KR102541309B1 - Method and Apparatus for Anomaly Detection of Communication in Industrial Control System Environment - Google Patents

Abstract

The present invention relates to a method and apparatus for detecting an abnormal state of communication in an industrial control system environment, wherein an electronic device communicates with a plurality of IoT (internet of things) terminals using different communication protocols to a plurality of IoT terminals. Automatically analyzing a periodic communication pattern based on the learning packet received from the electronic device, learning a normal state of communication with a plurality of IoT terminals based on the learning packet having a periodic communication pattern to create a learning model Steps, when the learning model is generated by the electronic device, receiving packets for detection through communication with a plurality of IoT terminals, generating a packet sequence based on the packets for detection by the electronic device, and generating the packet sequence by the electronic device Applying the learning model to detecting an abnormal communication state with at least one IoT terminal among a plurality of IoT terminals, and can be applied to other embodiments.

Description

Method and apparatus for detecting abnormal state of communication in industrial control system environment {Method and Apparatus for Anomaly Detection of Communication in Industrial Control System Environment}

The present invention relates to a method and apparatus for detecting an abnormal state of communication in an industrial control system environment.

A general industrial control system (ICS) environment is composed of a plurality of industrial IoT terminals, and the IoT terminals communicate with each other using an industrial control protocol. However, since these IoT terminals use different communication protocols and have various communication cycles for each terminal, an expert's analysis is required to define a steady state using a communication pattern.

Companies with a large-scale industrial control system environment employ experts to build a system that detects abnormal conditions by analyzing the communication packets of IoT terminals one by one and defining normal conditions. However, it is difficult to apply the above method due to economic problems in a company having a small-scale industrial control system environment.

In addition, since it is common for a plurality of IoT terminals to use both periodic and non-periodic communication in an industrial control system environment, not only network delay occurs, but even if experts analyze communication packets, human errors may occur during the analysis process. There arises a problem that the analysis of the communication pattern increases the probability of being wrong.

Embodiments of the present invention to solve these conventional problems automatically analyze the communication pattern of the industrial IoT terminal implementing the industrial control system, and can detect an abnormal state of communication based on the periodicity of the analyzed communication pattern. It is to provide a method and apparatus for detecting an abnormal state of communication in an industrial control system environment.

A method for detecting an abnormal state of communication in an industrial control system environment according to an embodiment of the present invention is an electronic device communicating with a plurality of Internet of Things (IoT) terminals using different communication protocols, thereby Automatically analyzing a periodic communication pattern based on a learning packet received from a terminal, wherein the electronic device learns a normal state of communication with the plurality of IoT terminals based on the learning packet having the periodic communication pattern Generating a learning model; receiving, by the electronic device, packets for detection through communication with the plurality of IoT terminals when the learning model is generated; and, by the electronic device, generating a packet sequence based on the detection packets. generating and detecting, by the electronic device, an abnormal communication state with at least one IoT terminal among the plurality of IoT terminals by applying the packet sequence to the learning model.

In addition, the step of automatically analyzing the communication pattern includes parsing the learning packet and checking information included in the learning packet, checking a source IP and a destination IP among the information and separating the learning packet by communication section. The step of grouping the learning packets separated by the communication section based on the function code and the target data object among the information and automatically analyzing a periodic communication pattern for the grouped learning packets. to be characterized

In addition, the step of automatically analyzing the periodic communication pattern for the grouped training packets includes the steps of analyzing the periodic communication sequence for each group based on the learning packets included in at least one group and the analyzed periodic communication and generating the periodic communication pattern for each group by combining sequences.

Also, the step of analyzing the periodic communication sequence may include deleting packets whose intervals between reception timings of the learning packets are aperiodic.

In addition, generating a packet sequence may include parsing the detection packets and checking information included in the detection packets, checking a source IP and a destination IP among the information, and separating the detection packets by communication section. and generating the packet sequence for periodic communication and aperiodic communication for each communication section.

In addition, an electronic device for detecting an abnormal state of communication in an industrial control system environment according to an embodiment of the present invention includes a communication unit that communicates with a plurality of internet of things (IoT) terminals using different communication protocols and the above Based on the learning packets received from a plurality of IoT terminals, periodic communication patterns are automatically analyzed, and based on the learning packets having periodic communication patterns, a normal state of communication with the plurality of IoT terminals is learned to create a learning model. and when the learning model is generated, a packet sequence is generated based on packets for detection received through communication with the plurality of IoT terminals, and the packet sequence is applied to the learning model to at least one of the plurality of IoT terminals. It is characterized in that it includes a control unit for detecting an abnormal state of communication with the IoT terminal.

