The invention relates to the technical field of industrial safety, in particular to an industrial control
honeypot safety protection device and method. A
shadow system comprises an IP
simulation module, a flow transfer redirection module,
virtual switch software and a plurality of
virtual machine systems; a honeynet
system comprises a general protocol
simulation module, an industrial protocol
simulation module and a
honeypot management configuration module; an industrial
control equipment interface provides access to a PLC module, a DSC module, an RTU module, an OPC service,
SCADA equipment and HMI man-
machine interaction
system industrial
control equipment; and a safety
protection system comprises a log acquisition and analysis module, a flow acquisition and analysis module, an abnormal behavior analysis module, a
traceability evidence obtaining analysis module, a
system management module and a system
database module. The beneficial effects are that the device does not need to connecta network in series, does not need to configure a port flow
mirror image in a bypass manner, does not change the
physical network structure of a user, does not affect the network operation environment of the user, achieves the flexible deployment of the environment, and achieves plug-and-play.