KR20180012548A - Method for discriminating of abnormal behavior in automatic control system - Google Patents

Abstract

The present invention relates to a method for discriminating abnormal behavior in an automatic control system and, more specifically, relates to a method for discriminating abnormal behavior in an automatic control system which has a programmable logic controller (PLC), a relay module, a current measurement module, and an abnormal signal detection device. The method comprises the steps of: initializing variables used in the current measurement module and the abnormal signal detection device; collecting a normal behavior pattern; storing the normal behavior pattern and signal information transmitted to the PLC in a white list database; and determining whether abnormal behavior occurs. Therefore, occurrence of abnormal behavior can be grasped in advance.

Description

Technical Field [0001] The present invention relates to a method for determining an abnormal behavior in an automatic control system,

The present invention relates to a method for determining an abnormal behavior in an automatic control system that determines whether or not an abnormal behavior occurs in an automatic control system operated in an industrial facility based on a user behavior pattern in a normal environment condition.

The information protection technology targeting the existing automatic control system has been developed as a method of performing filtering and abnormal symptom detection targeting a communication protocol dedicated to industrial automatic control such as a network-based firewall or MODEBUS.

As a prior art related to this, Korean Patent Registration No. 10-1538927 (hereinafter referred to as "Prior Art Document 1") automatically generates a sub key within the PLC, The value is encrypted to prevent exposure of variable values related to the control signal from the outside. However, in the case of the prior art document 1, it is impossible to respond to an attack that sends a signal that malfunctions the automatic control device under the same conditions as the normal signal by infecting the PC inside the automatic control system as in the recent attack type.

In Korean Patent Laid-Open Publication No. 10-2013-0071138 (hereinafter referred to as "Prior Art 2"), a source address and a port number, a destination address, and a port number included in the MODBUS protocol used for transmitting an automatic control signal The MAC address of the access control filter rule is used to prevent illegal access by the access control filter rule. However, in the case of the preceding document 2, it is not applicable to a system using a new protocol other than the applied protocol, and it is inconvenient to newly apply the access control method for each protocol.

In addition, the intrusion detection and analysis technology targeting the control system is mainly based on TCP / IP and MODBUS protocol and TCP / IP protocol, and is based on Ethernet / IP, BACnet (Building Control System), IEC61850 Research on the security of control systems targeting specific communication protocols is mainly conducted. In addition, it is not suitable as a method of applying a new security system to an existing control system which is operated without a security system, and development of a security technology for a newly installed control system is limited.

Therefore, there is a need for a technology capable of safely protecting an automatic control system by installing or using a general protocol instead of a security system that is applicable only to a specific protocol or a newly installed automatic control system.

KR 10-1538927 B1 KR 10-2013-0071138 A KR 10-1538709 B1 KR 10-1360591 B1 KR 10-2014-0118494 A KR 10-2014-0117753 A

SUMMARY OF THE INVENTION It is an object of the present invention to solve the problem that it is difficult to prevent attacks due to fraudulent manipulation that occurs inside from a specific protocol based on automatic control, And it is aimed to overcome the limit of difficulty in preventing external attack by reducing the operation error due to the illegal operation of the internal system on the protocol.

Furthermore, the present invention not only detects malfunctions that may occur in the automatic control system, system damage due to external viruses, etc., but also prevents an abnormal operation by determining in advance whether an internal user or a connection device due to a system error is over- , And to solve the economic difficulty of having various protocol-based security systems to detect anomalous indications.

According to another aspect of the present invention, there is provided a method of determining an abnormal behavior in an automatic control system, the method comprising: a PLC (Programmable Logic Controller) connected to an operation server and receiving a predetermined control signal from the operation server; A relay module for transmitting the output signal of the PLC to a plurality of loads; a current measuring module connected between the relay module and the plurality of loads for extracting power usage and usage pattern of the load; And an abnormality signal detection device for detecting an abnormality in the control signal, the method comprising the steps of: initializing variables used in the current measurement module and the abnormality signal detection device, And a use event event other than the use behavior of the operator in the abnormal signal detection apparatus The method comprising the steps of: collecting a normal behavior pattern corresponding to event information of a normal behavior in a normal environment state in which a system operation environment is maintained so that the normal operation pattern is not input; The method of claim 1, further comprising the steps of: mapping the signal information transmitted to the PLC to the PLC and storing the same in a white list database; And collecting the operation pattern in the state, and comparing the collected operation pattern with the previously stored normal pattern to determine whether an abnormal behavior has occurred.

