Industrial Control Monitoring with Selective Active Probing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control systems lack effective security features, making them susceptible to network attacks as they transition from closed to open systems due to increased IT integration and outsourcing, posing a critical security risk to production processes.
Innovation Solution
A monitoring method and device that passively monitors network traffic, determines the necessity for active probing based on industrial device characteristics, and sends targeted network traffic to identify and analyze specific devices, combining passive and active monitoring to minimize disruption and maximize security awareness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If active probing is used to monitor industrial control systems, then device identification and network security monitoring are improved, but system disruption and network traffic increase
Solution Approach 1:
The system performs active probing only on selected target devices rather than all devices continuously. The monitoring device determines whether active probing is necessary based on device characteristics obtained from passive monitoring, applying partial action only where needed to minimize disruption while maintaining identification accuracy.
Solution Approach 2:
The system uses periodic passive monitoring to gather device characteristics, then performs active probing only when changes are detected or at scheduled intervals. This periodic approach balances the need for accurate device identification with minimizing continuous network disruption.
2Reliability
If comprehensive active monitoring is deployed, then security detection capability is improved, but network traffic and system load increase
Solution Approach 1:
The system applies active monitoring only to specific target devices identified through passive monitoring, rather than deploying comprehensive active monitoring across all devices. This selective approach maintains security detection capability while reducing overall network traffic volume.
Solution Approach 2:
Passive monitoring serves as an intermediary that first gathers device characteristics and identifies potential targets, then enables focused active probing. This intermediary step filters which devices require active monitoring, reducing unnecessary network traffic while maintaining security detection effectiveness.
3Productivity
If passive monitoring only is used, then system disruption is minimized, but device characteristics and security threats cannot be fully identified
Solution Approach 1:
The system merges passive monitoring and active probing into a hybrid monitoring approach. Passive monitoring continuously operates to maintain system continuity and gather basic device characteristics, while active probing is selectively applied to obtain deeper device information and identify security threats that passive monitoring alone cannot detect.
Solution Approach 2:
Passive monitoring performs preliminary gathering of device characteristics and identifies potential target devices before active probing is initiated. This preliminary action prepares the system to perform focused active monitoring only where needed, ensuring complete device characterization while minimizing disruption.
Data Source
AI summary
The present disclosure relates to a monitoring method, device and system for an industrial control system and a computer-readable medium. They are used to effectively monitor the industrial control system. The method includes: obtaining first network traffic transmitted in the industrial control system in a passive monitoring manner; determining whether it is necessary to monitor the industrial control system in an active probe manner according to characteristics of industrial devices in the industrial control system in the first network traffic; and upon determining it is necessary to monitor the industrial control system in an active probe manner, determining a target industrial device according to the characteristics of the industrial devices in the industrial control system in the first network traffic, sending third network traffic to the determined target industrial device, and obtaining second network traffic sent by the target industrial device in response to the third network traffic.