KR101437405B1 - An Effective Mechanism and method against Intrusion Attack using Aggregate Traffic Prediction for Wireless Industrial Networks - Google Patents

Abstract

The present invention relates to an effective intrusion attack counteraction system using integrated traffic prediction in an industrial wireless network and a method thereof, more particularly, to an effective intrusion attack counteraction system using integrated traffic prediction in an industrial wireless network which is capable of extending a lifetime of network by accurately detecting an intrusion attack by a security manager, and a method thereof. The present invention includes: a security manager who is in charge of security of wireless sensor network; a network manager; an intrusion detection analysis system for generating analysis information through communication of agents of all the channels after integrating wireless data; local intrusion detection modules which are embedded in file devices and in routing devices to protect an attack which starts from the security manager; and a all channel analysis agent which is arranged to other area according to a network partition of the WIA-PA industrial wireless networks.

Description

[0001] The present invention relates to an effective intrusion attack response system using an integrated traffic prediction in an industrial wireless network,

The present invention relates to an effective intrusion attack response system and method using an integrated traffic prediction in an industrial wireless network, and more particularly, to an industrial wireless network capable of accurately detecting an intrusion attack and extending a lifetime of the network The present invention relates to an effective intrusion attack response system and method using integrated traffic prediction.

In the rapid diffusion of wireless technology, it has been used in industrial control field due to the formation of industrial wireless network.

Comparing the existing hardware communication bus system with wireless technology, the cost, installation time, and repair cost of many cables can be relatively reduced.

Industrial wireless networks have evolved not only due to the special needs of industrial applications, but also because of their high reliability and low energy costs.

At present, at least Wireless HART (IEC / PAS 62591), WIA-PA (IEC / PAS 62601) and ISA100.11a standards are being developed.

They essentially designate the same physical domain in the wireless technology needed for industrial applications.

However, industrial wireless networks are vulnerable to a particular kind of attack because they are exposed to open, non-defensive environments.

WIA-PA, created as a new standard for industrial wireless applications, provides a new way to secure wireless systems.

However, it was vulnerable to attacks such as DoS and flooding. Therefore, there is a need for a new system and method for providing an anomaly detection method for the attack described above.

In order to solve the above problems, the present invention provides an effective intrusion attack response system and method using an integrated traffic prediction in an industrial wireless network in which a security manager can accurately detect an intrusion attack and extend a lifetime of the network .

The present invention relates to a security manager for managing security of a wireless sensor network, a network manager, an intrusion detection analysis system for generating analysis information by communication of agents of all channels after wireless data collection, system, local intrusion detection modules embedded in filed devices and routing devices to prevent attacks initiated by the security manager, WIA-PA networks, And all channels analysis agents located in different areas according to the network partitions of the network.

In one embodiment, the intrusion detection analysis system is a detection decision method based on traffic prediction of input data, and the agents monitor traffic due to an attack in a wireless network.

In one embodiment, the intrusion detection analysis system may further include a data / event monitor module connected by communication of all channels after the wireless data integration.

In one embodiment, the intrusion detection analysis system provides a report to a security module according to statistical analysis, and the field devices are provided with a corresponding method from the security module.

In one embodiment, the local intrusion detection modules are enabled by the security manager to respond to replay attacks and anonymous attacks in WIA-PA devices.

In one embodiment, statistical characteristics of real wireless network traffic are captured to generate a model for predicting traffic of the industrial wireless network.

In one embodiment, to use a linear prediction technique in view of the limitations of the node capacity of the industrial wireless network, each signal may be weighted sum of multiple sampling values ).

In one embodiment, the polymerization is determined as a minimum of a mean square prediction error.

In one embodiment, in the modeling of the industrial wireless network, when q = 0, the following Equation 1 becomes an AR model of the p-th order, and when p = 0, the AR model changes to the MA model of q-th order Time series x_t is an ARMA (p, q) process.

