工业控制系统信息安全审计系统分析与设计

Analysis and Design of ICS Information Security Audit System

目前工业控制系统(Industrial Control System,ICS)广泛应用于电力、水利、交通运输、大型制造行业以及国家基础公共设施,已经成为国家安全战略的重要部分。传统的信息安全防护技术(如防火墙技术、入侵检测技术等)因其技术原理和适用协议的差异,使工业控制系统不能取得很好的防范效果。为了有效地提高ICS的安全防护能力,该文针对ICS的数据特点以及协议特点设计了一款ICS信息安全审计系统,该审计系统主要由数据采集模块、内容检测模块、异常行为判断模块、行为处理模块、审计响应模块等组成。实验结果表明,本系统能够对ICS进行全方位的安全审计,能够极大程度地提高ICS的安全防护能力。

At present, Industrial control system（ICS） is widely used in electric power, transportation, water conservancy, large manufacturing industry and national critical infrastructure. ICS has become the important part of the national security strategy. However, the traditional information security technology（such as firewall technology, intrusion detection technology, etc. ） has the different technical principle and the different network protocol, and doesn＇t have a good protection effect in ICS. In order to effectively improve the Industrial control system information security（ICSIS） pro- tection, based on the specific data and protocol and the highly real-time requirement, this paper designed an ICSIS audit system, which mainly includes data acquisition module, content detection mo-dule, abnormal behavior judgment module, behavior handling module, audit response module. The testing results show that the ICSIS audit system can comprehensive audit the ICS, and the use of ICSIS audit system can greatly improve the ICS safety protection ability.