基于区域/边界规则的Modbus TCP通讯安全防御模型  

Security defense module of Modbus TCP communication based on region/enclave rules

作　　者：张盛山[1,2] 尚文利[1] 万明[1] 张华良[1] 曾鹏[1] 

机构地区：[1]中国科学院沈阳自动化研究所,辽宁沈阳110016 [2]中国科学院大学,北京100049

出　　处：《计算机工程与设计》2014年第11期3701-3707,共7页Computer Engineering and Design

基　　金：国家自然科学基金项目(61164012);国家863高技术研究发展计划基金项目(2012AA041102-03)

摘　　要：针对目前工业控制系统中新型工业病毒的入侵检测难点问题,分析Modbus通讯协议的设计缺陷,提出Modbus TCP通讯深度解析方法,通过对Modbus应用层协议的关键字段的解析,有效应对来自协议应用层的威胁。在此基础上,提出Modbus TCP通讯的安全规则描述的一般形式,并进一步提出基于入侵检测规则和"白名单"相结合的工业SCADA系统中Modbus TCP通讯安全防御模型,通过定义不同区域间正常通讯的最小集合,极大程度上消除系统存在的风险敞口,通过及时报警兼顾可能合法但可疑的通讯流量。仿真实验验证了该方法的有效性。To solve the problem that it is difficult to detect the intrusion of advanced industrial virus into the industrial control system, design flaws of Modbus TCP were analyzed, and a method was proposed, through which the Modbus TCP packet was deeply parsed to deal with the threat from the application layer. Furthermore, a normal method describing the security rule was proposed and a Modhus TCP communication protection method in the industrial control system or SCADA system that combining the IDS rule with ＂white-list＂ was designed, which defined what was necessary between different zones, thus the possibility of being attacked was diminished, while in the meantime a suspicious but probable legal packet would trigger an alarm. The simula- tion experiments validate the effectiveness of the proposed method.

关 键 词：工业通讯协议 工业控制系统 白名单 入侵检测 数据采集与监控系统 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]