CN110912927B - 工业控制***中控制报文的检测方法及装置 - Google Patents
工业控制***中控制报文的检测方法及装置 Download PDFInfo
- Publication number
- CN110912927B CN110912927B CN201911252258.XA CN201911252258A CN110912927B CN 110912927 B CN110912927 B CN 110912927B CN 201911252258 A CN201911252258 A CN 201911252258A CN 110912927 B CN110912927 B CN 110912927B
- Authority
- CN
- China
- Prior art keywords
- message
- control
- packet
- matched
- rule
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 92
- 238000004891 communication Methods 0.000 claims abstract description 115
- 238000012544 monitoring process Methods 0.000 claims abstract description 83
- 238000001514 detection method Methods 0.000 claims abstract description 64
- 230000002159 abnormal effect Effects 0.000 claims description 145
- 230000008569 process Effects 0.000 claims description 39
- 238000004590 computer program Methods 0.000 claims description 14
- 238000009795 derivation Methods 0.000 claims description 4
- 238000012217 deletion Methods 0.000 claims description 3
- 230000037430 deletion Effects 0.000 claims description 3
- 238000012986 modification Methods 0.000 abstract description 10
- 230000004048 modification Effects 0.000 abstract description 10
- 238000010586 diagram Methods 0.000 description 12
- 230000006870 function Effects 0.000 description 11
- 238000004458 analytical method Methods 0.000 description 6
- 238000012545 processing Methods 0.000 description 6
- 238000012423 maintenance Methods 0.000 description 5
- 238000013467 fragmentation Methods 0.000 description 4
- 238000006062 fragmentation reaction Methods 0.000 description 4
- 230000009286 beneficial effect Effects 0.000 description 3
- 238000004519 manufacturing process Methods 0.000 description 3
- 238000004088 simulation Methods 0.000 description 3
- 238000012550 audit Methods 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000007726 management method Methods 0.000 description 2
- 230000004044 response Effects 0.000 description 2
- 244000035744 Hura crepitans Species 0.000 description 1
- 230000032683 aging Effects 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000015572 biosynthetic process Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000035515 penetration Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000011897 real-time detection Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
Claims (20)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201911252258.XA CN110912927B (zh) | 2019-12-09 | 2019-12-09 | 工业控制***中控制报文的检测方法及装置 |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201911252258.XA CN110912927B (zh) | 2019-12-09 | 2019-12-09 | 工业控制***中控制报文的检测方法及装置 |
Publications (2)
Publication Number | Publication Date |
---|---|
CN110912927A CN110912927A (zh) | 2020-03-24 |
CN110912927B true CN110912927B (zh) | 2022-04-12 |
Family
ID=69823505
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201911252258.XA Active CN110912927B (zh) | 2019-12-09 | 2019-12-09 | 工业控制***中控制报文的检测方法及装置 |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN110912927B (zh) |
Families Citing this family (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111885180B (zh) * | 2020-07-28 | 2023-06-20 | 海尔优家智能科技(北京)有限公司 | 消息下发方法及装置 |
CN111835793A (zh) * | 2020-08-05 | 2020-10-27 | 天津美腾科技股份有限公司 | 用于物联网接入的通信方法、装置、电子设备及存储介质 |
CN112486139A (zh) * | 2020-11-12 | 2021-03-12 | 顶象科技有限公司 | 基于虚拟补丁的工业控制***保护方法、装置、设备及介质 |
CN112822291A (zh) * | 2021-02-07 | 2021-05-18 | 国网福建省电力有限公司电力科学研究院 | 一种工控设备的监测方法与装置 |
CN113467345B (zh) * | 2021-08-11 | 2022-06-14 | 中电积至(海南)信息技术有限公司 | 一种具有模拟模块的智能家居安全网关*** |
CN115622963A (zh) * | 2022-12-01 | 2023-01-17 | 北京安帝科技有限公司 | 基于工业交换机的报文检测方法、装置、设备与介质 |
