Method and device for detecting stealth attack in control system

Abstract

Disclosed is an operating method of a stealth attack detection device, the method comprising the steps of: acquiring pieces of collection information branched from pieces of measurement information on the basis of the pieces of measurement information of a field device and a control system; preprocessing the pieces of collection information in time series; and detecting a stealth attack on the basis of the difference between the pieces of collection information, wherein the stealth attack detection device is network-separated from the field device and the control system.

Description

Method and device for detecting hidden attacks in a control system

[0001] The present disclosure relates to a method and apparatus for detecting a hidden attack in a control system, and in particular, to a method and apparatus for collecting information and detecting a hidden attack using a device in which the control system and the network are separated.

[0002] Recently, there has been a rapidly increasing trend of cyber attacks targeting Industrial Control Systems (ICS). In particular, starting from 2018, the number of disclosed vulnerabilities targeting industrial control systems has been continuously increasing, and as of November 2022, the ransomware reporting rate in the manufacturing sector reached 40.3% of the total reporting rate. As attacks on control networks in infrastructure or manufacturing industries intensify, there is a need to develop technologies capable of predicting and defending against such attacks.

[0003] The present disclosure is intended to provide a method and apparatus for detecting a hidden attack in a control system.

[0004] The present disclosure is intended to provide a method and apparatus for acquiring branched collected information based on measurement information of a field device and a control system.

[0005] The present disclosure is intended to provide a method and apparatus for detecting a stealth attack based on differences between collected information.

[0006] The present disclosure is intended to provide a method and apparatus for detecting a hidden attack based on display information of a control system.

[0007] The present disclosure is intended to provide a method and apparatus for detecting a stealth attack based on database information of a control system.

[0008] The present disclosure is intended to provide a method and apparatus for detecting a stealth attack based on standard information of a control system.

[0009] The present disclosure is intended to provide a hidden attack detection system in which the control system and the network are separated.

[0010] According to one aspect of the present disclosure, a method of operation of a hidden attack detection device is disclosed. The method comprises the steps of: acquiring collected information branched from measurement information based on measurement information of a field device and a control system; preprocessing the collected information in a time series; and detecting a hidden attack based on differences between the collected information, wherein the hidden attack detection device may be a device separated from the field device and the control system.

[0011] According to one embodiment of the present disclosure, the step of acquiring the collected information may include the step of acquiring a first collected information branched from the first measurement information based on the first measurement information acquired by the field device.

[0012] According to another embodiment of the present disclosure, the first collected information includes information branched from the first measurement information obtained by the field device using an information branching device, wherein the information branching device may be a device that separates the control system and the hidden attack detection device.

[0013] According to another embodiment of the present disclosure, the step of acquiring the collected information is,

[0014] Based on the display information of the control system, the method may include the step of obtaining second collected information branched from the display information.

[0015] According to another embodiment of the present disclosure, the second collected information includes information branched from the display information transmitted to the monitoring device of the control system using an information branching device, wherein the information branching device may be a device that separates the control system and the hidden attack detection device.

[0016] According to another embodiment of the present disclosure, the step of acquiring the collected information may include the step of acquiring a third collected information branched from the database information based on the database information of the control system.

[0017] According to another embodiment of the present disclosure, the third collected information includes information branched from the database information stored in the database of the control system, and may include at least one of the collection time, tag ID, and tag value of the database information.

[0018] According to another embodiment of the present disclosure, the step of acquiring the collected information may include acquiring a fourth collected information branched from information managed through the OPC (OLE for Process Control) interface of the control system.

[0019] According to another embodiment of the present disclosure, the step of detecting a stealth attack may include determining that a stealth attack exists when the collected information obtained from the field device and the collected information obtained from the control system are different.

[0020] According to another aspect of the present disclosure, a method of operating a hidden attack detection device is disclosed. The method comprises the steps of acquiring collected information based on measurement information of a field device and a control system, preprocessing the collected information in a time series, and detecting a hidden attack based on differences between the collected information, wherein the hidden attack detection device may be a device separated from the field device and the control system.

[0021] According to one embodiment of the present disclosure, the step of acquiring the collected information may include the step of acquiring the first collected information converted into an image through an imaging device based on the first measurement information acquired by the field device.

[0022] According to another embodiment of the present disclosure, the first collected information includes the first measurement information displayed by the field device, wherein the imaging device may be a device separated from the control system.

[0023] According to another embodiment of the present disclosure, the step of acquiring the collected information may include the step of acquiring second collected information converted into an image through an imaging device based on the display information of the control system.

[0024] According to another embodiment of the present disclosure, the second collected information includes the display information displayed on a monitoring device of the control system, wherein the imaging device may be a device separated from the control system.

[0025] According to the embodiments of the present disclosure, detection of a hidden attack can be effectively performed.

[0026] FIG. 1 is a schematic diagram illustrating a hidden attack detection system according to one embodiment of the present disclosure.

[0027] FIG. 2 illustrates the configuration of a device according to one embodiment of the present disclosure.

[0028] Figure 3 illustrates an example of a stealth attack scenario.

