Safety detection disposal system based on industrial control system

Abstract

The invention discloses a safety detection processing system based on an industrial control system, and relates to the technical field of safety detection processing systems.The safety detection processing system comprises a local control device operated through the internet, and a monitoring module is arranged in the local control device; the monitoring module comprises an industrial control security online monitoring module, a high-simulation attack and defense platform module and related security monitoring equipment, and the industrial control security online monitoring module is used for discovering potential security threats and vulnerabilities; the high-simulation attack and defense platform module is used for simulating attacks and defense measures possibly suffered by the industrial control system so as to carry out security evaluation and vulnerability analysis; the safe monitoring equipment is used for enhancing the safety protection capability of the industrial control system; according to the system, the security situation of the industrial internet can be perceived, tracked and analyzed, and related enterprises can be notified in time, so that people can master security threats and security risks of the internet, the threat disposal capability of the system is improved, and the security protection level of the industrial internet is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of safety detection and disposal systems, and in particular to a safety detection and disposal system based on an industrial control system. Background Art

[0002] The Industrial Internet is a new type of infrastructure, application model, and industrial ecosystem that deeply integrates the next-generation information and communication technology with the industrial economy. The Industrial Internet Security Detection Service and Disposal Platform detects and scans industrial assets exposed to the Internet, detects vulnerability information and security threats in Industrial Internet assets, assesses security risks of Industrial Internet assets and monitored enterprises, and realizes the awareness, tracking, and analysis of the Industrial Internet security situation. It promptly notifies relevant enterprises, grasps Internet security threats and security risks, improves the security threat handling capabilities of industrial enterprises, and enhances the security protection level of the Industrial Internet.

[0003] In recent years, industrial control systems have emphasized openness, but at the same time, a large number of IT vulnerabilities have been introduced into industrial control networks. Most industrial control network application layer protocols lack security protection measures, and there are unavoidable problems such as lack of strict identity identification and easy forgery of files. Therefore, industrial control systems are vulnerable to attacks that exploit vulnerabilities, causing industrial Internet processes to lose control or equipment to shut down.

[0004] On this basis, after searching the patent website, Chinese patent announcement number CN114978629A disclosed a security monitoring, early warning, and emergency response system based on the industrial Internet;

[0005] It can be seen that there are shortcomings in the above-mentioned patent application: the above-mentioned traditional Internet security monitoring and emergency response system has relatively simple functions, and the amount of calculated data is large, the system processing process is complex and the intelligent efficiency is poor. At present, most local infrastructure equipment will be equipped with security monitoring and emergency response systems, which can quickly alarm in emergency situations, but traditional alarm systems often only have the purpose of reminding local personnel and cannot notify other external units. When a large-scale fire occurs, the local area cannot notify the external fire department in time, and can only let the local control room handle it by itself. The traditional Internet security monitoring and emergency response system lacks the ability to handle emergency situations and cannot solve emergency events well, causing large economic losses and casualties, and reducing the system's handling efficiency.

[0006] In response to the above problems, a safety detection and disposal system based on industrial control system is proposed. Summary of the Invention

[0007] The purpose of the present invention is to provide a safety detection and disposal system based on an industrial control system, which works by adopting this system, thereby solving the problem in the above-mentioned background technology that most local infrastructure equipment is currently equipped with safety monitoring and emergency response systems, which can quickly alarm in emergency situations, but traditional alarm systems often only have the purpose of reminding local personnel and cannot notify other external units. When a large-scale fire occurs, the local area cannot notify the external fire department in time, and can only let the local control room handle it by itself. Traditional Internet security monitoring and emergency response systems lack the ability to handle emergency situations, cannot solve emergency events well, cause large economic losses and casualties, and reduce the system's handling efficiency.

[0008] To achieve the objectives of the present invention, the technical solutions provided by the present invention are as follows: a security detection and disposal system based on an industrial control system, the security detection and disposal system including a local control device operated by the Internet, the local control device being provided with a monitoring module, the monitoring module including an industrial control security online monitoring module, a high-simulation attack and defense platform module, and related security monitoring equipment, the industrial control security online monitoring module being used to monitor the security status of the industrial control system in real time and discover potential security threats and vulnerabilities; the high-simulation attack and defense platform module providing a high-simulation environment for simulating possible attacks and defense measures to the industrial control system, so as to conduct security assessments and vulnerability analysis; the security monitoring equipment may include an Internet firewall and an intrusion detection module, which are used to enhance the security protection capabilities of the industrial control system;

[0009] Preferably, the monitoring equipment may be a smoke sensor and an alarm, with multiple smoke sensors distributed among multiple devices arranged side by side. The smoke sensor is used to detect the smoke concentration in the environment surrounding the device. At the same time, the smoke sensor transmits a feedback signal to a local controller. The local controller is connected to the security center via the industrial Internet. The security center controls the movement of the local surveillance camera through a command transceiver module, and the images captured by the surveillance camera are transmitted to the security center via the Internet.