[Equation 1]

은 상기 모델의 파라미터이고,

는 에러 텀(error terms)이며, 독립한 것으로 가정하고 유한분산

과 제로 평균(zero mean)으로 정규분포로 부터 샘플링된다)(From here

Is a parameter of the model,

Are error terms, assuming independence, and finite variance

And sampled from the normal distribution with a zero mean)

이고, 자기상관함수(autocorrelation function)를 계산하면 하기 수학식 2와 같다.In one embodiment, in modeling the industrial wireless network, the actual data sequence is

And an autocorrelation function is calculated as shown in Equation 2 below.

&Quot; (2) "

In one embodiment, in modeling the industrial wireless network, a partial autocorrelation function may be calculated as: < EMI ID = 3.0 >

&Quot; (3) "

The security manager manages the security of the wireless sensor network. Managing a network state by a network manager; Generating analysis information by intrusion detection analysis system communication of agent of all channels after wireless data integration; Wherein local intrusion detection modules are embedded in filed devices and routing devices to prevent attacks initiated by the security manager; All channels analysis agents are arranged in different areas according to the network partitions of the WIA-PA networks.

In one embodiment, the intrusion detection analysis system is a detection decision method based on traffic prediction of input data, and the agents monitor traffic due to an attack in a wireless network.

In one embodiment, the intrusion detection analysis system is further connected to a data / event monitor module connected by communication of all channels after the wireless data integration.

In one embodiment, the intrusion detection analysis system provides a report to a security module according to statistical analysis, and the field devices are provided with a corresponding method from the security module.

In one embodiment, the local intrusion detection modules are enabled by the security manager to respond to replay attacks and anonymous attacks in WIA-PA devices.

In one embodiment, statistical characteristics of real wireless network traffic are captured to generate a model for predicting traffic of the industrial wireless network.

In one embodiment, to use a linear prediction technique in view of the limitations of the node capacity of the industrial wireless network, each signal may be weighted sum of multiple sampling values ).

In one embodiment, the polymerization is determined as a minimum of a mean square prediction error.

In one embodiment, in the modeling of the industrial wireless network, when q = 0, the above Equation 1 becomes the p-ary AR model, and when p = 0, the AR model changes to the q-order MA model Time series x_t is an ARMA (p, q) process.

이고, 자기상관함수(autocorrelation function)를 계산하면 상기 수학식 2와 같다.In one embodiment, in modeling the industrial wireless network, the actual data sequence is

, And the autocorrelation function is calculated as shown in Equation (2).

In one embodiment, in modeling the industrial wireless network, calculating a partial autocorrelation function is as in Equation (3).

According to the present invention, a security manager can accurately detect an intrusion attack and extend the lifetime of the network.

1 shows an intrusion detection scheme in a WIA-PA network;
2 is a diagram showing WIA-PA data traffic ARMA prediction results;
Figure 3 shows the metrics of a sliding window of replay detection.
4 is a view showing a test environment according to an embodiment of the present invention;
5 is a diagram illustrating channel analysis and intrusion detection rates of data traffic according to the present invention.

For a better understanding of the present invention, a preferred embodiment of the present invention will be described with reference to the accompanying drawings. The embodiments of the present invention may be modified into various forms, and the scope of the present invention should not be construed as being limited to the embodiments described in detail below. The present embodiments are provided to enable those skilled in the art to more fully understand the present invention. Therefore, the shapes and the like of the elements in the drawings can be exaggeratedly expressed to emphasize a clearer description. It should be noted that in the drawings, the same members are denoted by the same reference numerals. Further, detailed descriptions of well-known functions and configurations that may be unnecessarily obscured by the gist of the present invention are omitted.

The present invention relates to an intrusion attack countermeasure system utilizing integrated traffic prediction in an industrial wireless network.

An effective intrusion attack countermeasure system utilizing integrated traffic prediction in an industrial wireless network according to the present invention includes border router (1) wireless networks for industrial automation-process automation (WIA-PA) A security manager 3, a network manager 4, an intrusion detection analysis system 2, a security gateway 3, a security gateway 4, Local intrusion detection modules embedded in filed devices and routing devices to prevent attacks, and all channels analysis agents located in different areas according to the network partitions of the WIA-PA networks.

