various activities and data traffic in the industrial control network in real time and promptly discover potential security threats;

[0007] The dynamic strategy generation module can automatically generate dynamic defense strategies that adapt to different security conditions based on the information fed back by the security monitoring module;

[0008] The policy execution module is responsible for executing the defense strategy generated by the dynamic policy generation module to provide security protection for the industrial control network;

[0009] The data storage module is used to store security monitoring data, defense strategies, and related data during system operation.

[0010] As an improvement, the network traffic monitoring unit monitors and analyzes the data traffic in the industrial control network in real time to identify abnormal traffic patterns;

[0011] Equipment status monitoring unit monitors the operating status of various equipment in the industrial control network and promptly detects equipment failures or abnormalities;

[0012] The user behavior monitoring unit monitors the user's operation behavior in the industrial control network to prevent illegal operations by malicious users.

[0013] As an improvement, the threat assessment unit evaluates the security threats found by the security monitoring module and determines the severity and type of the threats;

[0014] The strategy formulation unit formulates corresponding dynamic defense strategies based on the threat assessment results.

[0015] As an improvement, an access control unit controls access to the industrial control network to prevent unauthorized access;

[0016] Intrusion detection and defense unit, which can detect intrusion behavior in time and take corresponding defense measures;

[0017] The vulnerability repair unit is responsible for repairing security vulnerabilities found in industrial control networks.

[0018] As an improvement, the data storage module adopts distributed storage technology to ensure the security and reliability of data.

[0019] As improvements, it also includes:

[0020] The visual management module is used to present security monitoring data and defense strategies to users in a visual manner to facilitate management and decision-making.

[0021] As an improvement, the data display unit displays security monitoring data and the execution of defense strategies in the form of charts, graphs, etc.;

[0022] The operation interface unit provides users with an operation interface for managing and configuring the system.

[0023] The advantages of the present invention compared with the prior art are: comprehensive safety protection:

[0024] Multi-dimensional monitoring: The security monitoring module monitors various activities and data flows in the industrial control network in real time, covering network flow, device status, user behavior and other aspects. It can comprehensively and timely discover potential security threats and effectively prevent loopholes that may arise from a single monitoring method.

[0025] Dynamic strategy generation: The dynamic strategy generation module automatically generates dynamic defense strategies that adapt to different security conditions based on the information fed back by the security monitoring module. This flexibility enables the system to quickly respond to changing security threats and improves the system's adaptability and protection capabilities.

[0026] Efficient policy execution: The policy execution module is responsible for executing the defense strategy generated by the dynamic policy generation module, including access control, intrusion detection and prevention, and vulnerability repair functions. It can provide all-round security protection for the industrial control network and ensure the stability and reliability of the system.

[0027] Precise threat response:

[0028] Accurate threat assessment: The threat assessment unit in the dynamic strategy generation module can accurately assess the security threats discovered by the security monitoring module and determine the severity and type of the threats. This provides an important basis for formulating targeted defense strategies and improves the effectiveness of defense strategies.

[0029] Scientific strategy formulation: The strategy formulation unit formulates corresponding dynamic defense strategies based on threat assessment results. This scientific strategy formulation method can ensure that the defense strategy matches the actual threat and minimize security risks.

[0030] Rapid response to threats: The system can respond quickly to security threats and take appropriate defensive measures in a timely manner. For example, when an intrusion is detected, the intrusion detection and prevention unit can immediately take defensive measures to prevent the further spread of the attack; when a device failure or abnormality is found, it can promptly notify maintenance personnel to carry out repairs to ensure the normal operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a schematic diagram of the industrial control network security dynamic defense system of the present invention.

[0032] Figure 2 It is a schematic diagram of a security monitoring module of the industrial control network security dynamic defense system of the present invention.

[0033] Figure 3 It is a schematic diagram of a dynamic strategy generation module of the industrial control network security dynamic defense system of the present invention.

[0034] Figure 4 It is a schematic diagram of a policy execution module of the industrial control network security dynamic defense system of the present invention.

[0035] Figure 5 It is a schematic diagram of a data storage module of the industrial control network security dynamic defense system of the present invention.

[0036] Figure 6It is a schematic diagram of a visualization management module of the industrial control network security dynamic defense system of the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0038] In the description of the embodiments of the present invention, it should be noted that if the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc. appear, the orientation or position relationship indicated is based on the orientation or position relationship shown in the drawings, or the orientation or position relationship in which the invented product is usually placed when used. It is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0039] In addition, the terms "horizontal", "vertical", "overhanging" and the like do not mean that the components must be absolutely horizontal or overhanging, but can be slightly tilted. For example, "horizontal" only means that its direction is more horizontal than "vertical", and does not mean that the structure must be completely horizontal, but can be slightly tilted.