[0010] Preferably, the industrial control safety online monitoring module includes a test engine module, a state monitoring module, a state reset control module, and multiple restart modules externally connected to the industrial control safety detection platform; the test engine module is respectively connected to multiple devices under test, and is used to monitor according to the monitoring mechanism of each group of devices under test, and when it is monitored that there is an abnormality in the device under test, an alarm signal corresponding to the abnormal device under test is sent to the state reset control module;

[0011] Preferably, the industrial control system includes an intrusion detection module, an intrusion tracking module, a vulnerability detection module, a main control module, a vulnerability repair module, an early warning module and an isolation protection module;

[0012] Preferably, the intrusion detection module is connected to the intrusion tracking module for detecting industrial Internet intrusion information; the intrusion tracking module is respectively connected to the intrusion detection module and the main control module for tracking industrial Internet intrusion information;

[0013] Preferably, the vulnerability detection module is connected to the main control module and is used to detect Internet vulnerabilities; the vulnerability repair module is connected to the main control module and is used to repair industrial Internet vulnerabilities.

[0014] Preferably, the smoke sensor will sound an alarm through an alarm after detecting a smoke signal to remind local monitoring personnel. Four groups of monitoring cameras are provided, and the security center has a monitoring display screen. The monitoring display screen is used to display the images captured by the monitoring cameras, making it convenient for monitoring staff to monitor accident images in real time.

[0015] Preferably, the state reset control module is electrically connected to multiple restart module signals, and is used to control the restart module corresponding to the abnormal device under test by the alarm signal, change its own connectivity state to control the abnormal device under test to first cut off the power and then power on to restart, and the power supply ends of the multiple restart modules are connected to the power supply that supplies power to them.

[0016] Preferably, the state monitoring module further includes a process monitor for monitoring the process status of each device under test, and the state monitoring module is connected to the device under test via a network connection.

[0017] Preferably, the main control module is electrically connected to the intrusion detection module, the intrusion tracking module, the network vulnerability detection module, the vulnerability repair module, the early warning module, and the isolation protection module respectively, for controlling the normal operation of each module.

[0018] Preferably, the early warning module is electrically connected to the main control module for issuing early warnings for industrial Internet failures; the isolation protection module is electrically connected to the main control module for isolating industrial Internet intrusion information.

[0019] Preferably, the monitoring display screen is connected to the main control module for displaying intrusion detection information, tracking information, and vulnerability information.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] 1. The present invention provides a security detection and disposal system based on an industrial control system. The present invention monitors whether each device under test is abnormal in a test state. When a device under test is abnormal, the system controls the restart module corresponding to the abnormal device under test to change its own connectivity state to control the restart of the device under test. After the port status scanning module scans and obtains the port status of the device under test, the present invention can efficiently and automatically complete security testing to achieve industrial Internet security situation awareness, tracking and analysis, and timely notification to relevant enterprises. People can understand the security threats and risks of the Internet, improve the security threat handling capabilities of industrial enterprises, and enhance the security protection level of the industrial Internet.

[0022] 2. The system of the present invention is based on the open conditions of the industrial control system, and adds a security detection and disposal module on its basis, which can avoid the situation where a large number of IT vulnerabilities in the network are introduced into the industrial control network, so that the industrial control network application layer can take security protection measures to prevent the lack of strict identity identification and the easy forgery of files. The industrial control system is not easily attacked by vulnerabilities and will not cause the process of the industrial Internet to be out of control or the device to shut down. This system is convenient for users to select and test test cases conveniently and efficiently, realizes automated testing, has an extremely low error rate, and has high system work efficiency.

[0023] 3. When emergencies occur in various places, the present invention combines the handling of cloud professionals with the handling of on-site equipment and personnel to solve some emergencies more professionally. The present invention can control the monitoring camera to move toward the problem point through the cloud, and conduct all-round monitoring of the location where the accident occurred. By shooting and handling the information on the monitoring screen, the problem can be quickly discovered, and the emergency point can be handled more accurately, so that the Internet security monitoring and emergency handling system has the ability to deal with emergencies, can well solve emergency events, avoid large losses in the local area, improve the system handling efficiency and reduce the handling time, and respond to other security departments at the same time, quickly take early warning actions, and quickly solve problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is the overall structural diagram of the industrial control system-based safety detection and disposal system of the present invention. DETAILED DESCRIPTION

[0025] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0026] like Figure 1As shown, a security detection and disposal system based on an industrial control system includes a local control device operated by the Internet. The local control device is provided with a monitoring module. The monitoring module includes an industrial control security online monitoring module, a high-simulation attack and defense platform module, and related security monitoring equipment. The industrial control security online monitoring module is used to monitor the security status of the industrial control system in real time and discover potential security threats and vulnerabilities; the high-simulation attack and defense platform module provides a high-simulation environment for simulating possible attacks and defense measures on the industrial control system to facilitate security assessment and vulnerability analysis; the security monitoring equipment may include an Internet firewall and an intrusion detection module, which are used to enhance the security protection capabilities of the industrial control system.