The intrusion detection analysis system is a detection decision method based on traffic prediction of input data, and the agents can monitor traffic according to an attack in a wireless network.

The present invention relates to an intrusion attack countermeasure system utilizing integrated traffic prediction in an industrial wireless network.

More particularly, the present invention relates to a security manager, a network manager, and an intrusion detection and analysis system for generating analysis information by communication of agents of all channels after wireless data integration, a local intrusion detection module embedded in filed devices and routing devices to prevent an attack initiated by the security manager, a WIA-PA and all channels analysis agents located in different areas according to the network partitions of the networks.

Here, the intrusion detection analysis system is a detection determination method based on traffic prediction of input data, and the agents monitor traffic according to an attack in a wireless network.

The intrusion detection analysis system may further include a data / event monitor module connected by communication of all channels after the wireless data integration.

The intrusion detection analysis system provides a report to the security module according to a statistical analysis, and the field devices are provided with a corresponding method from the security module.

The local intrusion detection modules are operated by the security manager to respond to a replay attack and an anonymous attack in WIA-PA devices.

And captures statistical characteristics of real wireless network traffic to generate a model for predicting the traffic of the industrial wireless network.

Each signal is represented by a weighted sum of a plurality of sampling values in order to use the linear prediction technique in view of the limitations of the node capacity of the industrial wireless network.

The polymerization is determined as the minimum of the mean square prediction error.

In the modeling of the industrial wireless network, when q = 0, the following Equation 1 becomes the AR model of the p-th order, and when p = 0, the AR model changes into the MA model of q-th order, , The time series x_t is an ARMA (p, q) process.

은 상기 모델의 파라미터이고,

는 에러 텀(error terms)이며, 독립한 것으로 가정하고 유한분산

과 제로 평균(zero mean)으로 정규분포로 부터 샘플링된다)(From here

Is a parameter of the model,

Are error terms, assuming independence, and finite variance

And sampled from the normal distribution with a zero mean)

이고, 자기상관함수(autocorrelation function)를 계산하면 하기 수학식 2와 같다.In the modeling of the industrial wireless network,

And an autocorrelation function is calculated as shown in Equation 2 below.

In the modeling of the industrial wireless network, a partial autocorrelation function is calculated as follows.

Hereinafter, an effective method for responding to an intrusion attack utilizing integrated traffic prediction in a specific industrial wireless network for implementing the present invention will be described in detail.

The security manager manages the security of the wireless sensor network. Managing a network state by a network manager; Generating analysis information by intrusion detection analysis system communication of agent of all channels after wireless data integration; Wherein local intrusion detection modules are embedded in filed devices and routing devices to prevent attacks initiated by the security manager; All channels analysis agents are arranged in different areas according to the network partitions of the WIA-PA networks.

The intrusion detection analysis system is a detection determination method based on the traffic prediction of input data, and the agents monitor traffic due to an attack in a wireless network.

The intrusion detection analysis system is further connected to a data / event monitor module connected by communication of all channels after the wireless data integration.

The intrusion detection analysis system provides a report to the security module according to a statistical analysis, and the field devices are provided with a corresponding method from the security module.

The local intrusion detection modules are operated by the security manager to respond to a replay attack and an anonymous attack in WIA-PA devices.

And captures statistical characteristics of real wireless network traffic to generate a model for predicting the traffic of the industrial wireless network.

Each signal is represented by a weighted sum of a plurality of sampling values in order to use the linear prediction technique in view of the limitations of the node capacity of the industrial wireless network.

The polymerization is determined as the minimum of the mean square prediction error.

In the modeling of the industrial wireless network, when q = 0, Equation (1) becomes the AR model of the p-th order, and when p = 0, the AR model becomes the MA model of q-th order, , The time series x_t is an ARMA (p, q) process.

이고, 자기상관함수(autocorrelation function)를 계산하면 상기 수학식 2와 같다.In the modeling of the industrial wireless network,

, And the autocorrelation function is calculated as shown in Equation (2).

In the modeling of the industrial wireless network, the partial autocorrelation function is calculated as in Equation (3).