[0029] Figure 4 illustrates an example of a surface targeted for a stealth attack.

[0030] FIG. 5 illustrates an example of a procedure for detecting a stealth attack according to one embodiment of the present disclosure.

[0031] FIG. 6 illustrates an example of a procedure for detecting a stealth attack according to another embodiment of the present disclosure.

[0032] FIG. 7 illustrates an example in which a hidden attack detection method according to one embodiment of the present disclosure is applied.

[0033] FIG. 8 illustrates an example of a hidden attack detection procedure for a field device according to one embodiment of the present disclosure.

[0034] FIG. 9 illustrates an example of a hidden attack detection procedure for a field device according to another embodiment of the present disclosure.

[0035] FIG. 10 illustrates an example of obtaining collected information from a field device according to one embodiment of the present disclosure.

[0036] FIG. 11 illustrates an example of obtaining collected information from a field device according to another embodiment of the present disclosure.

[0037] FIG. 12 illustrates an example of a procedure for obtaining collected information from a control system according to one embodiment of the present disclosure.

[0038] FIG. 13 illustrates an example of a procedure for obtaining collected information from a control system according to another embodiment of the present disclosure.

[0039] FIG. 14 illustrates an example of obtaining collected information from a control system according to one embodiment of the present disclosure.

[0040] FIG. 15 illustrates an example of obtaining collected information from a control system according to another embodiment of the present disclosure.

[0041] FIG. 16 illustrates an example of a procedure for obtaining collected information from a control system according to another embodiment of the present disclosure.

[0042] FIG. 17 illustrates an example of obtaining collected information from a control system according to another embodiment of the present disclosure.

[0043] FIG. 18 illustrates an example of a procedure for obtaining collected information from a control system according to another embodiment of the present disclosure.

[0044] FIG. 19 illustrates an example of a procedure for obtaining collected information from a control system according to another embodiment of the present disclosure.

[0045] The terms used in these embodiments have been selected to be as widely used and general as possible, taking into account the functions within these embodiments; however, these terms may vary depending on the intent of those skilled in the art, case law, the emergence of new technologies, etc. Additionally, in specific cases, the applicant has arbitrarily selected terms, and in such cases, their meanings will be described in detail in the relevant sections. Therefore, the terms used in these embodiments should be defined not merely by their names, but based on their meanings and the content throughout these embodiments.

[0046] The embodiments are subject to various modifications and may take various forms; therefore, some embodiments are illustrated in the drawings and described in detail. However, this is not intended to limit the embodiments to the specific disclosed forms, and it should be understood that the embodiments include all modifications, equivalents, and substitutions that fall within the spirit and scope of the embodiments. The terms used herein are for the description of the embodiments only and are not intended to limit the embodiments.

[0047] Unless otherwise defined, the terms used in these embodiments have the same meaning as generally understood by those skilled in the art to which these embodiments pertain. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and should not be interpreted in an ideal or overly formal sense unless explicitly defined in these embodiments.

[0048]

[0049] Recently, Operational Technology (OT), Internet of Things (IoT), and cloud-based IT technologies are being utilized in control networks not only in major infrastructure such as power generation facilities, ports, and railways, but also in industrial sites such as smart factories. As network connectivity expands in the IT-OT convergence environment, the mixing of IT systems and OT systems is increasing attack points.

[0050] Specifically, major attack methods on OT systems include infiltrating the enterprise's internet network, infiltrating the OT network, infecting control devices, or manipulating commands for field devices such as sensors. Accordingly, the present disclosure proposes a method for detecting stealth attacks in a control environment where OT and IT are combined.

[0051]

[0052] FIG. 1 is a schematic diagram illustrating a hidden attack detection system according to one embodiment of the present disclosure.

[0053] Referring to FIG. 1, the control system (100) may refer to a system in which a control environment combining an OT system and an IT system is implemented. For example, the control system (100) may refer to a network of control devices combining an OT system and an IT system to control infrastructure and industrial sites. The control system (100) may be accessible from the outside through an IT system. For example, the control system (100) may include, but is not limited to, a PC, a business server, a web server, and an ERP server (Enterprise Resource Planning server) that establish an IT system. Additionally, the control system (100) may include, but is not limited to, a PLC (Programmable Logic Controller), DCS (Distributed Control System), EWS (Engineering Workstation), OPC (OLE for Process Control), HMI (Human-machine Interface) that establish an OT system.

[0054] The field device (102) may refer to devices capable of operating through connection with the control system (102). For example, the field device (102) may include a device configured to collect, measure, or process information in a real environment. Specifically, the field device (102) may be configured to include a sensor to detect various physical or chemical information such as temperature, pressure, flow rate, location, humidity, and chemical composition. Additionally, the field device (102) may be configured to include an actuator to control the operation of an external environment or device, such as a motor, cylinder, valve, or pump. Furthermore, the field device (102) may be configured to include a data processing device, a communication module, or a control module to transmit collected information or process control signals.