[0040] In the description of the embodiments of the present invention, "plurality" means at least 2.

[0041] In the description of the embodiments of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal connection of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0042] Combined with the attached figure, the industrial control network security dynamic defense system, the security monitoring module is used to monitor various activities and data traffic in the industrial control network in real time, and promptly discover potential security threats;

[0043] The dynamic strategy generation module can automatically generate dynamic defense strategies that adapt to different security conditions based on the information fed back by the security monitoring module;

[0044] The policy execution module is responsible for executing the defense strategy generated by the dynamic policy generation module to provide security protection for the industrial control network;

[0045] The data storage module is used to store security monitoring data, defense strategies, and related data during system operation.

[0046] Network traffic monitoring unit, which monitors and analyzes data traffic in industrial control networks in real time and identifies abnormal traffic patterns;

[0047] Equipment status monitoring unit monitors the operating status of various equipment in the industrial control network and promptly detects equipment failures or abnormalities;

[0048] The user behavior monitoring unit monitors the user's operation behavior in the industrial control network to prevent illegal operations by malicious users.

[0049] The threat assessment unit evaluates the security threats found by the security monitoring module and determines the severity and type of the threats;

[0050] The strategy formulation unit formulates corresponding dynamic defense strategies based on the threat assessment results.

[0051] Access control unit, which controls access to the industrial control network to prevent unauthorized access;

[0052] Intrusion detection and defense unit, which can detect intrusion behavior in time and take corresponding defense measures;

[0053] The vulnerability repair unit is responsible for repairing security vulnerabilities found in industrial control networks.

[0054] The data storage module adopts distributed storage technology to ensure the security and reliability of data.

[0055] Also includes:

[0056] The visual management module is used to present security monitoring data and defense strategies to users in a visual manner to facilitate management and decision-making.

[0057] Data display unit, which displays security monitoring data and the implementation of defense strategies in the form of charts, graphs, etc.;

[0058] The operation interface unit provides users with an operation interface for managing and configuring the system.

[0059] When the present invention is implemented, 1. System installation and initialization:

[0060] First, select a suitable server or hardware device in the industrial control network environment to install this system. Make sure the hardware device meets the minimum requirements for system operation, including processor performance, memory capacity, storage capacity, etc.

[0061] Install system software, including security monitoring module, dynamic policy generation module, policy execution module, data storage module and visual management module. During the installation process, follow the installation wizard to ensure that each module is correctly installed and the relevant parameters are configured.

[0062] Perform system initialization settings. This includes setting network parameters such as IP address, subnet mask, gateway, etc. so that the system can communicate with the devices in the industrial control network. At the same time, set the distributed storage parameters of the data storage module to ensure the security and reliability of the data.

[0063] 2. Operation of the safety monitoring module:

[0064] Network traffic monitoring unit:

[0065] After the unit is started, it starts to monitor the data traffic in the industrial control network in real time. It captures network data packets by deploying traffic monitoring devices or software at key nodes of the network.

[0066] Analyze the captured data packets and extract traffic characteristics, such as packet size, source address, destination address, protocol type, etc.

[0067] Using machine learning algorithms or pre-defined rules, abnormal traffic patterns are identified. For example, if a certain IP address is found to send a large number of abnormal data packets in a short period of time, or the traffic suddenly increases beyond the normal range, it is considered abnormal traffic.

[0068] Once abnormal traffic is detected, the information is immediately fed back to the dynamic strategy generation module and the visual management module.

[0069] Equipment status monitoring unit:

[0070] The unit communicates with various devices in the industrial control network to obtain the operating status information of the devices. This can be achieved through the interfaces provided by the devices, such as SNMP (Simple Network Management Protocol), Modbus and other protocols.

[0071] The monitored device status includes the device's CPU usage, memory usage, hard disk space, network connection status, etc.

[0072] Check the device status regularly. If any device failure or abnormality is found, such as high CPU usage, insufficient memory, network connection interruption, etc., an alarm will be issued immediately and the information will be fed back to the dynamic policy generation module and the visual management module.

[0073] User behavior monitoring unit:

[0074] The unit prevents illegal operations by malicious users by monitoring user logins and operating behaviors in the industrial control network.

[0075] Record the user's login time, login location, operation content and other information.

[0076] Behavior analysis algorithms are used to determine whether user behavior is normal. For example, if a user is found to frequently log into the system during non-working hours or performs operations beyond their authority, it is considered abnormal behavior.

