Industrial control system security auditing method and system

By constructing a rule set on the relationship between task timing and expected resource consumption, and by parsing encrypted parameters, the problem of insufficient analysis of the correlation between task execution timing and resource consumption in existing technologies is solved, thus realizing efficient security auditing and intrusion detection for industrial control systems.

CN120930143AActive Publication Date: 2025-11-11CHONGQING HUATAI ACCOUNTING FIRM (GENERAL PARTNERSHIP)
4 Cites 4 Cited by

Patent Information

Application Number
CN202510993036.2
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-07-18
Publication Date
2025-11-11
Estimated Expiration
2045-07-18

AI Technical Summary

Technical Problem

Existing security auditing technologies in industrial control systems lack in-depth analysis of the inherent correlation between task execution timing and resource consumption, making it difficult to accurately judge normal system fluctuations and potential malicious interference. In particular, they cannot effectively identify local intrusion behavior when task execution times out but CPU utilization is abnormal.

Method used

Collect data on the cycle, timestamp, CPU usage, and memory usage of critical tasks in the real-time operating system; set task execution time boundaries and resource consumption envelopes; construct a rule set for the relationship between task timing characteristics and expected resource consumption; intercept encrypted function library call events through a function entry point replacement mechanism; parse encrypted parameters; generate a set of monitoring operation parameters; and identify anomalies through multi-dimensional comparison and association rules to trigger intrusion response measures.

Benefits of technology

It significantly improves the accuracy and depth of detection of industrial control systems, can identify abnormal combinations that are difficult to detect by traditional auditing methods, provides effective local security protection, and enhances the system's ability to resist complex local intrusions.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The invention relates to the technical field of security auditing, in particular to a security auditing method and system for an industrial control system, and the method comprises the following steps: aiming at a key control task, a communication task and a security task of a real-time operating system, collecting a period, a starting timestamp, a finishing timestamp, a central processing unit occupied time slice and peak memory usage amount data. According to the method, the period, timestamp, central processing unit occupation and memory usage data of a key task of a real-time operating system are collected, a task execution time boundary and a resource consumption envelope are set, and then an expected relation rule set of a task time sequence and resource consumption is constructed by applying historical data statistics and logic rule deduction; and meanwhile, the key length of symmetric and asymmetric encryption, initialization vector generation, hash algorithm selection, key derivation parameters and encryption operation context are stipulated, so that a comprehensive and specific ICS behavior specification baseline is established.
Need to check novelty before this filing date? Find Prior Art