In addition, the control unit parses the learning packet to check the source IP, destination IP, function code, and target data object included in the learning packet, and divides the learning packet by communication section based on the source IP and the destination IP. characterized by separation.

In addition, the control unit groups the learning packets separated by the communication section based on the function code and the target data object, and automatically analyzes a periodic communication pattern for the grouped learning packets. .

Further, the controller may analyze the periodic communication sequence for each group based on the learning packets included in at least one group, and generate the periodic communication pattern for each group by combining the periodic communication sequence.

In addition, the control unit may delete packets having an aperiodic interval between reception timings of the learning packets.

In addition, the controller parses the detection packet to check the detection packet information including a source IP and a destination IP, and separates the detection packet for each communication section.

In addition, the controller may generate the packet sequence for periodic communication and aperiodic communication for each communication section.

As described above, the method and apparatus for detecting an abnormal state of communication in an industrial control system environment according to the present invention automatically analyzes the communication pattern of the industrial IoT terminal implementing the industrial control system and determines the periodicity of the analyzed communication pattern. By detecting an abnormal state of communication based on this, it is possible to prevent human error occurring in the process of defining a normal state for detecting an abnormal state and to reduce the cost of defining a normal state.

1 is a diagram illustrating a system for detecting an abnormal state of communication in an industrial control system environment according to an embodiment of the present invention.
2 is a diagram illustrating an electronic device including a function of detecting an abnormal state of communication in an industrial control system environment according to an embodiment of the present invention.
3 is a flowchart illustrating a method of performing learning for detecting an abnormal state of communication according to an embodiment of the present invention.
4 is an exemplary diagram for explaining a method of generating a communication pattern according to an embodiment of the present invention.
5 is a flowchart illustrating a method of detecting an abnormal state of communication according to an embodiment of the present invention.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings. The detailed description set forth below in conjunction with the accompanying drawings is intended to describe exemplary embodiments of the present invention and is not intended to represent the only embodiments in which the present invention may be practiced. In order to clearly describe the present invention in the drawings, parts irrelevant to the description may be omitted, and the same reference numerals may be used for the same or similar components throughout the specification.

In one embodiment of the present invention, expressions such as “or” and “at least one” may represent one of the words listed together, or a combination of two or more. For example, "A or B" and "at least one of A and B" may include only one of A or B, or may include both A and B.

1 is a diagram illustrating a system for detecting an abnormal state of communication in an industrial control system environment according to an embodiment of the present invention.

Referring to FIG. 1 , a system 10 according to the present invention includes a plurality of IoT terminals 100 and an electronic device 200.

The plurality of IoT terminals 100 include a first IoT terminal 110, a second IoT terminal 120 to an nth IoT terminal 130, and the IoT terminal 100 communicates with the electronic device 200. It refers to a terminal that builds an industrial control system (ICS) environment through a terminal, and may include devices such as a sensor, a network device, a programmable logic controller (PLC), and a robot. The IoT terminal 100 performs communication between IoT terminals and also performs operations by control of the electronic device 200 through communication with the electronic device 200 . To this end, the IoT terminal 100 performs communication such as wireless communication and wired communication.

The electronic device 200 builds an industrial control system environment together with a plurality of IoT terminals 100, controls the operation of the IoT terminal 100 through communication with the IoT terminal 100, and among the IoT terminals 100 It detects whether communication with at least one IoT terminal is normal or abnormal. To this end, the control unit 250 performs learning of a deep learning model capable of detecting an abnormal communication state with the IoT terminal 100. The operation of the electronic device 200 will be described in more detail with reference to FIG. 2 below. 2 is a diagram illustrating an electronic device including a function of detecting an abnormal state of communication in an industrial control system environment according to an embodiment of the present invention. In addition, in an embodiment of the present invention, the electronic device 200 may be a device such as a computer or a tablet PC (personal computer), but is not necessarily limited thereto, and it should be clarified that it may be built in the form of a server.

Referring to FIG. 2 , an electronic device 200 according to the present invention includes a communication unit 210, an input unit 220, a display unit 230, a memory 240, and a control unit 250.

The communication unit 210 performs communication with the IoT terminal 100. To this end, the communication unit 210 may perform port mirroring using wired communication with the IoT terminal 100 .

The input unit 220 generates input data in response to a user's input of the electronic device 200 . To this end, the input unit 220 may include input devices such as a keyboard, mouse, keypad, dome switch, touch panel, touch keys and buttons.

The display unit 230 outputs output data according to the operation of the electronic device 200 . To this end, the display unit 230 may include a display device such as a liquid crystal display (LCD), a light emitting diode (LED) display, or an organic LED (OLED) display. In addition, the display unit 230 may be combined with the input unit 220 and implemented in the form of a touch screen.