The embodiments of the effective intrusion attack response system utilizing the integrated traffic prediction in the industrial wireless network of the present invention described above are merely illustrative and those skilled in the art will appreciate that various modifications And other equivalent embodiments are possible.

Therefore, it is to be understood that the present invention is not limited to the above-described embodiments. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims. It is also to be understood that the invention includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention as defined by the appended claims.

1: border router
2: Intrusion detection analysis system
3: Security Manager
4: My network manager

Claims (22)

In an attack response system using integrated traffic prediction in an industrial wireless network,
A security manager for security of the wireless sensor network;
A network manager;
An intrusion detection analysis system that generates analysis information by communication of agents of all channels after wireless data integration;
Local intrusion detection modules embedded in filed devices and routing devices to prevent attacks initiated by the security manager;
All channels analysis agents located in different areas according to the network partition of the industrial wireless network (WIA-PA networks);
And an integrated attack prediction system using the integrated traffic prediction in an industrial wireless network. The method according to claim 1,
Wherein the intrusion detection analysis system performs a determination based on traffic prediction of the input data and the agents monitor traffic following the attack in the wireless network. An effective attack response system using predictions. The method according to claim 1,
Wherein the intrusion detection analysis system is further connected to a data / event monitor module connected by communication of all channels after the wireless data integration. Attack response system. The method according to claim 1,
Wherein the intrusion detection analysis system provides a report to the security module according to a statistical analysis and the field devices are provided with a corresponding method from the security module. An effective intrusion attack response system utilizing integrated traffic forecasting. The method according to claim 1,
Wherein the local intrusion detection module is activated by the security manager to respond to a replay attack and an anonymous attack in WIA-PA devices. Attack response system. The method according to claim 1,
Wherein the statistical characteristics of the real wireless network traffic are captured to generate a model for predicting the traffic of the industrial wireless network. The method according to claim 1,
In order to use the linear prediction technique in consideration of the node capacity of the industrial wireless network, each signal is represented by a weighted sum of a plurality of sampling values. An effective attack response system that utilizes integrated traffic forecasting in an industrial wireless network. 8. The method of claim 7,
Wherein the polymerization is determined as a minimum value of a mean square prediction error. ≪ RTI ID = 0.0 > 11. < / RTI > delete delete delete In a method for responding to an intrusion attack utilizing integrated traffic prediction in an industrial wireless network,
Managing a security of a wireless sensor network by a security manager;
Managing a network state by a network manager;
Generating analysis information by intrusion detection analysis system communication of agent of all channels after wireless data integration;
Wherein local intrusion detection modules are embedded in filed devices and routing devices to prevent attacks initiated by the security manager;
Wherein all channels analysis agents are located in different areas according to the network partitions of the WIA-PA networks;
And an integrated traffic forecasting method in an industrial wireless network. 13. The method of claim 12,
Wherein the intrusion detection analysis system is a detection decision method based on traffic prediction of input data and the agents monitor traffic according to an attack in a wireless network. An effective attack response method using prediction. 13. The method of claim 12,
Wherein the intrusion detection analysis system is further connected to a data / event monitor module connected by communication of all channels after the wireless data integration. How to respond to an attack. 13. The method of claim 12,
Wherein the intrusion detection analysis system provides a report to the security module according to a statistical analysis and wherein the field devices are provided with a corresponding method from the security module. An effective method of responding to an attack using traffic prediction. 13. The method of claim 12,
Wherein the local intrusion detection module is activated by the security manager to respond to a replay attack and an anonymous attack in WIA-PA devices. How to respond to an attack. 13. The method of claim 12,
Wherein the statistical characteristics of the real wireless network traffic are captured to generate a model for predicting the traffic of the industrial wireless network. 13. The method of claim 12,
In order to use the linear prediction technique in consideration of the node capacity of the industrial wireless network, each signal is represented by a weighted sum of a plurality of sampling values. An effective attack response method using integrated traffic prediction in an industrial wireless network. 19. The method of claim 18,
Wherein the polymerization is determined as a minimum value of a mean square prediction error. ≪ RTI ID = 0.0 > 11. < / RTI > delete delete delete

Images