WO2015024315A1

WO2015024315A1 - Network intrusion alarm method and system for nuclear power station

Info

Publication number: WO2015024315A1
Application number: PCT/CN2013/087737
Authority: WO
Inventors: 孙永滨; 刘高俊; 王婷; 孙奇; 张建波; 何大宇; 陈卫华; 黄伟军; 彭华清; 王春冰; 段奇志; 杨华龙
Original assignee: 中广核工程有限公司; 中国广核集团有限公司
Priority date: 2013-08-19
Filing date: 2013-11-24
Publication date: 2015-02-26
Also published as: GB201602102D0; GB2532630A; CN103888282A; GB2532630B

Abstract

Disclosed is a network intrusion alarm method for a nuclear power station, which comprises: detecting data information sent by an access object, the detection comprising misuse detection and protocol abnormality data detection; if the result of the data information detection is abnormal, generating instant pre-alarm information; matching the instant pre-alarm information with historical pre-alarm information in a database; and if the matching result of the instant pre-alarm information and the historical pre-alarm information does not conform to a pre-set matching value, sending intrusion alarm information. The network intrusion alarm method for a nuclear power station of the present invention effectively satisfies the requirements of a nuclear power station industry network for network security protection. In addition, further disclosed is a network intrusion alarm system for a nuclear power station.

Description

Nuclear power plant network into 4 MAN alarm method and system

Technical field

The invention belongs to the field of nuclear power station security, and particularly relates to a network intrusion alarm method and system for a nuclear power plant. Say

BACKGROUND Intrusion Detection System (IDS) refers to a system for identifying and processing malicious use behaviors of computers and network resources. As the scale of the network grows larger and larger, the resources on the network become more and more abundant, and the threats from the network are increasing, and the attacks are more and more secret. The data of nuclear power operation is related to national security and social stability. Therefore, it is imperative to construct a network security system to ensure the security of the data center. The industrial control system, including the nuclear power plant control system, is an independent network because it is not connected to the Internet. Under normal circumstances, it will not have a virus, and outside hackers can not attack. In addition, the usual hacker and network virus attacks are directed at computer devices, and there is generally no virus for control devices in the industrial control system network. In the nuclear power control system, with the development of information technology, due to the convenience of integration and use of nuclear power systems, the industrial Ethernet ring network and (OLE for Process Control, OPC) communication protocol are widely used for the integration of nuclear power control systems. At the same time, PC servers and terminal products have also been used extensively. Nuclear power operating systems and databases have also used a large number of general-purpose systems. Although the nuclear power industry network is not connected to the internet, nuclear power plants have developed many specifications. However, in reality, people often fail to comply with the regulations. For example, using a USB flash drive to interact with the nuclear power industry network and using undetected optical discs can easily lead to attacks from viruses, Trojans, and hackers from the corporate management network or the Internet. And this can lead to failures in the actual physical system. The data of nuclear power operation is related to national security and social stability. Therefore, it is imperative to construct a network security system to ensure the security of the data center. The existing network security system usually consists of a firewall, anti-virus software, and an Intrusion Detection System (IDS) or an Intrusion Prevention System (IPS). However, the commercial intrusion detection system is not deployed in the nuclear power control system for network defense, or the deployed commercial intrusion detection system is also an intrusion detection system based on misuse detection. Since the nuclear power industry network is not connected to the Internet, the virus database for intrusion detection cannot be updated in time in the nuclear power industry network. It is impossible to detect a new virus or a virus designed for a specific industrial control system using a commercial intrusion detection system.

Therefore, how to detect and warn against virus intrusion from the network is an urgent issue for nuclear power security.

Summary of the invention

The object of the present invention is: a nuclear power control system provides a network intrusion alarm method and system based on a nuclear power plant for virus intrusion from a network, and improves the network intrusion by the nuclear power plant control system by using an anomaly detection technology and a misuse detection technology. The detection capability and the perfection of the intrusion alarm mechanism effectively meet the requirements of the nuclear power plant industrial network for network security protection.

In order to achieve the above object, the present invention provides a network intrusion alarm method for a nuclear power plant, which includes:

Detecting data information sent by the access object, where the detection includes misuse detection and protocol abnormal data detection;

If the result of detecting the data information is abnormal, generating an instant warning information;

Matching the instant warning information with historical warning information in the database;

If the matching result of the instant warning information and the historical warning information does not meet the preset matching value, the intrusion alarm information is sent.