The memory 240 stores operating programs of the electronic device 200 . In particular, the memory 240 stores the deep learning model learned by the control unit 250 . The memory 240 stores an algorithm for automatically analyzing a periodic communication pattern of the IoT terminal 100 based on the learning packet received from the IoT terminal 100 so that the control unit 250 can generate a deep learning model. do.

The control unit 250 performs learning to detect an abnormal communication state with the IoT terminal 100, and detects an abnormal communication state through communication with the IoT terminal 100 when the learning is completed. More specifically, the control unit 250 receives a learning start signal for starting learning about a normal state of communication with at least one IoT terminal among the IoT terminals 100 in an industrial control system environment from the input unit 220, the IoT terminal A learning packet is received from (100).

The control unit 250 checks the time, source IP, destination IP, function code, and target data object included in the training packet through parsing of the received training packet. . The control unit 250 separates traffic by communication section based on the source IP and the destination IP. The control unit 250 groups training packets based on function codes and target data objects. For this reason, all packets included in the same group may have the same source IP, destination IP, function code, and target data object.

Next, the controller 250 analyzes the periodic communication sequence for each group based on the packets included in each group, and generates a periodic communication pattern by combining the periodic communication sequence for each group. The controller 250 learns the deep learning model using only the packets having the generated periodic communication pattern.

In this case, the controller 250 may learn a deep learning model using long short term memory (LSTM), which is a type of deep learning algorithm based on a recurrent neural network (RNN). Through this, the controller 250 may define a normal state for communication with the plurality of IoT terminals 100 . When the learning of the deep learning model is completed, the controller 250 stores it in the memory 240 .

When the learning of the deep learning model is completed as described above, the controller 250 detects an abnormal state for communication with at least one IoT terminal among the IoT terminals 100 in an industrial control system environment from the input unit 220. Receive a detection start signal. The control unit 250 receives a packet for detection from the IoT terminal 100 through communication with the IoT terminal 100 based on the detection start signal. The control unit 250 checks the time, source IP, destination IP, function code, and target data object included in the detection packet through parsing of the received detection packet.

The control unit 250 separates the traffic based on the source IP and the destination IP, performs separation by communication section, and generates a packet sequence for each communication section to be used as an input to the deep learning model stored in the memory 240. At this time, the control unit 250 may generate a packet sequence for both periodic communication and aperiodic communication with the IoT terminal 100.

The controller 250 applies the generated packet sequence to the deep learning model. As a result of application to the deep learning model, the control unit 250 outputs an alarm notifying this when it is detected that communication with at least one IoT terminal 100 among the IoT terminals 100 is in an abnormal state. More specifically, the control unit 250 may distinguish normal packets from abnormal packets by matching prediction packets predicted by the deep learning model with packets for detection received from the IoT terminal 100 . The control unit 250 may check a predicted packet predicted by the deep learning model by inputting a packet sequence of a normal period to the deep learning model. The control unit 250 detects that communication with the IoT terminal 100 is in a normal state if the prediction packet predicted by the deep learning model and the detection packet are the same, and if the prediction packet and the detection packet are not identical, the control unit 250 ) can detect that communication with the IoT terminal 100 is in an abnormal state.

3 is a flowchart illustrating a method of performing learning for detecting an abnormal state of communication according to an embodiment of the present invention. When a communication period is used to define a normal state, a problem in that accuracy is degraded due to network delay occurs. Therefore, in the present invention, in order to solve this problem, packets are separated for each communication section and the packet sequence of each communication section is used for learning.

Referring to FIG. 3, in step 301, the control unit 250 receives a learning start signal for starting learning about a normal state of communication with at least one IoT terminal among the IoT terminals 100 in an industrial control system environment from the input unit 220. check the reception of As a result of checking in step 301, if the learning start signal is received, the control unit 250 performs step 303, and if the learning start signal is not received, it waits for reception of the learning start signal.

In step 303, the controller 250 receives a learning packet from the IoT terminal 100 through communication with the IoT terminal 100 constructing an industrial control system environment. In step 305, the controller 250 parses the received learning packet. Through this, the control unit 250 checks the time, source IP, destination IP, function code, and target data object included in the learning packet.

In step 307, the control unit 250 separates traffic based on the source IP and destination IP and separates learning packets by communication section. In step 309, the control unit 250 groups training packets based on function codes and target data objects. For this reason, all packets included in the same group may have the same source IP, destination IP, function code, and target data object.

