公开(公告)号：KR101079036B1

公开(公告)日：2011-11-03

申请号：KR1020100050071

申请日：2010-05-28

Applicant: 한국전자통신연구원

Inventor： 장문수 ,  김우년 ,  민병길 ,  김신규 ,  이건희 ,  서정택 ,  이철원

IPC: H04L12/22 ,  G06F17/30

CPC classification number: H04L63/1416 ,  H04L63/20

Abstract: PURPOSE: An apparatus and method for detecting abnormality in control system network are provided to make a normal behavior model of a control system and to detect the violation of a normal behavior model. CONSTITUTION: A normal behavior model database(207) stores normal behavior model information for generating a result of a normal behavior modeling module. An abnormal event detecting module(208) determines whether to compare normal behavior model information with packet data that is extracted by a packet preprocessing module. A manager interface(210) generates control network state information from the packet preprocessing module.

Abstract translation: 目的：提供一种用于检测控制系统网络异常的装置和方法，以建立控制系统的正常行为模型，并检测违反正常行为模型。 规定：正常行为模型数据库（207）存储用于生成正常行为建模模块的结果的正常行为模型信息。 异常事件检测模块（208）确定是否将正常行为模型信息与由分组预处理模块提取的分组数据进行比较。 管理接口（210）从分组预处理模块生成控制网络状态信息。