As an improvement of the network intrusion method of the nuclear power plant of the present invention, the method further includes: As an improvement of the network intrusion alarm method of the nuclear power plant of the present invention, the historical early warning information includes a field of the number of early warnings, and if the matching result of the instant warning information and the historical early warning information meets a preset matching value, the early warning The number of times increases.

As an improvement of the network intrusion method of the nuclear power plant of the present invention, the method further includes: performing association analysis on the instant warning information and the historical early warning information, and determining the access object according to a preset association rule. Purpose of the visit.

As an improvement of the network intrusion method of the nuclear power plant of the present invention, the method further includes: if the access purpose of the access object cannot be determined according to a preset association rule, establishing a new association rule according to the instant warning information, And update the association rules in real time.

As an improvement of the network intrusion method of the nuclear power plant of the present invention, the method further comprises: saving the instant warning information to a database, and updating the database.

As an improvement of the network intrusion method of the nuclear power plant of the present invention, the method further includes: performing blocking of the IP address or port access of the access object according to the intrusion alarm information.

In order to achieve the above object, the present invention also provides a network intrusion alarm system for a nuclear power plant, comprising:

a detecting module, configured to detect data information sent by the access object, where the detecting includes misuse detection and protocol abnormal data detection;

The warning module is configured to generate instant warning information if the result of detecting the data information by the detecting module is abnormal;

a matching module, configured to match the early warning information generated by the early warning module with historical warning information in a database;

The alarm module is configured to: if the matching result of the instant warning information and the historical warning information does not meet the preset matching value, issue an intrusion alarm message.

As an improvement of the network intrusion "3" alarm system of the nuclear power plant of the present invention, the system further includes: a receiving module, configured to receive data information sent by the access object. As an improvement of the network intrusion "3⁄4" alarm system of the nuclear power plant of the present invention, the system further includes: a database, configured to store historical warning information, wherein the historical early warning information includes a field of the number of early warnings, if the instant warning information and the The matching result of the historical warning information meets a preset matching value, and the number of the warnings is increased once.

As an improvement of the network intrusion "3" alarm system of the nuclear power plant of the present invention, the system further includes: an analysis module, configured to perform correlation analysis on the instant warning information and the historical early warning information, and determine according to a preset association rule The access purpose of the access object.

As an improvement of the network intrusion "3" alarm system of the nuclear power plant of the present invention, the system further includes: an adaptive module, configured to save a preset association rule, if the analysis module cannot determine the according to a preset association rule Accessing the object's access purpose, establishing a new association rule according to the instant warning information, and updating the association rule in real time.

As an improvement of the network intrusion "3" alarm system of the nuclear power plant of the present invention, the system further includes: an update module, configured to save the instant warning information to a database, and update the database. As a network intrusion of the nuclear power plant of the present invention An improvement of the alarm system, the system further comprising: an execution module, configured to perform blocking of an IP address or port access of the access object according to the intrusion alarm information.

Compared with the prior art, the network intrusion alarm method and system of the nuclear power plant of the invention has the following beneficial technical effects:

Through the misuse detection and protocol abnormal data detection of the data information sent by the access object, the analysis and matching are performed on the basis of the above detection, and the alarm is performed according to the matching result, thereby realizing the invasion of the adaptive network environment of the nuclear power plant control system; By combining the abnormal detection technology and misuse detection technology, the detection capability and alarm mechanism of the nuclear power plant control system for network intrusion are improved, and the requirements of the nuclear power plant industrial network for network security protection are effectively met, and good technical results are obtained. DRAWINGS

The network intrusion alarm method and system of the nuclear power plant of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments, wherein:

1 provides a flow chart of one embodiment of a network intrusion alarm method for a nuclear power plant of the present invention.

Figure 2 provides a schematic diagram of one embodiment of a network intrusion alarm system for a nuclear power plant of the present invention.

Figure 3 provides a schematic diagram of yet another embodiment of a network intrusion alarm system for a nuclear power plant of the present invention. detailed description

The present invention will be further described in detail below with reference to the drawings and embodiments. The specific embodiments described in the specification are to be construed as illustrative only and not limiting.