CN116142296B (zh) * | 2023-04-21 | 2023-06-23 | 中国第一汽车股份有限公司 | 后轮转向***的故障检测方法、装置、设备及存储介质 |
CN116893663B (zh) * | 2023-09-07 | 2024-01-09 | 之江实验室 | 一种主控异常检测方法、装置、存储介质及电子设备 |
Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109922072A (zh) * | 2019-03-18 | 2019-06-21 | 腾讯科技(深圳)有限公司 | 一种分布式拒绝服务攻击检测方法及装置 |
Family Cites Families (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102523223B (zh) * | 2011-12-20 | 2014-08-27 | 北京神州绿盟信息安全科技股份有限公司 | 一种木马检测的方法及装置 |
JP2017123522A (ja) * | 2016-01-05 | 2017-07-13 | 富士通株式会社 | 通信装置、制御装置、通信システム、および、通信方法 |
CN107404487B (zh) * | 2017-08-07 | 2020-07-21 | 浙江国利网安科技有限公司 | 一种工业控制***安全检测方法及装置 |
CN109660518B (zh) * | 2018-11-22 | 2020-12-18 | 北京六方云信息技术有限公司 | 网络的通信数据检测方法、装置以及机器可读存储介质 |
CN110011973B (zh) * | 2019-03-06 | 2021-08-03 | 浙江国利网安科技有限公司 | 工业控制网络访问规则构建方法及训练*** |
CN110113332A (zh) * | 2019-04-30 | 2019-08-09 | 北京奇安信科技有限公司 | 一种检测工控协议是否存在异常的方法及装置 |
-
2019
- 2019-12-09 CN CN201911252258.XA patent/CN110912927B/zh active Active
Patent Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109922072A (zh) * | 2019-03-18 | 2019-06-21 | 腾讯科技(深圳)有限公司 | 一种分布式拒绝服务攻击检测方法及装置 |
Also Published As
Publication number | Publication date |
---|---|
CN110912927A (zh) | 2020-03-24 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN110912927B (zh) | 工业控制***中控制报文的检测方法及装置 | |
CN111901327B (zh) | 云网络漏洞挖掘方法、装置、电子设备及介质 | |
WO2019095719A1 (zh) | 网络流量异常检测方法、装置、计算机设备和存储介质 | |
CN111274583A (zh) | 一种大数据计算机网络安全防护装置及其控制方法 | |
CN112702383A (zh) | 收集误差分组信息以进行网络策略实施 | |
CN109164786A (zh) | 一种基于时间相关基线的异常行为检测方法、装置及设备 | |
CN110417778B (zh) | 访问请求的处理方法和装置 | |
CN111935172A (zh) | 基于网络拓扑的网络异常行为检测方法、计算机装置及计算机可读存储介质 | |
CN110830330B (zh) | 一种防火墙测试方法、装置及*** | |
CN112565266A (zh) | 一种信息泄露攻击检测方法、装置、电子设备及存储介质 | |
CN114374566B (zh) | 一种攻击检测方法及装置 | |
CN112615858B (zh) | 物联网设备监控方法、装置与*** | |
CN111083157B (zh) | 报文过滤规则的处理方法和装置 | |
WO2019136954A1 (zh) | 网络合规检测方法、装置、设备及介质 | |
CN112422554B (zh) | 一种检测异常流量外连的方法、装置、设备及存储介质 | |
EP3343421A1 (en) | System to detect machine-initiated events in time series data | |
CN111464513A (zh) | 数据检测方法、装置、服务器及存储介质 | |
CN112822291A (zh) | 一种工控设备的监测方法与装置 | |
CN112653693A (zh) | 一种工控协议分析方法、装置、终端设备及可读存储介质 | |
CN111316272A (zh) | 使用行为和深度分析的先进网络安全威胁减缓 | |
CN115147956A (zh) | 数据处理方法、装置、电子设备及存储介质 | |
WO2019043804A1 (ja) | ログ分析装置、ログ分析方法及びコンピュータ読み取り可能記録媒体 | |
CN113098852B (zh) | 一种日志处理方法及装置 | |
KR20040072365A (ko) | 네트워크 상태 표시 장치 및 그 방법 | |
CN117009963A (zh) | 用于基于机器学习的恶意软件检测的***和方法 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
CB02 | Change of applicant information | ||
CB02 | Change of applicant information |
Address after: 100089 Beijing city Haidian District Road No. 4 North wa Yitai three storey building Applicant after: NSFOCUS Technologies Group Co.,Ltd. Applicant after: NSFOCUS TECHNOLOGIES Inc. Address before: 100089 Beijing city Haidian District Road No. 4 North wa Yitai three storey building Applicant before: NSFOCUS INFORMATION TECHNOLOGY Co.,Ltd. Applicant before: NSFOCUS TECHNOLOGIES Inc. |
|
GR01 | Patent grant | ||
GR01 | Patent grant | ||
TR01 | Transfer of patent right | ||
TR01 | Transfer of patent right |
Effective date of registration: 20240424 Address after: 100089 Beijing city Haidian District Road No. 4 North wa Yitai 5 storey building Patentee after: NSFOCUS Technologies Group Co.,Ltd. Country or region after: China Patentee after: NSFOCUS TECHNOLOGIES Inc. Patentee after: Guangzhou Lvmeng Network Security Technology Co.,Ltd. Address before: 100089 Beijing city Haidian District Road No. 4 North wa Yitai three storey building Patentee before: NSFOCUS Technologies Group Co.,Ltd. Country or region before: China Patentee before: NSFOCUS TECHNOLOGIES Inc. |