[0055] The detection system (104) is a system capable of independently collecting information by being separated from the control system (100) and the field device (102). For example, the detection system (104) may be configured to acquire information from the control system (100) and / or the field device (102), and may include a device or server capable of detecting or determining the presence of a stealth attack based on the acquired information. Specifically, the detection system (104) may be configured to collect and analyze sensor data, log data, communication traffic, command signals, and other control-related information, and may be configured to detect abnormal behavior, abnormal patterns, unauthorized access, or potential attacks based on the collected information. Additionally, the detection system (104) may be configured to include a data processing module, an analysis server, a warning generation module, and a communication module, etc., to efficiently process the collected information and provide a response signal to the control system (100) or the field device (102) when necessary.

[0056] The detection system (104) may include a collection device (106). The collection device (106) may be physically or logically separated from the field device (102) and the control system (100) and configured to obtain information from the field device (102) or the control system (100). For example, the collection device (106) may obtain information from the field device (102) or the control system (100) using an information branching device such as an isolator, a splitter, or a signal distributor. Specifically, the collection device (106) may be configured to obtain sensor data, log data, communication traffic, command signals, and other control-related information collected by the field device (102). Additionally, the collection device (106) may be configured to obtain sensor data, log data, communication traffic, command signals, and other control-related information stored in or provided by the control system (100). For example, the collection device (106) may include a field device data collection device that collects information from a field device (102). Additionally, the collection device (106) may include a monitoring data collection device that collects display information of a control system (100). Additionally, the collection device (106) may include a tag storage data collector that collects database information of a control system (100). Furthermore, the collection device (106) may be configured to include a data processing module, a communication module, and a temporary storage device, etc., to efficiently process the collected information and transmit it to a detection device (108). Additionally, the collection device (106) may include a camera module, etc., capable of capturing a field device (102) or a display device of a control system (100). Meanwhile, the collection device (106) may be installed to correspond to each control level of the control system (100).Here, the control level may refer to the device-specific levels of a network structured model for connecting system control. Here, the structured model may be, for example, the Purdue Model.

[0057] The detection system (104) may include a detection device (108). The detection device (108) may refer to an external server that performs detection of a stealth attack. Specifically, the detection device (108) may refer to a server that analyzes collected information collected by a collection device (106) and determines whether a stealth attack has occurred in the control system (100) or the field device (102). Although not shown in the drawing, the detection device (108) may be configured to include a data processing module, an analysis server, a warning generation module, and a communication module, etc., to efficiently process the collected information and, when necessary, provide a response signal to the control system (100) or the field device (102).

[0058] Meanwhile, in FIG. 1, the collection device (106) and the detection device (108) are shown as being separated in hardware or logic, but are not limited thereto. It is understood that they can be combined and operated together under the premise that the control system (100) and the field device (102) and the network are separated.

[0059]

[0060] FIG. 2 illustrates the configuration of a device according to one embodiment of the present disclosure. The configuration of FIG. 2 may be the configuration of the collection device (106) and / or detection device (108) of FIG. 1.

[0061] Referring to FIG. 2, the device (200) may include a transceiver (202), a memory (204), and a processor (206).

[0062] The transceiver (202) is connected to the processor (206) to transmit and receive wireless signals.

[0063] The transceiver (202) may include a baseband circuit for processing wireless signals. For example, the transceiver (202) may include a short-range transceiver, a mobile transceiver, and a broadcast receiver.

[0064] Memory (204) is a functional configuration that stores various data processed by the processor (206) and stores a knowledge graph according to the present disclosure. Additionally, memory (204) can store applications, drivers, etc. to be driven by the processor (206). Memory (204) may include RAM (random access memory) such as DRAM (dynamic random access memory) and SRAM (static random access memory), ROM (read-only memory), EEPROM (electrically erasable programmable read-only memory), CD-ROM, Blu-ray or other optical disc storage, HDD (hard disk drive), SSD (solid state drive), or flash memory.

[0065] The processor (206) can control the overall function and operation of the device. The processor (206) may include an application-specific integrated circuit (ASIC), other chipsets, logic circuits, and / or data processing devices. According to an embodiment of the present disclosure, the processor (206) can acquire branched collected information based on measurement information of the field device and control system. For example, the processor (206) may be network-isolated from the field device and control system to acquire branched collected information based on measurement information of the field device and control system. Additionally, the processor (206) may preprocess the acquired collected information in a time series and determine whether a stealth attack has occurred based on the difference between the collected information.

[0066] Meanwhile, the device (200) may additionally be equipped with an additional device to perform the detection of a hidden attack according to the present disclosure. According to an embodiment, the device (200) may further include an imaging device such as a camera module.

[0067]

[0068] FIG. 3 illustrates an example of a stealth attack scenario. Specifically, FIG. 3 describes a scenario in which a stealth attack is attempted on a control system and a field device that combine an OT system and an IT system. Additionally, FIG. 3 describes the stealth attack scenario based on the Purdue model, but the present disclosure is not limited to stealth attack scenarios according to the Purdue model.