Network intrusion detection technology is divided into two categories: misuse detection technology and anomaly detection technology according to its working principle. The misuse detection technology is based on the matching of data message features. This detection technology has high accuracy, but the problem is that the new intrusion mode cannot be found and the omission is reported. Anomaly detection technology, such as Protocol Anomaly Detection System (PADS), establishes a description model of normal network behavior based on data such as network connection characteristics, system call characteristics, network traffic characteristics, and system delay characteristics. When the activity deviates significantly from normal behavior, it is considered to be an intrusion. The detection technology can discover new network intrusion, but there is a problem that the false positive rate is high and a large number of training samples are needed. At present, the combination of misuse detection technology and anomaly detection technology in the field of nuclear power control systems is still blank.

Referring to FIG. 1 , FIG. 1 provides a network intrusion alarm method for a nuclear power plant, which specifically includes: Step 101: Detecting data information sent by an access object, including detection of misuse detection and protocol abnormal data detection.

The nuclear power intrusion alarm management system receives the data information sent by the access object, and specifically, the accessed data information enters the control system application server through the switch. Intrusion Detection Alert Management System (IDAMS) installed in a computer server The ND-IDAMS obtains the data information of the accessed object through the switch.

The nuclear power intrusion alarm management system receives the data information sent by the access object. Optionally, the access object can also send data information to the nuclear power plant control system through the server.

The nuclear power intrusion alarm management system detects the data information sent by the access object, including: the detection includes misuse detection and protocol abnormal data detection. Specifically, the nuclear power intrusion alarm management system calls the misuse detection module to detect the data information; further, the protocol abnormal data detection for the data information PADS, PADS can use the Markov model to detect the protocol in the network data.

Optionally, the nuclear power intrusion alarm management system can detect data information through a networked commercial intrusion detection system (IPS or IDS). The nuclear power intrusion alarm management system can be connected to multiple commercial intrusion detection systems (IPS or IDS).

Step 103: Generate an instant warning information if the result of detecting the data information is abnormal.

Through the detection of normal data, the relevant system can be accessed normally. If the result of detecting the data information is abnormal, the nuclear power intrusion alarm management system generates instant warning information.

Step 105: Match the instant warning information with the historical warning information in the database.

Specifically, the nuclear power intrusion alarm management system matches the instant warning information with the historical warning information stored in the database, and the classification algorithm determines that the historical warning information exists in the database and is the same as the instant warning information.

Optionally, the foregoing method further includes: pre-setting a matching value between the instant warning information and the historical warning information.

Optionally, the matching value of the instant warning information and the historical warning information may be preset. For example, if the matching value is set to 75%, if the instant warning information and the historical warning information are more than 75% (including 75%), the instant warning information is matched with the historical warning information. Match values can be adjusted as needed.

If the historical warning information matching the instant warning information is found, it is classified into the same type of early warning. No matter how many instant warning information is available, as long as it matches the historical warning information, the return of the early warning information is the historical warning information, which can be greatly Reduce the repeatability of similar warnings. Optionally, the historical warning information includes a field of the number of warnings. If the matching result of the instant warning information and the historical warning information meets a preset matching value, the number of warnings increases once. For example, the historical warning information includes at least the content of the warning and the number of warnings. When the instant warning information matches the historical warning information, the content of the warning is unchanged, and the number of warnings is increased once.

Further, correlation analysis is performed on the instant warning information and the historical warning information, and the access purpose of the access object is determined according to the association rule set in advance.

Step 107: If the matching result of the instant warning information and the historical warning information does not meet the preset matching value, the intrusion alarm information is sent.

For example, if the matching value is set to 75%, if the instant warning information and the historical warning information are less than 75%, the immediate warning information and the historical warning information are determined to be mismatched. If the matching result of the instant warning information and the historical warning information does not meet the preset matching value, the nuclear power intrusion alarm management system issues the intrusion alarm information.

If the access purpose of the access object cannot be determined according to the preset association rule, a new association rule is established according to the instant warning information, and the association rule is updated in real time.

The received real-time warning information cannot find historical warning information of similar or matching matching values in the database. Confirmed by the administrator, and establish a new alert fusion classification, association rules for it. View the attack alert association table that has occurred, and the administrator can update the association rules that have occurred.