In step 311, the control unit 250 analyzes the periodic communication sequence for each group based on the packets included in each group, and generates a periodic communication pattern for each group by combining the periodic communication sequence for each group. At this time, a method for generating a periodic communication pattern will be described in more detail with reference to FIG. 4 below. 4 is an exemplary diagram for explaining a method of generating a communication pattern according to an embodiment of the present invention.

Referring to FIG. 4 , reference numeral 401 denotes detailed packet collection information according to time generated through separation by communication section. At this time, it is not easy to analyze the periodicity of the packets because they are collected at the same time as the packets a and b collected from the IoT terminal using a single communication.

Accordingly, the control unit 250 performs grouping based on function codes and target data objects as shown by reference numeral 403 . When grouping is performed, it is classified into a and b based on the function code and the target data object, and the packets of a and b are sorted by received time. Here, the control unit 250 checks when a and b are respectively received based on the time axis.

임으로 주기적임을 확인할 수 있고, b패킷의 경우, 수신된 시점 사이의 간격이

과

로 상이함을 확인할 수 있다. 제어부(250)는 확인결과에 따라

과

중 시간차가 최대인

을 주기성을 확인하기 위한 시간으로 확인한다. As a result of the check, the control unit 250 determines that, in the case of packet a, the interval between the received times is

Arbitrarily, it can be confirmed that it is periodic, and in the case of the b packet, the interval between the received points is

class

The difference can be confirmed by The control unit 250 according to the confirmation result

class

with the largest time difference

is checked as the time to check the periodicity.

As shown in reference numeral 405, the control unit 250 deletes packets 411 collected at non-periodic intervals. After deleting the packets 411 collected at non-periodic intervals, the control unit 250 combines a and b to generate a periodic communication pattern as indicated by reference numeral 407 .

Subsequently, in step 313, the controller 250 learns the deep learning model using only packets having periodic communication patterns. More specifically, the controller 250 may learn a deep learning model using long short term memory (LSTM), which is a type of deep learning algorithm based on a recurrent neural network (RNN). Through this, the controller 250 may define a normal state for communication with the plurality of IoT terminals 100 .

In step 315, if it is confirmed that the learning of the deep learning model is completed, the controller 250 performs step 317 to store the deep learning model in the memory 240. Conversely, in step 315, if it is determined that the learning of the deep learning model is not completed, the control unit 250 may return to step 303 and perform the operations of steps 303 to 313 again.

In this way, since the present invention defines the normal state of communication using a periodic communication pattern, the normal state can be automatically adjusted according to the periodicity of the communication pattern. Therefore, an effect that can be used in many industrial control systems occurs regardless of the type of IoT terminal using different communication protocols.

5 is a flowchart illustrating a method of detecting an abnormal state of communication according to an embodiment of the present invention.

Referring to FIG. 5, in step 501, the control unit 250 starts detecting an abnormal state for communication with at least one IoT terminal among the IoT terminals 100 in an industrial control system environment from the input unit 220. Check whether the signal is received. As a result of checking in step 501, if the detection start signal is received, the controller 250 performs step 503, and if the detection start signal is not received, the controller 250 waits for reception of the detection start signal.

In step 503, the control unit 250 receives a packet for detection from the IoT terminal 100 through communication with the IoT terminal 100 constructing an industrial control system environment. In step 505, the controller 250 parses the received packet for detection. Through this, the controller 250 checks the time, source IP, destination IP, function code, and target data object included in the detection packet.

In step 507, the control unit 250 separates traffic based on the source IP and the destination IP and performs separation by communication section. In step 509, the control unit 250 generates a packet sequence for each communication section to be used as an input for the deep learning model generated in step 313 of FIG. 3, and performs step 511. At this time, the control unit 250 may generate a packet sequence for both periodic communication and aperiodic communication with the IoT terminal 100.

In step 511, the controller 250 applies the generated packet sequence to the deep learning model. In step 513, the controller 250 performs step 515 when it is detected that communication with at least one IoT terminal 100 among the IoT terminals 100 is in an abnormal state as a result of applying the deep learning model, and determines that the state is not in an abnormal state. If detected, step 517 is performed. In step 515, the control unit 250 outputs an alarm notifying that an abnormal state has been detected according to the check result and performs step 517.

More specifically, the control unit 250 may distinguish normal packets from abnormal packets by matching prediction packets predicted by the deep learning model with packets for detection received from the IoT terminal 100 . The control unit 250 may check a predicted packet predicted by the deep learning model by inputting a packet sequence of a normal period to the deep learning model. The control unit 250 detects that communication with the IoT terminal 100 is in a normal state if the prediction packet predicted by the deep learning model and the detection packet are the same, and if the prediction packet and the detection packet are not identical, the control unit 250 ) can detect that communication with the IoT terminal 100 is in an abnormal state.