[0069] Referring to Figure 3, a hacker attempting a stealth attack can attempt to attack a PC or business server through the company's internet network. Specifically, malware can be installed on the IT system of the control system through phishing via email, etc. Additionally, the hacker can locate the target server for intrusion into the control system by scanning the DNS (Domain Name Server), etc. Furthermore, the hacker can steal credentials that allow access to the OT system of the control system. Additionally, the hacker can attempt to infect the IT system of the control system with malware using an infected laptop, USB, etc.

[0070] In addition, hackers can access OT systems by using stolen identities or through unauthorized APs. For example, hackers can access devices such as EWS, OPC, and HMI (Human-Machine Interface) PCs that can be connected to control devices such as PLCs and DCS, or install malware.

[0071] Furthermore, hackers can infect PLCs and DCSs using infected EWS and HMIs. Specifically, hackers can use infected EWSs to alter the configuration of control devices such as PLCs and DCSs. Additionally, hackers can use infected HMIs to transmit malicious commands to control devices such as PLCs and DCSs.

[0072] Consequently, hackers can use the aforementioned method to induce manipulation of field devices such as pumps, sensors, valves, and actuators. For example, a hacker can use the aforementioned stealth attack method to induce a malfunction in a field device while disguising the field device to appear as if it is operating normally within the control system, thereby preventing the operator of the control system from detecting the occurrence of a stealth attack. Furthermore, such stealth attacks can be carried out in various forms, such as modulating control signals, falsifying or altering sensor data, manipulating log data, or disguising communication traffic; consequently, this can not only disrupt the normal control flow of the control system and field devices but also have a significant impact on the stability and reliability of the entire industrial control network. Therefore, this disclosure proposes a method for detecting such stealth attacks. In particular, since stealth attacks occur through OT systems, this will be explained in detail below with reference to FIG. 4.

[0073]

[0074] Figure 4 illustrates an example of a stealth attack target surface. Figure 4 describes a stealth attack surface occurring in an OT system of a control system.

[0075] Referring to Fig. 4, an OT system can monitor the current situation through multiple sensors and control the operation of the physical system based on measured values ​​to operate the physical system efficiently and stably. Accordingly, the reliability of the measurements collected through multiple sensors is important for the normal operation of the physical system. Meanwhile, since sensors and actuators are physically difficult to access, attacks (Attack 1, Attack 2) between the physical system and the sensors, or against the sensors or actuators themselves, may be relatively more difficult compared to attacks on the OT system itself. However, for control systems such as OT systems that may be operated in a geographically distributed manner, it is difficult to fundamentally block access by attackers, and there may be cases where tracking is impossible because no digital records are left during the attack process. Consequently, such control systems can become primary targets for stealth attacks (Attack 3 to Attack 6). Furthermore, stealth attacks can not only cause field devices to malfunction but also deceive measurement information, thereby delaying the response of the control system operator as much as possible and maximizing physical damage. Accordingly, the present disclosure proposes a technical means to effectively identify hidden attacks on a control system and a field device by providing a detection method based on the relationship between a field device and a control system that is relatively less likely to be exposed to hidden attacks.

[0076]

[0077] Consequently, to detect a stealth attack on a control system, it is necessary to analyze the paths through which measurement information collected from sensors and transmitted to actuators is conveyed. Furthermore, to detect a stealth attack, it is necessary to compare information at key points where manipulation of the information can be determined. Accordingly, the present disclosure proposes a method for detecting a stealth attack on a control system by collecting measurement information from areas where an attacker can easily manipulate the information through a stealth attack and areas where it is relatively difficult to manipulate, and by comparing the collected information. Additionally, the present disclosure proposes a method for determining which device within the control system has been subjected to a stealth attack by comparing the information collected by area. Specifically, the present disclosure provides a method and apparatus for collecting information from corresponding devices at each level of a structured control system and detecting a stealth attack.

[0078]

[0079] FIG. 5 illustrates an example of a procedure for detecting a stealth attack according to one embodiment of the present disclosure. Hereinafter, the operating entity is described as a device, and may be, for example, the collection device (106) or the detection device (108) of FIG. 1. Alternatively, the operating entity of FIG. 5 may be understood as the detection system (104) itself, which combines the collection device (106) and the detection device (108) of FIG. 1.

[0080] Referring to FIG. 5, in step S501, the device acquires branched collected information based on measurement information from the field device and the control system. Here, the device is a device that is network-isolated from the field device and the control system. For example, the device can be network-isolated from the field device and the control system through an information branching device.

[0081] Specifically, the device can acquire collected information branched from measurement information measured by a field device by using an information branching device. Additionally, the device can acquire collected information based on measurement information transmitted to a control system. Specifically, the device can acquire collected information from measurement information transmitted to or stored in the control system. Collected information acquired from the control system can be acquired by branching from a measurement information transmission and reception path between devices within the control system. For example, collected information acquired from the control system can be branched using an information branching device and transmitted to the device. Meanwhile, the collected information acquired from the control system may further include, but is not limited to, at least one of a collection date and time, a tag ID, and a tag value corresponding to the measurement information.