According to the present invention, it is possible to determine whether an abnormal operation is caused by an error of an illegal or automatic control system within an automatic control system based on a command pattern of a user used in a normal state, .

In addition, according to the present invention, it is possible to solve a problem that a lot of time and expense is required for further development necessary for adding a new security function to an existing automatic control system installed and operated, It can be used universally regardless of the data format of the communication protocol.

1 is a block diagram showing a configuration of an automatic control system according to an embodiment of the present invention,
2 is a flowchart illustrating a method of determining an abnormal behavior in an automatic control system according to an embodiment of the present invention,
FIG. 3 is a flowchart illustrating in detail the step of collecting the normal behavior pattern of FIG.

The foregoing and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings. Like reference numerals refer to like elements throughout the specification.

1 is a block diagram showing a configuration of an automatic control system according to an embodiment of the present invention.

The automatic control system according to the present invention includes a PLC (Programmable Logic Controller) 120 connected to the operation server 110 and receiving a predetermined control signal from the operation server 110, A relay module 150 connected between the relay module 150 and the plurality of loads 170 to extract a power consumption and a usage pattern of the load 170, And an abnormal signal detecting device 130 provided between the PLC 120 and the relay module 150 to discriminate whether the control signal is abnormal or not.

The operation server 110 transmits a control signal corresponding to the command of the operator 10 to the PLC 120 in a state where a SCADA system for transmitting and receiving data from dozens of substations is established, Lt; / RTI >

Here, an inverter (not shown) may be further included between the PLC 120 and the relay module 150.

In this case, when the PLC 120 sends a frequency signal to the inverter in accordance with the control amount of each load 170 to send an operation signal to a plurality of devices located at the end of FIG. 1, that is, the load 170, And may be transmitted from the inverter to each load 170 corresponding to the control amount.

At this time, the current measuring module 160 measures the amount of current transferred from the inverter to each of the loads 170, and transmits the measured amount of current to the abnormal signal detecting device 130.

Here, the load 170 may include a motor, a loop fan, a freezer, and a pump as shown in FIG.

At this time, the load 170 having a rotating structure such as a motor can acquire information such as an operating position and a speed by attaching a predetermined encoder to the shaft.

Here, the current measuring module 160 may extract the power consumption and the usage pattern of each of the plurality of loads 170, and then calculate the operation range of each load 170 from the extracted information.

Here, the abnormal signal detection device 130 collects normal signal patterns that operate when a plurality of loads 170 to which an automatic control system operated in an industrial facility is applied is in a normal environmental state, constructs them into a whitelist, An apparatus for safely protecting the automatic control system from an abnormal behavior by detecting an abnormal signal of an abnormal behavior that occurs when the operating environment is in a state of being based on a normal signal pattern, S100 to S400).

In this case, the normal environment state is a state in which the system operating environment is maintained such that no use event other than the usage behavior of the operator 10 is input, and the operating environment state is a state in which the above- That is, the usage event of the operator 10 and the other usage event may be simultaneously input.

FIG. 2 is a flowchart showing an abnormal behavior discrimination method in an automatic control system according to an embodiment of the present invention, and FIG. 3 is a flowchart illustrating a step of collecting normal behavior patterns in FIG.

Hereinafter, a method of determining an abnormal behavior in an automatic control system according to an embodiment of the present invention will be described with reference to the drawings.

The method for determining an abnormal behavior according to the present invention is a method for determining an abnormal operation by using an automatic control including the operation server 110, the PLC 120, the relay module 150, the current measurement module 160, System.

First, variables used in the current measurement module 160 and the abnormal signal detection device 130 are initialized (S100).