[0027] Monitoring equipment can be smoke sensors and alarms. Multiple smoke sensors are distributed among multiple devices set up side by side. The smoke sensors are used to detect the smoke concentration in the environment around the equipment. At the same time, the smoke sensors transmit feedback signals to the local controller. The local controller is connected to the security center through the industrial Internet. The security center controls the movement of local surveillance cameras through the command transceiver module. The images captured by the surveillance cameras are transmitted to the security center via the Internet.

[0028] The industrial control safety online monitoring module includes a test engine module, a status monitoring module, a status reset control module, and multiple restart modules externally connected to the industrial control safety detection platform. The test engine module is connected to multiple devices under test and is used to monitor them according to the monitoring mechanism of each group of devices under test. When an abnormality is detected in a device under test, an alarm signal corresponding to the abnormal device under test is sent to the status reset control module.

[0029] The industrial control system includes intrusion detection module, intrusion tracking module, vulnerability detection module, main control module, vulnerability repair module, early warning module and isolation protection module;

[0030] The intrusion detection module is connected to the intrusion tracking module to detect industrial Internet intrusion information; the intrusion tracking module is connected to the intrusion detection module and the main control module respectively to track industrial Internet intrusion information;

[0031] The vulnerability detection module is connected to the main control module and is used to detect Internet vulnerabilities; the vulnerability repair module is connected to the main control module and is used to repair industrial Internet vulnerabilities.

[0032] When the smoke sensor detects a smoke signal, it will sound an alarm to remind local monitoring personnel. There are four groups of monitoring cameras, and the security center has a monitoring display screen. The monitoring display screen is used to display the images captured by the monitoring cameras, making it convenient for monitoring staff to monitor the accident images in real time.

[0033] The state reset control module is electrically connected to the signals of multiple restart modules, and is used to control the restart modules corresponding to the abnormal devices under test through alarm signals, changing its own connectivity state to control the abnormal devices under test to first power off and then power on for restart, and the power supply ends of the multiple restart modules are connected to the power supply that supplies power to them.

[0034] The status monitoring module also includes a process monitor for monitoring the process status of each device under test. The connection between the status monitoring module and the device under test is a network connection.

[0035] The main control module is electrically connected to the intrusion detection module, intrusion tracking module, network vulnerability detection module, vulnerability repair module, early warning module, and isolation protection module respectively, and is used to control the normal operation of each module.

[0036] The early warning module is electrically connected to the main control module and is used to provide early warning of industrial Internet failures; the isolation protection module is electrically connected to the main control module and is used to isolate industrial Internet intrusion information.

[0037] The monitoring display screen is connected to the main control module and is used to display intrusion detection information, tracking information, and vulnerability information.

[0038] In summary, the present invention provides a security detection and disposal system based on an industrial control system: The present invention provides a security detection and disposal system based on an industrial control system. The present invention monitors whether each device under test is abnormal in a test state. When an abnormality occurs in a device under test, the restart module corresponding to the abnormal device under test is controlled to change its own connectivity state to control the restart of the device under test. After the port status scanning module scans and obtains the port status of the device under test, the present invention can efficiently and automatically complete the security test to realize the awareness, tracking and analysis of the security situation of the industrial Internet, and promptly inform relevant enterprises. People can grasp the security threats and security risks of the Internet, improve the security threat handling capabilities of industrial enterprises, and enhance the security protection level of the industrial Internet.

[0039] The system of the present invention is based on the open conditions of the industrial control system and adds a security detection and disposal module on its basis. It can prevent a large number of IT vulnerabilities in the network from being introduced into the industrial control network. It enables the industrial control network application layer to take security protection measures to prevent the problem of lack of strict identity identification and easy forgery of files. The industrial control system is not easily attacked by vulnerabilities and will not cause the process of the industrial Internet to lose control or the device to shut down. This system facilitates users to select and test test cases conveniently and efficiently, realizes automated testing, has a very low error rate, and has high system efficiency.