[0082] In step S503, the device preprocesses the collected information into a time series. Specifically, the device preprocesses the collected information obtained from field devices and control systems into a time series. For example, the device may preprocess the collected information into a time series based on the collection date and time, tag ID, and tag value of the collected information obtained from the control system. Additionally, for example, the device may preprocess the collected information into a time series based on a predefined data format according to user settings or system settings.

[0083] In step S505, the device detects a stealth attack based on differences between collected information. Specifically, the device can determine whether a stealth attack has occurred in any device of the control system based on differences between collected information that has been preprocessed in a time series. Specifically, the device can determine whether a stealth attack has occurred by detecting the time when differences between the collected information occurred and the tag. Meanwhile, if the device determines that a stealth attack has occurred, it may provide an alarm to the control system, etc.

[0084]

[0085] FIG. 6 illustrates an example of a procedure for detecting a stealth attack according to one embodiment of the present disclosure. Hereinafter, the operating entity is described as a device, and may be, for example, the collection device (106) or the detection device (108) of FIG. 1. Alternatively, the operating entity of FIG. 6 may be understood as the detection system (104) itself, which combines the collection device (106) and the detection device (108) of FIG. 1.

[0086] Referring to FIG. 6, in step S601, the device acquires collected information based on measurement information from the field device and the control system. Here, the device is a device isolated from the field device and the control system. For example, the device may include a shooting device such as a camera.

[0087] Specifically, the device can acquire collected information from measurement information measured by a field device using a shooting device. For example, the device can acquire collected information based on measurement information displayed on a field device or a control system. Meanwhile, the collected information acquired from the control system may further include, but is not limited to, at least one of a collection date and time, a tag ID, and a tag value corresponding to the measurement information.

[0088] In step S603, the device preprocesses the collected information into a time series. Specifically, the device preprocesses the collected information obtained from field devices and control systems into a time series. For example, the device may preprocess the collected information into a time series based on the collection date and time, tag ID, and tag value of the collected information obtained from the control system. Additionally, for example, the device may preprocess the collected information into a time series based on a predefined data format according to user settings or system settings. Furthermore, for example, the device may generate an image from the collected information obtained as video, and collect tags at regular intervals through image enhancement and operation information tagging by image location.

[0089] In step S605, the device detects a stealth attack based on differences between collected information. Specifically, the device can determine whether a stealth attack has occurred in any device of the control system based on differences between collected information that has been preprocessed in a time series. Specifically, the device can determine whether a stealth attack has occurred by detecting the time when differences between the collected information occurred and the tag. Meanwhile, if the device determines that a stealth attack has occurred, it may provide an alarm to the control system, etc.

[0090]

[0091] FIG. 7 illustrates an example in which a hidden attack detection method according to one embodiment of the present disclosure is applied. FIG. 7 illustrates an example in which a hidden attack detection method according to the present disclosure is applied. FIG. 7 is described based on the Purdue model, but the control system model to which the detection method of the present disclosure is applied is not limited thereto.

[0092] Referring to FIG. 7, the devices acquire collected information from field devices and control devices and detect stealth attacks by comparing the collected information over time. The device may include a field device data collection device that collects information from field devices. Additionally, the device may include a monitoring data collection device that collects display information of a control system. Additionally, the collection device may include a tag storage data collector that collects database information of a control system.

[0093] For example, a field device data collector can acquire collected information based on measurement information from a Level 0 field device. The field device data collector may include a digital conversion module, an image enhancement module, an image tagging module, an OCR (Optical Character Recognition) module, a data transmission module, etc.

[0094] In addition, as an example, the monitoring data collector can obtain collected information from a Level 2 control system. For example, the monitoring data collector can obtain collected information branched from a path through which display information based on measurement information is transmitted. The monitoring data collector may include a video capture module, a video image extraction module, an image tagging module, an OCR module, and a data transmission module.

[0095] In addition, as an example, the tag storage data collector can obtain collected information from a Level 3 control system. For example, the tag storage data collector can obtain collected information including measurement information, collection time, tag ID, and tag value, etc., from a control system where measurement information is stored. Specifically, the tag storage data collector can obtain collected information from an OPC, Historian, etc. The tag storage data collector may include a tag storage module and a data transmission module, etc.

[0096]

[0097] FIG. 8 illustrates an example of a concealed attack detection procedure for a field device according to one embodiment of the present disclosure.

[0098] FIG. 8 illustrates an example of a procedure for detecting a stealth attack on a field device according to one embodiment of the present disclosure. Specifically, FIG. 8 illustrates a procedure for obtaining collected information from a field device to detect a stealth attack.

[0099] Referring to FIG. 8, in step S801, the device obtains branched collected information based on measurement information obtained by a field device. Here, the branched collected information is merely information branched from the measurement information and may be substantially identical to the measurement information of the field device. Specifically, the device may collect measurement information from field devices such as sensors and actuators. For example, the device may obtain measurement information in the form of analog or digital data through an isolator or a splitter.