Here, the initializing step S100 may be performed before the plurality of loads 170 are executed to collect the normal behavior pattern in the normal environment state, or may be performed before the plurality of loads 170 May be performed in a new operation.

At this time, an accumulated parameter for confirming over-operation to cause an abnormal operation of the load 170, a maximum signal parameter for confirming an operation exceeding a maximum allowable range of the load 170, Variables can be initialized or automatically changed to a preset value.

Next, the abnormal signal detection device 130 collects a normal behavior pattern corresponding to the event information of the normal behavior in the normal environment state in which the system operation environment is maintained such that the use event other than the use behavior of the operator is not inputted (S200).

Specifically, the collecting step S200 collects user activity events indicated by the operation server from the destination (that is, the load 170 connected to the end system) IP, the destination interface number, A first collecting step (S210) of collecting and classifying the data into one of a protocol and an operation command value, and collecting an operation signal for operating the load with a predetermined electrical signal based on a control signal of the operation server A third collecting step S230 of sorting and cataloging the collected user activity events and the operation signals according to the operation state and storing the same in the normal behavior pattern, The first collecting step to the third collecting step are repeatedly performed according to the usage schedule of the operator until the shutdown command is received from the operator Series (S240); it can include.

Here, the user action event collected in the first collecting step S210 is digital information, and is classified according to the type of the control device (that is, the load 170 connected to the end system) The concrete behavior information can be derived, and the purpose and importance can be distinguished.

At this time, the offset value of the user action event, which is a criterion of the action type classification in the first collecting step (S210), is a sequence value of a packet and a destination (a control device at the end, 170) < / RTI > IP, destination interface protection, transport protocol, and operation command values.

In the second collecting step S220, the abnormality signal detecting device 130 detects a signal (voltage, current, voltage) output from the PLC 120 according to an operation command instructed by the operator 10 through the operation server 110, Current, or the like), and then stores the operation signal value in a transfer parameter corresponding to each of the loads 170 connected to the end system.

Here, the ending step S240 may include repeating the normal action pattern collection process (S210 to S230) according to the usage schedule of the operator 10, while repeating the operation event signal (behavior pattern) And stores the signal values as a normal behavior pattern in a normal environment state after cataloging the operation state at the time of generating the operation event signal.

If the termination command is received from the operator 10, all the information collected through the normal behavior pattern collection process described above is stored in the white list database 140, and then, based on the stored data, The behavior pattern is determined.

Next, the normal action pattern collected by the abnormal signal detection device 130 and the signal information transmitted to the PLC 120 at the time of occurrence of the normal action pattern are mapped together and stored in the white list database 140 (S300) .

In this case, the abnormal signal detection device 130 receives the offset value directly from the operation server 110 and stores the offset value in the white list database 140, and also collects the PLC output analog signal that is directly mapped to the stored event .

Next, the abnormal signal detection device 130 collects the operation pattern in the operation environment state, in which the use behavior of the operator and other use event other than the normal environment state can be inputted at the same time, And comparing the normal behavior pattern with the previously stored normal behavior pattern (S400).

Here, the determining step S400 may include comparing an operation sequence of the control signal output from the PLC 120 with the operation sequence of the normal behavior pattern when the operation environment state is the state, It is determined that the abnormal behavior has occurred.

At this time, the operation sequence may indicate a sequence value of a packet including the offset value collected in the first collecting step (S210).

Meanwhile, if it is determined in step S400 that the abnormal operation has occurred, the abnormal operation discrimination method in the automatic control system according to an embodiment of the present invention may include sending an abnormal operation alarm signal of the load 170 to the operation server 110 to the mobile terminal.

In this case, since the alarm signal is automatically transmitted to the operation server 110 when the abnormal operation is automatically performed without continuous monitoring by the operator 10, the operator 10 at the remote location can immediately recognize whether the abnormal operation has occurred.

In addition, the method for determining the abnormal behavior in the automatic control system according to an embodiment of the present invention may further include the step of, when the difference value in step S400 exceeds the predetermined maximum threshold value, And transmitting the generated information to the operation server 110. [

In this case, the operation of the load 170 is restricted independently of the operation command of the operator 10 by reporting an abnormal signal due to the abnormal operation to the predetermined load 170 connected to the end of the automatic control system, It is possible to prevent errors and damages in the inside of the battery 170.

