Whitelist-Based Abnormal Behavior Detection in Control Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting abnormal behavior in control networks using blacklists impose a significant load on embedded systems and are difficult to update, while whitelist-based methods struggle to identify the cause of issues and ensure system availability.
Innovation Solution
An apparatus and method that collect system information from main and terminal devices in a control network, using a whitelist to detect abnormal behavior by comparing collected data against process, file, and network whitelists, and generating countermeasures for unauthorized activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a blacklist-based method is used to detect abnormal behavior, then malicious code detection capability is improved, but system load increases and resources are consumed excessively
Solution Approach 1:
The patent inverts the traditional blacklist approach by implementing a whitelist-based monitoring system. Instead of maintaining a list of known malicious patterns that consume significant resources for comparison, the system establishes a whitelist of normal, authorized processes, files, and network connections. Any deviation from the whitelist is flagged as abnormal behavior, thereby reducing system load while maintaining detection capability.
Solution Approach 2:
The patent extracts the monitoring function from the embedded systems themselves and relocates it to an external server. The server collects system information from multiple devices, performs whitelist-based analysis centrally, and sends back only necessary control commands. This extraction eliminates the need for resource-intensive blacklist maintenance on each embedded device, significantly reducing their system load.
2Reliability
If a blacklist-based method is used to detect abnormal behavior, then malicious code detection capability is improved, but update difficulty increases due to closed network constraints
Solution Approach 1:
The patent introduces a server as an intermediary between the closed control network and external threat intelligence sources. The server acts as a mediator that collects system information from within the closed network, compares it against whitelist criteria, and can receive update information from external sources without requiring direct network access for individual devices. This intermediary architecture enables easy updates while maintaining network security and closed architecture constraints.
3Use of energy by moving object
If a whitelist-based monitoring system is implemented, then system load is reduced, but problem cause identification capability deteriorates
Solution Approach 1:
The patent implements comprehensive feedback mechanisms that provide detailed information about abnormal behaviors detected by the whitelist system. When an anomaly is detected, the system generates feedback reports that include specific details about the deviation from normal behavior, the affected processes or files, and potential causes. This feedback loop enables effective problem cause identification despite using the lighter whitelist approach, as it provides actionable diagnostic information without requiring resource-intensive analysis on the embedded devices themselves.
4Use of energy by moving object
If a whitelist-based monitoring system is implemented, then system load is reduced, but active problem resolution capability deteriorates
Solution Approach 1:
The patent implements preliminary action by pre-configuring the whitelist with authorized processes, files, and network connections before system operation begins. The server maintains an updated whitelist that reflects the normal operational state of the control network. When abnormal behavior is detected, the system can immediately compare against the pre-established whitelist criteria and execute predetermined response actions, such as blocking unauthorized processes or alerting operators, without requiring real-time complex analysis or manual intervention for each anomaly.
Data Source
AI summary
Disclosed herein are an apparatus and method for detecting abnormal behavior in a main device and a terminal device, included in a control network, using a whitelist. The apparatus for detecting abnormal behavior includes an information collection unit for collecting system information about the main device and system information about the terminal device and a detection unit for detecting abnormal behavior in the main device and the terminal device by comparing a whitelist with system information that includes the system information about the main device and the system information about the terminal device, wherein the whitelist includes a process whitelist, a file whitelist, and a network whitelist.