Industrial Control Safety Monitoring for Unknown Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing safety monitoring systems for industrial control systems are limited in detecting unknown abnormal behaviors as they rely on preset rules and have poor real-time performance due to the need to analyze large amounts of network flow data.
Innovation Solution
A method that performs time statistics on data generated during industrial control system operations, allowing for the detection of abnormal behaviors by observing changes over time, with user-selectable data ranges for further analysis, combining automatic analysis with user judgment to reduce data processing and enhance accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If rule-based automatic analysis engine is used with preset rules, then known attacks and abnormal behaviors can be identified, but unknown attacks and abnormal behaviors cannot be identified
Solution Approach 1:
The system dynamically adapts its detection capabilities by combining static rule-based analysis with dynamic machine learning models that continuously learn from new data, enabling the system to evolve its detection patterns and identify both known and unknown threats
Solution Approach 2:
The monitoring system performs multiple functions simultaneously: it executes preset rules for known threat detection while also employing machine learning algorithms to discover unknown abnormal behaviors, making the system versatile against various types of attacks
2Measurement precision
If analysis is performed on large amount of network flow data, then abnormal behavior detection capability is improved, but real-time performance deteriorates due to long detection time
Solution Approach 1:
The system segments the analysis process into multiple stages: initial filtering using preset rules, intermediate analysis using machine learning models, and detailed investigation only for suspicious cases. This segmentation reduces the amount of data requiring intensive processing while maintaining detection capability
Solution Approach 2:
The system applies full analytical resources only to a subset of data that shows signs of abnormality through preliminary screening, rather than analyzing all network flow data with equal depth, thus achieving good detection performance with reduced processing time
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
The present invention relates to the technical field of industrial safety, in particular to a safety monitoring method and apparatus for an industrial control system that has the advantage of quick and accurate detection of an abnormal behavior in the industrial control system. The method provided by the examples of the present invention includes: providing the first data (301) generated during the process of operating of an industrial control system (10) and performing the first statistics on the first data; providing a result (401) of the first statistics to a user; obtaining an operation (501) performed by the user on the result (401) of the first statistics; determining, based on the operation (501), a target time period (601) related to the first statistics and the second data (302) satisfying a preset condition (502) in the first data (301); and obtaining a result of second statistics in the target time period (601), and based on the result thereof, performing the safety analysis on the industrial control system (10).