The invention discloses an industrial firewall device based on
time sequence atlas detection, which relates to the technical field of industrial
control network security and comprises the steps of protocol identification,
feature extraction,
time sequence atlas construction, baseline modeling, online detection and response protection. Extracting
time sequence characteristics such as a request-response relationship, a time interval and an
event sequence, and converting the time sequence characteristics into a time
sequence graph on which nodes correspond to communication events and edges correspond to time sequences; and generating a baseline map based on normal data, comparing the deviation between the current map and the baseline map in real-time communication, and executing a protection action after judging
abnormality. The device for realizing the method comprises a
data acquisition module, a
feature extraction module, an atlas modeling module, a detection analysis module, a protection response module, a man-
machine interaction module and a wide-
voltage power supply module which are electrically connected in sequence. According to the method and the device, hidden time sequence attacks can be accurately identified, multiple industrial protocols are supported, and the adaptive resource-limited
industrial equipment is designed in a lightweight manner.