In step 517, the control unit 250 checks whether an end signal for terminating detection of an abnormal communication state with the IoT terminal 100 is received from the input unit 220. As a result of checking in step 517, if an end signal is received, the control unit 250 ends the corresponding process, and if the end signal is not received, it may return to step 503 and repeat the operations of steps 503 to 515.

As such, the present invention has a solid advantage against hostile attacks that induce false learning by contaminating learning packets by separately executing an operation for learning a normal communication state with the IoT terminal 100 and an operation for detecting an abnormal communication state. there is

Embodiments of the present invention disclosed in the present specification and drawings are only presented as specific examples to easily explain the technical content of the present invention and help understanding of the present invention, and are not intended to limit the scope of the present invention. Therefore, the scope of the present invention should be construed as including all changes or modifications derived based on the technical idea of the present invention in addition to the embodiments disclosed herein.

Claims (12)

Learning packets having periodic communication patterns by automatically analyzing communication patterns of learning packets received from a plurality of Internet of Things (IoT) terminals by an electronic device communicating with a plurality of Internet of Things (IoT) terminals using different communication protocols. and checking learning packets having an aperiodic communication pattern and deleting the learning packets having the aperiodic communication pattern;
generating, by the electronic device, a learning model by learning a normal state of communication with the plurality of IoT terminals based on the learning packet having the periodic communication pattern;
receiving, by the electronic device, a packet for detection through communication with the plurality of IoT terminals when the learning model is generated;
generating, by the electronic device, a packet sequence based on the detection packet; and
detecting, by the electronic device, an abnormal communication state with at least one IoT terminal among the plurality of IoT terminals by applying the packet sequence to the learning model;
A method for detecting an abnormal state of communication, comprising: According to claim 1,
The step of deleting the learning packet,
parsing the learning packet and checking information included in the learning packet;
checking the source IP and the destination IP among the information and separating the learning packet by communication section;
grouping the training packets separated for each communication section based on a function code and a target data object among the information; and
automatically analyzing the periodic communication pattern for the grouped training packets;
A method for detecting an abnormal state of communication, comprising: According to claim 2,
The step of automatically analyzing the periodic communication pattern,
Analyzing a periodic communication sequence for each group based on learning packets included in at least one group; and
generating the periodic communication pattern for each group by combining the analyzed periodic communication sequences;
A method for detecting an abnormal state of communication, comprising: delete According to claim 1,
Generating the packet sequence,
parsing the detection packet and checking information included in the detection packet;
checking a source IP and a destination IP among the information and separating the detection packets by communication section; and
generating the packet sequence for periodic communication and aperiodic communication for each communication section;
A method for detecting an abnormal state of communication, comprising: A communication unit for performing communication with a plurality of internet of things (IoT) terminals using different communication protocols; and
Automatically analyze the communication patterns of the learning packets received from the plurality of IoT terminals to identify learning packets having a periodic communication pattern and learning packets having an aperiodic communication pattern to obtain learning packets having an aperiodic communication pattern. delete, and based on the learning packet having the periodic communication pattern, learning a normal state of communication with the plurality of IoT terminals to create a learning model,
When the learning model is generated, a packet sequence is generated based on packets for detection received through communication with the plurality of IoT terminals, and the packet sequence is applied to the learning model to detect at least one IoT among the plurality of IoT terminals. a control unit that detects an abnormal state of communication with the terminal;
An electronic device performing abnormal state detection of communication, characterized in that it comprises a. According to claim 6,
The control unit,
Parsing the learning packet to check the source IP, destination IP, function code, and target data object included in the learning packet, and dividing the learning packet by communication section based on the source IP and the destination IP An electronic device that performs abnormal state detection of communication. According to claim 7,
The control unit,
Abnormal state of communication, characterized in that the grouping of the learning packets separated by the communication section based on the function code and the target data object and automatically analyzing the periodic communication pattern for the grouped learning packets. The electronics that do the detection. According to claim 8,
The control unit,
Detecting an abnormal state of communication, characterized in that the periodic communication sequence for each group is analyzed based on the learning packets included in at least one group, and the periodic communication pattern is generated for each group by combining the periodic communication sequence. electronics to perform. delete According to claim 6,
The control unit,
An electronic device for detecting an abnormal state of communication, characterized in that by parsing the detection packet, checking the detection packet information including a source IP and a destination IP, and separating the detection packet by communication section. According to claim 11,
The control unit,
An electronic device for detecting an abnormal state of communication, characterized in that the packet sequence for periodic communication and aperiodic communication is generated for each communication section.

Images