[0040] When an emergency occurs in various places, the present invention combines the handling of cloud professionals with the handling of on-site equipment and personnel to solve some emergencies more professionally. The present invention can control the monitoring camera to move toward the problem point through the cloud, and conduct all-round monitoring of the location where the accident occurred. By shooting and handling the information on the monitoring screen, the problem can be quickly discovered, and the emergency point can be handled more accurately, so that the Internet security monitoring and emergency handling system has the ability to deal with emergencies, can well solve emergency events, avoid causing large losses to the local area, improve the system handling efficiency and reduce the handling time, and respond to other security departments at the same time, quickly take early warning actions, and quickly solve problems.

[0041] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0042] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

[0043] The above describes in detail the optional implementation methods of the embodiments of the present invention in conjunction with the accompanying drawings, but the embodiments of the present invention are not limited to the specific details in the above implementation methods. Within the technical concept of the embodiments of the present invention, various simple modifications can be made to the technical solutions of the embodiments of the present invention, and these simple modifications all fall within the scope of protection of the embodiments of the present invention.

Claims

1. A safety detection and disposal system based on an industrial control system, characterized in that: The security detection and disposal system includes a local control device operated by the Internet, wherein a monitoring module is provided in the local control device, and the monitoring module includes an industrial control security online monitoring module, a high-simulation attack and defense platform module, and related security monitoring equipment. The industrial control security online monitoring module is used to monitor the security status of the industrial control system in real time and discover potential security threats and loopholes; The high-simulation attack and defense platform module provides a high-simulation environment for simulating possible attacks and defense measures of the industrial control system, so as to conduct security assessment and vulnerability analysis; the security monitoring equipment may include an Internet firewall and an intrusion detection module, which is used to enhance the security protection capability of the industrial control system; The monitoring equipment may be a smoke sensor and an alarm. A plurality of smoke sensors are distributed among a plurality of devices arranged side by side. The smoke sensor is used to detect the smoke concentration in the surrounding environment of the equipment. At the same time, the smoke sensor transmits a feedback signal to a local controller. The local controller is connected to the security center through the industrial Internet. The security center controls the movement of the local monitoring camera through the command transceiver module. The images captured by the monitoring camera are transmitted to the security center via the Internet. The industrial control safety online monitoring module includes a test engine module, a state monitoring module, a state reset control module and a plurality of restart modules externally connected to the industrial control safety detection platform; the test engine module is respectively connected to a plurality of devices under test, and is used to monitor according to the monitoring mechanism of each group of devices under test, and when an abnormality is detected in the device under test, an alarm signal corresponding to the abnormal device under test is sent to the state reset control module; The industrial control system includes intrusion detection module, intrusion tracking module, vulnerability detection module, main control module, vulnerability repair module, early warning module and isolation protection module; The intrusion detection module is connected to the intrusion tracking module for detecting industrial Internet intrusion information; the intrusion tracking module is respectively connected to the intrusion detection module and the main control module for tracking industrial Internet intrusion information; The vulnerability detection module is connected to the main control module and is used to detect Internet vulnerabilities; the vulnerability repair module is connected to the main control module and is used to repair industrial Internet vulnerabilities.

2. The safety detection and disposal system based on the industrial control system according to claim 1 is characterized in that: After the smoke sensor detects the smoke signal, it will sound an alarm through the alarm to remind the local monitoring personnel. There are four groups of monitoring cameras. The security center has a monitoring display screen, which is used to display the pictures taken by the monitoring cameras, so that the monitoring staff can monitor the accident pictures in real time.

3. A safety detection and disposal system based on an industrial control system according to claim 2, characterized in that: The state reset control module is electrically connected to multiple restart module signals, and is used to control the restart module corresponding to the abnormal device under test through an alarm signal, so as to change its own connectivity state to control the abnormal device under test to first power off and then power on for restart, and the power supply ends of the multiple restart modules are connected to the power supply that supplies power to them.

4. The safety detection and disposal system based on the industrial control system according to claim 3 is characterized in that: The state monitoring module also includes a process monitor for monitoring the process state of each device under test. The state monitoring module is connected to the device under test through a network connection.

5. The safety detection and disposal system based on the industrial control system according to claim 4 is characterized in that: The main control module is electrically connected to the intrusion detection module, the intrusion tracking module, the network vulnerability detection module, the vulnerability repair module, the early warning module, and the isolation protection module, respectively, and is used to control each module to work normally.

6. The safety detection and disposal system based on the industrial control system according to claim 5 is characterized in that: The early warning module is electrically connected to the main control module and is used to warn of industrial Internet failures; The isolation protection module is electrically connected to the main control module and is used to isolate industrial Internet intrusion information.

7. A safety detection and disposal system based on an industrial control system according to claim 6, characterized in that: The monitoring display screen is connected to the main control module and is used to display intrusion detection information, tracking information, and vulnerability information.

Images