[0100] In step S803, the device preprocesses the collected information. For example, if the collected information is analog, the device can convert it to digital. Additionally, for example, the device can arrange the collected information in a chronological order. That is, by converting the collected information into digital format and arranging it in a chronological order, the device enables information comparison between the field device and the control system.

[0101] In step S805, the device transmits the collected information to the detection device. The device may transmit the preprocessed collected information to the detection device. At this time, the measurement information measured by the field device can be transmitted to the control system as before through the information branching device.

[0102]

[0103] FIG. 9 illustrates an example of a procedure for detecting a stealth attack on a field device according to another embodiment of the present disclosure. Specifically, FIG. 9 illustrates a procedure for obtaining collected information from a field device to detect a stealth attack.

[0104] Referring to FIG. 9, in step S901, the device acquires collected information converted into an image based on measurement information acquired by a field device. Here, the collected information converted into an image can be understood as information captured from measurement information displayed on the field device. The device can collect measurement information displayed on field devices such as sensors and actuators. For example, the device can acquire collected information by capturing measurement information output to the field device itself or a separate display device as an image.

[0105] In step S903, the device preprocesses the collected information. For example, the device can generate an image from the collected information converted into video. In addition, the device can improve the resolution of the image through OCR. For example, the device can ensure the accuracy of subsequent analysis processes by using an artificial intelligence model to remove noise within the image, recognize visual patterns, or extract features.

[0106] In step S905, the device transmits the collected information to the detection device. The device may transmit the preprocessed collected information to the detection device.

[0107]

[0108] FIG. 10 illustrates an example of obtaining collected information from a field device according to one embodiment of the present disclosure.

[0109] Referring to FIG. 10, a device including a digital conversion module and a data transmission module can obtain information about pressure from a valve and information about temperature from a sensor. Here, the information measured by the valve and the sensor corresponds to the measured information.

[0110] The device can acquire collected information from measurement information using an isolator, etc. That is, the device is isolated from the valve and sensor. The device can convert the collected information obtained from the valve and sensor into digital form and transmit it to a device that detects hidden attacks. Specifically, the device can convert the collected information into digital form according to the conversion formula of the sensor and actuator. For example, if the collected information is digital, this process may be omitted. Meanwhile, the other side of the signal branched from the measurement information may be transmitted to a PLC.

[0111]

[0112] FIG. 11 illustrates an example of obtaining collected information from a field device according to another embodiment of the present disclosure.

[0113] Referring to FIG. 11, the device can obtain pressure information from a valve and temperature information from a sensor. Here, the information measured by the valve and the sensor corresponds to measurement information. Specifically, the device can obtain collected information by capturing the displayed measurement information using a shooting device. That is, the device obtains collected information using a shooting device such as a camera module, and is separated from the valve and the sensor. The device may include an image enhancement module, an image tagging module, an OCR module, and a data transmission module. Meanwhile, FIG. 8 is illustrated as being separated from the device including the shooting device and the image enhancement module, etc., but it is obvious that they can be combined and operated as a single device.

[0114] The device's image enhancement module and OCR module can generate an image from collected information obtained from video and improve the resolution of the image through OCR. In addition, the device's image tagging module can perform driving information tagging by location in the image and collect tags at regular intervals. The data transmission module can transmit the preprocessed collected information to a device that detects stealth attacks.

[0115]

[0116] FIG. 12 illustrates an example of a procedure for obtaining collected information from a control system according to one embodiment of the present disclosure.

[0117] Referring to FIG. 12, in step S1201, the device can obtain branched collected information based on display information of the control system. Specifically, the device can obtain branched collected information from a path through which display information is transmitted within the control system. Here, the display information may be information converted based on measurement information. The device can obtain collected information by branching display information transmitted to a monitoring device within the control system. As an example, the device can obtain collected information from display information transmitted from an HMI PC to an HMI monitor using a signal splitter.

[0118] In step S1203, the device can preprocess the collected information. For example, the device can extract images from the display information at specific intervals. Additionally, for example, the device can perform tagging based on the location of the extracted images. Specifically, the device can match specific areas within the images to operation information tags corresponding to the operating status of the field device. Furthermore, for example, the device can preprocess the collected information in a time series. That is, by converting the display information and arranging it in a time series, the device enables comparison with the information collected by the field device.

[0119] In step S1205, the device transmits the collected information to the detection device. The device may transmit the preprocessed collected information to the detection device. At this time, the display information may be transmitted to the control system as before through the data signal distributor.

[0120]

[0121] FIG. 13 illustrates an example of a procedure for obtaining collected information from a control system according to another embodiment of the present disclosure.

[0122] Referring to FIG. 13, in step S1301, the device can acquire collected information converted into an image based on the display information of the control system. The display information may be information converted to display measurement information. The collected information converted into an image can be understood as information captured from the measurement information displayed on the display device of the control system. The device can acquire the collected information converted into an image by capturing the display information visualized on the monitoring device of the control system. For example, the device can capture the display information displayed on the HMI monitor from the HMI PC using a shooting device such as a camera module and acquire the collected information converted into an image.

