PHYSICAL INTRUSION ATTACK DETECTION METHOD FOR INDUSTRIAL CONTROL SYSTEM BASED ON SERIAL COMMUNICATION BUS SIGNAL ANALYSIS

摘要

Provided is a physical intrusion attack detection method for an industrial control system based on serial communication bus signal analysis. A detection signal is actively sent to a communication bus by means of a bus controller. After a monitoring device carries out sampling and analysis on signals of the communication bus, differential comparison is performed on the signals with a standard signal stored in a device database, and noise reduction technology and weak signal detection technology are used to detect an intrusion signal in difference signals. According to a detection result of an intrusion signal caused by a physical intrusion device, any external malicious device in a system can be quickly and effectively determined, and the security state regarding whether the system is subjected to a physical intrusion attack is determined. The technical problem that the network security of a serial communication bus of an industrial control system attacked by a physical intrusion cannot be effectively detected by an existing network defense method is solved.