As described above, the method for determining the abnormal behavior in the automatic control system according to the present invention is a technology for detecting the abnormal operation signal and the malfunction signal in the control system in order to ensure the availability of the industrial basic facility. This system is used for automatic control system verification and detection of malicious signals as a method for effectively detecting a cyber attack that may occur in an automatic control system that controls and operates the system.

In the case of the present invention, the control signal transmitted from the automatic control system is analyzed and verified using the open-source-based large-capacity data analysis platform, and the control signal transmitted from the control device, that is, Or abnormal operation, and detects whether the control signal transmitted by the pattern matching method from the internal variable for detecting the abnormal operation is a normal signal or a signal for an abnormal operation.

Thus, according to the present invention, it is possible to judge and check whether an over-actuation signal command due to an error of an illegal or automatic control system exists in an automatic control system based on a command pattern of a user used in a normal state, Can be grasped in advance.

Further, according to the present invention, it is possible to solve a problem that a lot of time and cost are incurred for further development required when adding a new security function to an existing automatic control system installed and operated, It can be used universally regardless of the data format of the communication protocol.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. It should be appreciated by those of skill in the art that it can be used immediately as a basis for designing or modifying other features for a particular application.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the inventions. You will understand. Therefore, it should be understood that the disclosed embodiments are to be considered in an illustrative rather than a restrictive sense, and that various modifications and changes may be made without departing from the spirit and scope of the invention as defined in the appended claims and equivalents thereof All differences should be construed as being included in the present invention.

10: Operator 110: Operational server
120: PLC 130: abnormal signal detection device
140: Whitelist database 150: Relay module
160: Current measurement module 170: Load

Claims (5)

A PLC (Programmable Logic Controller) connected to the operation server and receiving a predetermined control signal from the operation server; a relay module for transmitting the output signal of the PLC to a plurality of loads; And an abnormality signal detection device which is provided between the PLC and the relay module and discriminates whether the control signal is abnormal or not. In the abnormal behavior discrimination method,
Initializing variables used in the current measurement module and the abnormal signal detection device;
Collecting a normal behavior pattern corresponding to event information of a normal activity in a normal environment state in which the system operation environment is maintained so that the use event other than the usage event of the operator is not input in the abnormal signal detection device;
Mapping the normal behavior pattern collected by the abnormal signal detection device and the signal information transmitted to the PLC at the time of occurrence of the normal behavior pattern, and storing the mapped signal information in the white list database; And
The abnormality signal detection apparatus collects an operation pattern in an operating environment state in which the use behavior of the operator and the use event other than the normal environment state can be inputted at the same time, And comparing the behavior patterns to determine whether an abnormal behavior has occurred or not. The method according to claim 1,
Wherein the collecting comprises:
A first collecting step of classifying and collecting user activity events indicated by the operation server in the normal environment state into any one of a destination (end system) IP, a destination interface number, a transmission protocol, and an operation command value;
A second collecting step of collecting an operation signal for operating the load with a predetermined electrical signal based on a control signal of the operation server;
A third collecting step of classifying and collecting the collected user activity events and the operation signals according to the operation state, and storing the collected list in the normal behavior pattern; And
And repeating the first collecting step to the third collecting step according to the use schedule of the operator until the end command is received from the operator through the operating server. How to Identify an Abnormal Activity in. The method according to claim 1,
Wherein the determining step comprises:
When the operation state of the control signal outputted from the PLC is compared with the operation sequence of the normal behavior pattern and the difference value exceeds the error range of the predetermined operation range, A method for determining an abnormal behavior in an automatic control system. The method of claim 3,
And transmitting an abnormal operation alarm signal of the load to the operation server when it is determined that the abnormal operation has occurred. The method of claim 3,
And generating an event limiting the operation of the load and transmitting the generated event to the operation server when the difference value exceeds a preset maximum threshold value. .

Images