[0123] In step S1303, the device can preprocess the collected information. For example, the device can perform tagging on the collected information converted into an image. Specifically, the device can match a specific area of ​​the collected information converted into an image to an operation information tag corresponding to the operating status of the field device. In addition, for example, the device can preprocess the collected information in a time series. That is, by arranging the collected information converted into an image in a time series, the device enables comparison with the information collected by the field device. Furthermore, the device can improve the resolution of the collected information converted into an image through an image enhancement module.

[0124] In step S1305, the device transmits the collected information to the detection device. The device may transmit the preprocessed collected information to the detection device.

[0125]

[0126] FIG. 14 illustrates an example of obtaining collected information from a control system according to one embodiment of the present disclosure.

[0127] Referring to FIG. 14, the device can acquire display information transmitted from the HMI PC to the HMI monitor through a signal splitter. For example, the device can acquire display information transmitted from the HMI PC to the HMI monitor through the signal splitter by using a video capture module. The device can acquire video from the display information using the video capture module. At this time, the existing display information can be transmitted to the HMI monitor through the signal splitter. The device can extract images from the acquired video. For example, the device can extract images from the video using a video image extraction module. In addition, the device can tag operation information by location on the image and collect tags according to a predetermined period. For example, the device can use an image tagging module to match a specific area of ​​the image to an operation information tag corresponding to the operation status of the field device. The device can acquire collected information through the above-described process and transmit it to a detection device through a data transmission module.

[0128] Meanwhile, the device illustrated in FIG. 14 is exemplified as a combined form of multiple modules, but this is merely an example for convenience of explanation and is not necessarily limited to a form separated in hardware. That is, the multiple modules may be implemented separated in hardware, or they may be implemented separated logically within a single hardware.

[0129]

[0130] FIG. 15 illustrates an example of obtaining collected information from a control system according to another embodiment of the present disclosure.

[0131] Referring to FIG. 15, the device can capture display information displayed on an HMI monitor from an HMI PC using a capturing device such as a camera module and acquire collected information converted into an image. Additionally, the device can perform tagging on the collected information converted into an image. Specifically, the device can match a specific area of ​​the collected information converted into an image with an operation information tag corresponding to the operating status of the field device. Furthermore, as an example, the device can preprocess the collected information in a time series. That is, by arranging the collected information converted into an image in a time series, the device enables comparison with the information collected by the field device. In addition, the device can improve the resolution of the collected information converted into an image using an image enhancement module. At this time, the device can improve the resolution of text requiring identification in the collected information converted into an image using an OCR processor.

[0132] Meanwhile, the device illustrated in FIG. 15 is exemplified as a combined form of multiple modules, but this is merely an example for convenience of explanation and is not necessarily limited to a form separated in hardware. That is, the multiple modules may be implemented separated in hardware or logically separated within a single hardware. For example, the camera module, image enhancement module, image tagging module, OCR module, and data transmission module illustrated in FIG. 10 may operate in a single device.

[0133]

[0134] FIG. 16 illustrates an example of a procedure for obtaining collected information from a control system according to another embodiment of the present disclosure.

[0135] Referring to FIG. 16, in step S1601, the device obtains branched collection information based on database information of the control system. Specifically, the device can collect measurement information stored in the database of the control system. Additionally, the device can collect at least one of the collection time, tag ID, and tag value corresponding to the measurement information stored in the database. The device can collect information such as measurement information, collection time, tag ID, and tag value stored in the database based on a predetermined period.

[0136] In step S1603, the device preprocesses the collected information. For example, the device may preprocess the collected information obtained from a database into a time series. Additionally, for example, the device may preprocess the collected information based on a predefined data format according to user settings or system settings.

[0137] In step S1605, the device can transmit the collected information to the detection device. The device can transmit the preprocessed collected information to the detection device.

[0138]

[0139] FIG. 17 illustrates an example of obtaining collected information from a control system according to another embodiment of the present disclosure.

[0140] Referring to FIG. 17, the device can obtain collected information through database linkage from a database such as a historian or a tag repository. For example, the device can collect measurement information stored in a historian or a tag repository. Additionally, the device can collect at least one of a collection date and time, a tag ID, and a tag value corresponding to the measurement information stored in the historian or a tag repository. The device can collect information such as measurement information, collection date and time, a tag ID, and a tag value stored in the historian or a tag repository based on a predetermined period. Additionally, the device can store the acquired collected information. For example, the device can store and manage the acquired collected information based on tags using a tag storage module. The device can obtain the collected information through the process described above and transmit it to a detection device through a data transmission module.

[0141]

[0142] FIG. 18 illustrates an example of a procedure for obtaining collected information from a control system according to another embodiment of the present disclosure.

[0143] Referring to FIG. 18, in step S1801, the device obtains branched collected information based on standard information of the control system. Standard information may refer to information used by a device that substantially implements the standard protocol of the control system. For example, standard information may refer to information stored in an OPC interface that substantially implements the protocol according to OPC. According to an embodiment, devices constituting the OPC interface may manage information corresponding to measurement information obtained by a field device as standard information. That is, the device may obtain branched collected information based on measurement information managed in a standardized manner through the OPC interface.