Further, the instant warning information is saved to the database, and the database is updated. Establish new early warning fusion classification and association rules, and update the database in real time.

Further, the IP address or port access of the blocking access object is performed according to the intrusion alarm information. Associate with a firewall or IPS to block access to the IP address or port to which the access object belongs.

By performing misuse detection and protocol abnormal data detection on the data information sent by the access object, analysis and matching are performed on the basis of the above detection, and an alarm is performed according to the matching result. The intrusion of the adaptive network environment of the nuclear power plant control system is realized. At the same time, by combining the abnormal detection technology and the misuse detection technology, the detection capability and alarm mechanism of the nuclear power plant control system for network intrusion are improved, which effectively satisfies The requirements of the nuclear power plant industrial network for network security protection have achieved good technical results.

2 provides a schematic diagram of one embodiment of a network intrusion alarm system for a nuclear power plant, including: a detection module 201, an early warning module 203, a matching module 205, and an alarm module 207. Specifically, the detecting module 201 is configured to detect data information sent by the access object, and the detecting includes misuse detection and protocol abnormal data detection;

The warning module 203 is configured to generate an instant warning information if the result of detecting the data information by the detecting module 201 is abnormal;

The matching module 205 is configured to match the generated early warning information generated by the early warning module 203 with the historical warning information in the database;

The alarm module 207 is configured to issue an intrusion "3⁄4" alarm information if the matching result of the instant warning information and the historical warning information does not meet the preset matching value.

For the implementation method and the process of the system, refer to the method embodiment described in the foregoing embodiment, and details are not described herein again.

Referring to Figure 3, Figure 3 provides a schematic diagram of one embodiment of a network intrusion alarm system for a nuclear power plant. The system includes: a receiving module 301, a detecting module 303, an alerting module 305, a matching module 307, an alarm module, an updating module 311, a database 313, an analyzing module, an adaptive module 317, and an executing module 319. specific,

The receiving module 301 is configured to receive data information sent by the access object.

Specifically, the accessed data information enters the control system application server through the switch. The receiving module 301 in the nuclear power intrusion alarm management system ND-IDAMS installed in the computer server obtains the data information of the access object through the switch.

The receiving module 301 receives the data information transmitted by the access object. Optionally, the access object may also send data information to the nuclear power plant control system through the server, and then the receiving module 301 receives the data information.

The detecting module 303 is configured to detect data information sent by the access object, where the detecting includes misuse detection and protocol abnormal data detection; The detecting module 303 detects the data information sent by the access object received by the receiving module 301, and includes: the detecting module 303 detects the misuse detection and the protocol abnormal data detection. Specifically, the detecting module 303 performs protocol anomaly data detection PADS on the data information, and the PADS can detect the protocol in the network data by using the Markov model.

Optionally, the detection module 303 can detect the data information through a networked commercial intrusion detection system (IPS or IDS). The detection module 303 can be connected to a plurality of commercial intrusion detection systems (IPS or IDS).

The warning module 305 is configured to generate an instant warning information if the result of detecting the data information by the detecting module is abnormal;

The detecting module 303 can detect the passed normal data to access the related system normally. If the result of detecting the data information is abnormal, the early warning module 305 generates the instant warning information.

The matching module 307 is configured to match the generated early warning information generated by the early warning module 35 with the historical warning information in the database;

Specifically, the matching module 307 matches the instant warning information with the historical warning information stored in the database, and determines, by the classification algorithm, that the historical warning information exists in the database 313 is the same as the instant warning information.

Optionally, the system further includes a setting module, configured to preset a matching value between the instant warning information and the historical warning information.

Optionally, the matching module 307 can preset a matching value that matches the real-time warning information with the historical warning information. For example, if the matching value is set to 75%, if the instant warning information and the historical warning information are more than 75% (including 75%), the instant warning information is matched with the historical warning information. Match values can be adjusted as needed.

If the historical warning information matching the instant warning information is found, it is classified into the same type of early warning. No matter how many instant warning information is available, as long as it matches the historical warning information, the return of the early warning information is the historical warning information, which can be greatly Reduce the repeatability of similar warnings.

