Plant Network Improper Communication Detection via Session Whitelisting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current improper communication detection systems in plant networks rely on log analysis of firewalls and intrusion detection systems, which are inadequate for real-time monitoring, fail to detect new attack patterns, and can disrupt plant operations, especially when attack traffic affects field devices connected to control bus networks.
Innovation Solution
An improper communication detection system that acquires packets by mirroring and uses a session whitelist and traffic pattern whitelist to detect unauthorized communication, allowing for real-time identification of improper traffic without relying on firewall log analysis or intrusion detection systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If log analysis of firewall and intrusion detection systems is used, then detection capability is provided, but real-time monitoring is not achieved and plant operations may be disrupted
Solution Approach 1:
The system performs preliminary actions by capturing and storing packets in advance using packet mirroring from the network switch. Packets are pre-captured and stored in a database before analysis is needed, enabling real-time detection without disrupting plant operations. The capture unit continuously monitors and stores network traffic, so when detection is required, the data is already available for immediate analysis.
2Reliability
If intrusion detection system is deployed, then security monitoring is provided, but new attack patterns cannot be detected and system complexity increases
Solution Approach 1:
The system changes parameters by analyzing multiple packet attributes including source IP, destination IP, source port, destination port, protocol type, packet size, and timing information. By examining combinations of these parameters rather than relying on fixed signatures, the system can detect new attack patterns that deviate from normal traffic parameters without requiring pre-programmed detection rules for each specific threat.
3Reliability
If traditional detection methods are used, then existing threats are identified, but operational disruptions occur and response time is delayed
Solution Approach 1:
The system introduces an intermediary approach by using packet mirroring to create a copy of network traffic for analysis without intercepting or blocking the original traffic flow. The capture unit receives mirrored packets from the network switch and analyzes them separately, allowing threat identification to occur in parallel with normal plant operations, thus maintaining operational continuity while providing security monitoring.
Data Source
AI summary
An improper communication detection system that acquires packets that are circulated through a plant network by mirroring and detects improper communication includes a storage unit configured to prestore a session whitelist, which is a list of sessions that can be generated in the plant network; a session determination/separation unit configured to make a determination as to a success or failure of session approval on the basis of the acquired packet and configured to generate session information indicating an approved session; and a first improper communication detection unit configured to compare the session information generated by the session determination/separation unit with the session whitelist, and configured to detect communication related to the relevant session as improper communication when the session information does not match any session in the session whitelist.