[0144] In step S1803, the device preprocesses the collected information. For example, the device may preprocess the collected information obtained from the OPC interface in a time series. Additionally, for example, the device may preprocess the collected information based on a predefined data format according to user settings or system settings.

[0145] In step S1805, the device can transmit the collected information to the detection device. The device can transmit the preprocessed collected information to the detection device.

[0146]

[0147] FIG. 19 illustrates an example of a procedure for obtaining collected information from a control system according to another embodiment of the present disclosure. Referring to FIG. 19, the device may obtain collected information from an OPC. For example, the device may collect measurement information stored in an OPC server. The OPC server may be a server that substantially implements the standard protocol of the control system. Additionally, the device may collect at least one of a collection time, tag ID, and tag value corresponding to the measurement information stored in the OPC server. The device may collect information such as measurement information, collection time, tag ID, and tag value stored in the OPC server based on a predetermined period. Additionally, the device may store the obtained collected information. For example, the device may store and manage the obtained collected information based on tags using a tag storage module. The device may obtain the collected information through the process described above and transmit it to a detection device through a data transmission module.

[0148]

[0149] Meanwhile, those skilled in the art related to the present embodiment will understand that it may be implemented in modified forms without departing from the essential characteristics of the above description. Therefore, the disclosed methods should be considered in an illustrative rather than a restrictive sense. The scope of the present disclosure is defined by the claims, not by the foregoing description, and all variations within the scope of equivalence should be interpreted as being included in the present disclosure.

[0150] The present disclosure can be used in a device for detecting a stealth attack in a control system.

Claims

In a method of operation of a hidden attack detection device, A step of obtaining collected information branched from the measurement information based on the measurement information of the field device and control system; A step of preprocessing the above collected information into a time series; and The method includes a step of detecting a hidden attack based on the difference between the collected information above, The above-mentioned hidden attack detection device is a device network-isolated from the field device and the control system, a method. In paragraph 1, The step of acquiring the above-mentioned collected information is, A method comprising the step of obtaining first collected information branched from the first measurement information based on the first measurement information obtained by the field device. In paragraph 2, The above first collected information is, Using an information branching device, the information branched from the first measurement information obtained by the field device is included, The above information branching device is, A method in which the above control system and the above hidden attack detection device are a network separation device. In paragraph 1, The step of acquiring the above-mentioned collected information is, A method comprising the step of obtaining second collected information branched from the display information based on the display information of the control system. In paragraph 4, The above second collected information is, Using an information branching device, the information branched from the display information transmitted to the monitoring device of the control system is included, The above information branching device is, A method in which the above control system and the above hidden attack detection device are a network separation device. In paragraph 1, The step of acquiring the above-mentioned collected information is, A method comprising the step of obtaining third collected information branched from the database information based on the database information of the control system. In paragraph 6, The above third collected information is, It includes information branched from the database information stored in the database of the control system, A method comprising at least one of the collection date and time of the above database information, tag ID, and tag value. In paragraph 1, The step of acquiring the above-mentioned collected information is, A method comprising the step of obtaining a fourth collected information branched from information managed through the OPC (OLE for Process Control) interface of the control system. In paragraph 1, The step of detecting the above-mentioned stealth attack is, A method comprising the step of determining that a stealth attack exists when the collected information obtained from the field device and the collected information obtained from the control system are different. In a method of operation of a hidden attack detection device, A step of acquiring collected information based on measurement information of field devices and control systems; A step of preprocessing the above collected information into a time series; and The method includes a step of detecting a hidden attack based on the difference between the collected information above, The above-mentioned hidden attack detection device is a device network-isolated from the field device and the control system, a method. In Paragraph 10, The step of acquiring the above-mentioned collected information is, A method comprising the step of acquiring first collected information converted into an image through an imaging device based on first measurement information acquired by the above-mentioned field device. In Paragraph 11, The above first collected information is, The first measurement information displayed by the above-mentioned field device, comprising: The above imaging device is, A method in which the above-mentioned control system and network-separated device. In Paragraph 10, The step of acquiring the above-mentioned collected information is, A method comprising the step of acquiring second collected information converted into an image through an imaging device based on display information of the above-mentioned control system. In Paragraph 13, The above second collected information is, The display information displayed on the monitoring device of the above-mentioned control system, comprising: The above imaging device is a device separated from the control system and network. In Paragraph 10, The step of acquiring the above-mentioned collected information is, A method comprising the step of obtaining third collected information branched from the database information based on the database information of the control system. In paragraph 15, The above third collected information is, It includes information branched from the database information stored in the database of the control system, A method comprising at least one of the collection date and time of the above database information, tag ID, and tag value. In Paragraph 10, The step of acquiring the above-mentioned collected information is, A method comprising the step of obtaining a fourth collected information branched from information managed through the OPC (OLE for Process Control) interface of the control system. In Paragraph 10, The step of detecting the above-mentioned stealth attack is, A method comprising the step of determining that a stealth attack exists when the collected information obtained from the field device and the collected information obtained from the control system are different.

Images