核电仪控系统的网络安全监测

Cyber Security Monitoring for I&C Systems of NPPs

仪表和控制系统作为核电厂"中枢神经"的重要组成部分,对于核电厂安全稳定的运行起到关键的作用。近年来,数字化仪控系统遇到网络安全的新问题,即预防、检测和应对针对仪控系统实施的运用数字化手段的恶意行为。这种网络攻击将致使电厂性能下降,实体设备受损,甚至引发事故工况。依据核电厂"纵深防御"的安全设计理念和国内外法规标准的要求,提出应对核电仪控系统实施网络安全监测。网络安全监测的实施方案为,在仪控系统中部署入侵检测系统,监视并分析仪控系统事件,发现未经授权访问仪控系统资源的尝试并给出报警。本文详细分析了部署入侵检测系统需要考虑的检测点部署位置、监测数据源、入侵检测方法3个方面的问题,并给出了评价方式。

The instrumentation and control （I＆C） system serves as the important part of the ＂central nervous system＂ of a nuclear power plant （NPP）. It is critical for the safe and stable operation of nuclear power plants. The transition from analog systems to digital I＆C systems has brought in the new issue of cyber security. The cyber security problem is that the operation of I＆C systems is possible to be interfered by the malicious cyber intrusions from either outsiders or insiders. These cyber intrusions may lead to the degradation of plant performance, the equipment damage, or even accident condition. We propose to conduct the cyber security monitoring for I＆C systems of nuclear power plants in accordance with the concept of defense-in-depth and the requirement of regulations and standards. The implementation of cyber security monitoring is to deploy the intrusion detection system that monitors and analyzes I＆C systems events, for the purpose of finding and providing warnings of attempts to access I＆C systems resources in an unauthorized manner. Three aspects of intrusion detection systems including the deployment, the data source, and the intrusion detection are analyzed in detail and the assessment criterion are giver.