[0077] Once abnormal behavior is found, the user's further operations are immediately blocked and the information is fed back to the dynamic strategy generation module and the visual management module.

[0078] 3. Operation of dynamic strategy generation module:

[0079] Threat Assessment Unit:

[0080] When the security monitoring module finds a security threat, the threat assessment unit begins to assess the threat.

[0081] Analyze the severity of the threat. For example, determine the severity level of the threat based on factors such as the size of abnormal traffic, the scope of impact of equipment failure, and the potential harm of illegal user operations.

[0082] Identify the type of threat, such as network attack, device failure, user malicious behavior, etc.

[0083] Feedback the evaluation results to the strategy formulation unit.

[0084] Strategy Formulation Unit:

[0085] According to the results of the threat assessment unit, formulate corresponding dynamic defense strategies.

[0086] If it is a network attack, possible strategies may include blocking the IP address of the attack source, adjusting firewall rules, and launching an intrusion detection and prevention system.

[0087] If it is a device failure, possible strategies may include notifying maintenance personnel to perform repairs, starting backup equipment, adjusting the network topology, etc.

[0088] If it is malicious behavior by the user, possible strategies may include disabling the user account, strengthening user rights management, conducting security audits, etc.

[0089] Send the formulated strategy to the strategy execution module.

[0090] 4. Operation of the strategy execution module:

[0091] To access the control unit:

[0092] This unit controls access to the industrial control network based on the access control policy developed by the dynamic policy generation module.

[0093] You can limit unauthorized access by setting firewall rules, access control lists, etc.

[0094] Access to legitimate users is controlled based on their permissions to ensure that users can only access authorized resources.

[0095] Intrusion Detection and Prevention Unit:

[0096] The unit continuously monitors industrial control networks for intrusions.

[0097] Use intrusion detection system (IDS) and intrusion prevention system (IPS) technology to analyze network traffic in real time to detect whether there is any intrusion behavior.

[0098] If an intrusion is detected, appropriate defensive measures will be taken immediately, such as blocking the attack source, sending an alarm to notify the administrator, etc.

[0099] Bug Fixing Unit:

[0100] The unit regularly scans the devices in the industrial control network for vulnerabilities.

[0101] After discovering a vulnerability, the administrator will be notified in a timely manner and corresponding repair suggestions will be provided.

[0102] Security patches can be automatically downloaded and installed to fix known security vulnerabilities.

[0103] 5. Operation of data storage module:

[0104] The data storage module uses distributed storage technology to store security monitoring data, defense strategies, and related data during system operation on multiple storage nodes.

[0105] To ensure the security and reliability of data, technologies such as data encryption and backup can be used.

[0106] When historical data needs to be queried, the required data can be quickly retrieved from the storage module.

[0107] 6. Operation of the visual management module:

[0108] Data display unit:

[0109] Display security monitoring data and the execution status of defense strategies in the form of charts, graphs, etc.

[0110] For example, you can use a bar chart to show changes in network traffic, a pie chart to show the proportion of different types of security threats, and a line chart to show the changing trend of device status.

[0111] Users can intuitively understand the security status of the industrial control network through the visual interface.

[0112] Operation interface unit:

[0113] Provides an operating interface for users to manage and configure the system.

[0114] Users can set security monitoring parameters, adjust defense strategies, view system logs, etc. through the operation interface.

[0115] The operating interface should be simple and clear, easy to operate, and convenient for users to manage and make decisions.

[0116] 7. System maintenance and update:

[0117] Regularly maintain the system, including checking the operating status of hardware devices, cleaning up storage data, optimizing system performance, etc.

[0118] Update system software promptly to fix known security vulnerabilities and improve system functions.

[0119] Conduct security audits on the system to check the security and compliance of the system.

[0120] Train users to improve their safety awareness and operating skills and ensure the correct use of the system.

[0121] Comprehensive security protection:

[0122] Multi-dimensional monitoring: The security monitoring module monitors various activities and data flows in the industrial control network in real time, covering network flow, device status, user behavior and other aspects. It can comprehensively and timely discover potential security threats and effectively prevent loopholes that may arise from a single monitoring method.

[0123] Dynamic strategy generation: The dynamic strategy generation module automatically generates dynamic defense strategies that adapt to different security conditions based on the information fed back by the security monitoring module. This flexibility enables the system to quickly respond to changing security threats and improves the system's adaptability and protection capabilities.

[0124] Efficient policy execution: The policy execution module is responsible for executing the defense strategy generated by the dynamic policy generation module, including access control, intrusion detection and prevention, and vulnerability repair functions. It can provide all-round security protection for the industrial control network and ensure the stability and reliability of the system.

