基于Snort的PROFINET入侵检测系统设计

Design of PROFINET Intrusion Detection System Based on Snort

近年来工业化与信息化的不断融合使工厂的管理更加透明化,企业的效率和效益也得到很大提升。随着工控行业信息化建设的不断推进,产生的工控安全问题也愈发突出。以Snort入侵检测系统和PROFINET协议为研究对象,设计了一款预处理器插件扩展到原有Snort系统中。实现了Snort对PROFINET协议的解析与识别,并通过设计模拟攻击实验验证了改进后的Snort系统能够对异常PROFINET协议进行实时检测与报警,从而保护了PROFINET IO通信系统的安全。

This paper takes Snort intrusion detection system and PROFINET protocol as the research object,and designs a preprocessor plugin to extend into the original Snort system.The Snort analysis and identification of the PROFINET protocol is realized,and the simulated Snaut system can verify the real-time detection and alarm of the abnormal PROFINET protocol by designing the simulation attack experiment,thus protecting the security of the PROFINET IO communication system.