Intrusion Detection System For Industry Control System

With the rapid evolution of computer technology and the widespread use of general development standard and Internet technology, industrial control systems become more open, which, simultaneously, makes the attacks against industrial control system show a substantial increase. Security incidents related with industrial control system frequently happen, means of attacks against the industrial control system become increasingly complicated and diversified, which lead to severe consequences. Being as an essential part of national strategy, the information security of Industrial control system is particularly important, therefore, many countries have sped up the research of information security protection of the industrial control system. Intrusion detection technology, as one of the effective means to prevent the attack against industrial control system, is also a frontier topic no matter in today’s domestic or foreign research.This paper analyzes the current security status of industrial control system, and illustrates its fragility and safety protection requirements. Specifically, on the basis of analyzing the methods of traditional intrusion detection, we elaborated the functional demands of the intrusion detection model, and made an overall design for the intrusion detection model of industrial control system. In this paper, we put forward a kind of composite intrusion detection model orienting industrial control system. This model consists of three parts, including intrusion detection engine, sub-model of intrusion detection based on misuse detection technology and sub-model based on abnormal detection technology respectively, and we conducted the detailed design particularly for the latter two sub-models. Finally, with regard to smart substation, this paper has carried on the typical design and deployment for intrusion detection system, and implemented DoS experiment based on the smart substation, emphatically evaluated the false positives rates, false negatives rates, and accuracy rates caused by composite intrusion detection model, and we obtained the good experimental results through verifying the effectiveness of the proposed model.The proposed composite intrusion detection model for industrial control system in this paper can play a protective role in systems that do not possess powerful computing capacity and sufficient memory, additionally, it does not influence the business requirements of the original system. Under the condition of the monitoring system not affected, this model is easy to be integrated into the original system.