The database 313 is configured to save historical warning information, and the historical warning information includes a field of the number of early warnings. If the matching result of the instant warning information and the historical warning information meets the preset matching value, the number of warnings is increased once. For example, the historical warning information includes at least the content of the warning and the number of warnings. When the instant warning information matches the historical warning information, the content of the warning is unchanged, and the number of warnings is increased once.

If the instant alert information does not match the historical alert information, the update module 311 is configured to save the instant alert information to the database 313 and update the database 313.

The analysis module 315 is configured to perform association analysis on the instant warning information and the historical warning information, and determine the access purpose of the access object according to the association rule set in advance.

The adaptation module 317 is configured to save a preset association rule. If the analysis module 315 cannot determine the access destination of the access object according to the preset association rule, the adaptation module 317 establishes a new association rule according to the instant warning information, and updates the file immediately. Association rules.

The alarm module 309 is configured to: if the matching module 307 determines that the matching result of the instant warning information and the historical warning information does not meet the preset matching value, issue the intrusion alarm information.

The executing module 319 is configured to perform blocking of the IP address or port access of the access object according to the intrusion alarm information.

As can be seen from the above detailed description of the present invention, the present invention has at least the following advantageous technical effects with respect to the prior art:

Through the misuse detection and protocol abnormal data detection of the data information sent by the access object, the analysis and matching are performed on the basis of the above detection, and the alarm is performed according to the matching result, thereby realizing the invasion of the adaptive network environment of the nuclear power plant control system; Combined with anomaly detection technology and misuse detection technology, the detection capability and alarm mechanism of the nuclear power plant control system for network intrusion are improved, and the requirements for network security protection of the nuclear power plant industrial network are effectively met. In addition, since the intrusion alarm information is discovered in time, it can pass Adaptively constantly update the database and intrusion types, and perform policy processing alarms, such as blocking IP or ports, so that nuclear power plant control security is guaranteed, and good technical results are achieved.

According to the above principle, the present invention can also be appropriately modified and modified as described above. Therefore, the invention is not limited to the specific embodiments disclosed and described above, some modifications of the invention And modifications are also intended to fall within the scope of the appended claims. In addition, although specific terms are used in the specification, these terms are merely for convenience of description and do not limit the invention.

Claims

Claim

A nuclear power plant network intrusion alarm method, characterized in that the method comprises:

2. The method according to claim 1, wherein the method further comprises:

Receive data information sent by the access object.

The method according to claim 2, wherein the method further comprises:

The matching value of the instant warning information and the historical warning information is preset.

The method according to claim 2, wherein the historical warning information includes a field of the number of warnings, and if the matching result of the instant warning information and the historical warning information meets a preset matching value, The number of warnings is increased once.

The method according to claim 2, wherein the method further comprises:

And correlating the instant warning information with the historical early warning information, and determining an access destination of the access object according to a preset association rule.

The method according to claim 5, wherein the method further comprises:

The method according to claim 6, wherein the method further comprises:

The instant alert information is saved to a database and the database is updated.

The method according to claim 7, wherein the method further comprises: Performing blocking of the IP address or port access of the access object according to the intrusion alarm information.

A nuclear power plant network intrusion alarm system, characterized in that the system comprises:

The system according to claim 9, wherein the system further comprises:

The receiving module is configured to receive data information sent by the access object.

The system according to claim 10, wherein the system further comprises: a setting module, configured to preset a matching value of the instant warning information and the historical warning information.

The system according to claim 9, wherein the system further comprises:

The database is configured to save the historical warning information, where the historical early warning information includes a field of the number of early warnings. If the matching result of the instant warning information and the historical early warning information meets a preset matching value, the number of the early warnings is increased once.

The system according to claim 12, wherein the system further comprises: an analysis module, configured to perform association analysis on the instant warning information and the historical early warning information, and determine the location according to a preset association rule The access purpose of the access object.

The system according to claim 13, wherein the system further comprises: an adaptation module, configured to save a preset association rule, if the analysis module cannot determine the access according to a preset association rule The purpose of the object is to establish a new association rule according to the instant warning information, and update the association rule in real time.

The system according to claim 14, wherein the system further comprises: an update module, configured to save the instant warning information to a database, and update the database.

The system according to claim 15, wherein the system further comprises: an execution module, configured to perform blocking of an IP address or port access of the access object according to the intrusion alarm information.