Siemens Aktiengesellschaft

Siemens Ltd., China

Dai Fei Guo

Xi Feng Liu

Various embodiments include an industrial control system security analysis method. The method may include: collecting a communication data packet of interactive data transmitted between control devices in a first industrial control system; extracting network identifiable information; and determining whether it matches a pre-created event database. If the information matches: determining that the communication data packet is a malicious data packet; acquiring security policies of the first industrial control system and a second industrial control system; and determining a threat coefficient of the communication data packet for the second industrial control system based on the network identifiable information and each of the security policies, wherein the threat coefficient represents a degree of threat of the communication data packet to the second industrial control system.

Industrial control system security analysis method and apparatus

Various embodiments of the teachings herein include an industrial network behavior analysis method. The method may include: defining a first time window for a target industrial control system, for the target industrial control system to perform a control behavior; respectively determining an execution probability deviation for each control instruction within the first time window and using the execution probability to characterize the ratio of the number of times the corresponding control instruction is executed within a time period to the total number of times the control instruction within the time period; defining a second time window according to the control instruction characterizing a time period when the system performs the corresponding control behavior, and the control behavior is the same as that performed in the first time window. The method may include performing for each second time window: for each control instruction, calculating an execution probability; for each control instruction, determining whether the execution probability meets a target deviation, wherein the target execution probability deviation is the execution probability deviation of the control instruction in the first time window corresponding to the same in the second; determining that the control instruction is legal if the execution probability meets the target deviation; and determining that the instruction is suspicious if the execution probability of the control instruction does not.

Industrial network behavior analysis method, apparatus and system, and computer-readable medium

The application includes a data processing device and method. In an embodiment, the data processing device includes a data collection unit, configured to collect data transmitted in a network, and divide the collected data, according to a predetermined feature, into known attack data and unknown attack data. The data processing device further includes a data conversion unit, configured to replace, according to a mapping database, at least a portion of the content included in the unknown attack data with corresponding identification codes. Therefore, the size of data transmitted in the network can be reduced.

Network security monitoring of network traffic

Provided are a data processing method, device, and system. The data processing method comprises: acquiring a first data packet in a local client network; determining sensitive data in the first data packet; masking the sensitive data in the first data packet, and generating a second data packet from the first data packet; and sending the generated second data packet.

Data processing method, device, and system

A safety monitoring method and apparatus for an industrial control system include an advantage of quick and accurate detection of an abnormal behavior in the industrial control system. An embodiment of the method includes: providing the first data generated during the process of operating of an industrial control system and performing the first statistics on the first data; providing a result of the first statistics to a user; obtaining an operation performed by the user on the result of the first statistics; determining, based on the operation, a target time period related to the first statistics and the second data satisfying a preset condition in the first data; and obtaining a result of second statistics in the target time period, and based on the result thereof, performing the safety analysis on the industrial control system.

Growing community of inventors

Beijing, China

Dai Fei Guo