摘要
随着工控系统和互联网的交叉融合与边界模糊,边界部署的安全设备无法进行有效防护。已有的安全检测平台和系统,对工控系统安全事件的理解和整合能力不足。在深入理解工控系统的工业属性以及安全需求的基础上,结合深度数据包检测、网络威胁情报感知、协议解析及数据挖掘等人工智能方法,设计工控网络安全监测分析及溯源系统,实现数据驱动的工业互联网态势感知、检测预警、攻击溯源及反制,有效提升工控系统的安全实时检测、感知预警与防护水平。
With the continuous integration of industrial networks and the Internet,the network boundary is blurred,and the security equipment deployed at the boundary can not be effectively protected. Existing security detection platforms and systems have insufficient ability to understand and integrate safety events in Industrial Control Systems( ICS). On the basis of understanding of industrial attributes and security requirements,this paper designs an ICS security monitoring and traceability system,which combines artificial intelligence methods such as deep packet detection,network threat intelligence perception,protocol analysis,data mining and machine learning,to realize situational awareness,detection and early warning,attack traceability and countermeasure by data-driven industry. It can effectively enhance the security protection of ICS.
作者
张玫
曾彬
朱成威
Zhang Mei;Zeng Bin;Zhu Chengwei(Central South University of Forestry and Technology,Changsha 410080,China;Hunan YouDao Information Technology Co.,Ltd.,Changsha 410080,China;Institute of Deep-sea Science and Engineering,Chinese Academy of Sciences,Sanya 572000,China)
出处
《信息技术与网络安全》
2019年第1期14-19,共6页
Information Technology and Network Security
基金
湖南省教育厅一般项目(17C1651)
校青年基金项目(QJ2012008B)
关键词
工业控制系统
安全监测
深度数据包检测
攻击溯源
industrial control systems
security monitoring
deep packet inspection
attack traceability
