US 11,843,639 B2
Industrial control system security analysis method and apparatus
Dai Fei Guo, Beijing (CN)
Assigned to SIEMENS LTD., CHINA, Beijing (CN)
Appl. No. 17/927,930
Filed by Siemens Ltd., China, Beijing (CN)
PCT Filed May 29, 2020, PCT No. PCT/CN2020/093522
§ 371(c)(1), (2) Date Nov. 28, 2022,
PCT Pub. No. WO2021/237739, PCT Pub. Date Dec. 2, 2021.
Prior Publication US 2023/0199029 A1, Jun. 22, 2023
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/20 (2013.01) [H04L 63/1408 (2013.01)] 6 Claims
OG exemplary drawing
 
1. An industrial control system security analysis method comprising:
collecting a communication data packet from a first industrial control system, wherein the communication data packet comprises interactive data transmitted between control devices in the first industrial control system;
extracting network identifiable information from the communication data packet, wherein the network identifiable information identifies at least one of a communication object, a communication rule, and a communication content;
determining whether the network identifiable information matches a pre-created event database;
if the network identifiable information matches the event database, performing the following:
determining that the communication data packet is a malicious data packet;
acquiring security policies of the first industrial control system and a second industrial control system, wherein the security policies include rules for processing a malicious data packet; and
determining a threat coefficient of the communication data packet for the second industrial control system based on the network identifiable information and each of the security policies, wherein the threat coefficient represents a degree of threat of the communication data packet to the second industrial control system;
wherein after acquiring security policies of the first industrial control system and the second industrial control systems respectively, the method further comprises:
determining target control devices having a risk of being attacked by the communication data packet in the OT network according to extracted network identifiable information and the security policies;
determining a threat coefficient of the communication data packet for each target control device respectively according to the network identifiable information;
sending the threat coefficient for each of the target control devices to a manager; and
generating optimization suggestions for optimizing at least one of said acquired security policies according to the network identifiable information after receiving a confirmation instruction sent by the manager according to the threat coefficient for each target control device.