[0125] Precise threat response:

[0126] Accurate threat assessment: The threat assessment unit in the dynamic strategy generation module can accurately assess the security threats discovered by the security monitoring module and determine the severity and type of the threats. This provides an important basis for formulating targeted defense strategies and improves the effectiveness of defense strategies.

[0127] Scientific strategy formulation: The strategy formulation unit formulates corresponding dynamic defense strategies based on threat assessment results. This scientific strategy formulation method can ensure that the defense strategy matches the actual threat and minimize security risks.

[0128] Rapid response to threats: The system can respond quickly to security threats and take appropriate defensive measures in a timely manner. For example, when an intrusion is detected, the intrusion detection and prevention unit can immediately take defensive measures to prevent the further spread of the attack; when a device failure or abnormality is found, it can promptly notify maintenance personnel to carry out repairs to ensure the normal operation of the system.

[0129] Reliable Data Storage:

[0130] Distributed storage technology: The data storage module adopts distributed storage technology to ensure the security and reliability of data. Distributed storage can store data in multiple storage nodes, avoiding the risk of single point failure and improving data availability and durability.

[0131] Data security: Data encryption, backup and other technologies are used to further ensure the security of stored data. Even in the event of an attack or data loss, data can be quickly restored to ensure the normal operation of the system.

[0132] Convenient management and decision-making:

[0133] Visual management: The visual management module presents security monitoring data and defense strategies to users in a visual way, making it easier for users to manage and make decisions. Users can understand the security status of the system through intuitive charts and graphs, make decisions quickly, and improve management efficiency.

[0134] Friendly operation interface: The operation interface unit provides users with an operation interface for system management and configuration. The interface is concise and easy to operate. Users can easily set security monitoring parameters, adjust defense strategies, view system logs, etc., which improves the user experience.

[0135] Wide applicability:

[0136] Applicable to various industrial control networks: The system is applicable to industrial control networks of different sizes and types, and can meet the security needs of different industries and fields. Whether it is an industrial automation production line, energy system or traffic control system, effective security protection can be achieved through this system.

[0137] Compatible with multiple devices and protocols: The system is compatible with various industrial control equipment and communication protocols, and has good compatibility and scalability. It can be seamlessly integrated with existing industrial control network equipment without large-scale equipment transformation and upgrading, reducing the implementation cost of the system.

[0138] The present invention and its embodiments are described above, and such description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if ordinary technicians in the field are inspired by it, without departing from the purpose of the invention, they can design a structure and embodiment similar to the technical solution without creativity, which should belong to the protection scope of the present invention.

Claims

1. Industrial control network security dynamic defense system, characterized by: Security monitoring module, used to monitor various activities and data traffic in the industrial control network in real time, and promptly detect potential security threats; The dynamic strategy generation module can automatically generate dynamic defense strategies that adapt to different security conditions based on the information fed back by the security monitoring module; The policy execution module is responsible for executing the defense strategy generated by the dynamic policy generation module to provide security protection for the industrial control network; The data storage module is used to store security monitoring data, defense strategies, and related data during system operation.

2. The industrial control network security dynamic defense system according to claim 1 is characterized by: Network traffic monitoring unit, which monitors and analyzes data traffic in industrial control networks in real time and identifies abnormal traffic patterns; Equipment status monitoring unit monitors the operating status of various equipment in the industrial control network and promptly detects equipment failures or abnormalities; The user behavior monitoring unit monitors the user's operation behavior in the industrial control network to prevent illegal operations by malicious users.

3. The industrial control network security dynamic defense system according to claim 2 is characterized by: The threat assessment unit evaluates the security threats found by the security monitoring module and determines the severity and type of the threats; The strategy formulation unit formulates corresponding dynamic defense strategies based on the threat assessment results.

4. The industrial control network security dynamic defense system according to claim 3 is characterized by: Access control unit, which controls access to the industrial control network to prevent unauthorized access; Intrusion detection and defense unit, which can detect intrusion behavior in time and take corresponding defense measures; The vulnerability repair unit is responsible for repairing security vulnerabilities found in industrial control networks.

5. The industrial control network security dynamic defense system according to claim 4 is characterized by: The data storage module adopts distributed storage technology to ensure the security and reliability of data.

6. The industrial control network security dynamic defense system according to claim 5 is characterized by: Also includes: The visual management module is used to present security monitoring data and defense strategies to users in a visual manner to facilitate management and decision-making.

7. The industrial control network security dynamic defense system according to claim 6 is characterized by: Data display unit, which displays security monitoring data and the implementation of defense strategies in the form of charts, graphs, etc.; The operation interface unit provides users with an operation interface for managing and configuring the system.

Images