Product Overview

Industrial control intrusion detection system is a detection and audit security product specially designed for industrial Internet attack threats. The product is equipped with a professional industrial control attack rule library, covering various types of attack features such as buffer overflow, scan attacks, DoS/DDoS, SQL injection, worm viruses, Trojans, backdoors, etc; At the same time, website filtering, email filtering, application recognition and control can be developed according to business functional requirements to match the behavior of captured data packets on the industrial control network, timely detect attack threats from both internal and external sources of the production network, provide customers with intuitive and practical security protection suggestions, and ensure the safe operation of the production network.

Features

Rich industrial control attack library:It can detect and defend against network attacks against industrial control systems, ensuring the security of industrial control systems. The product is equipped with over a hundred SCADA feature libraries, covering various protocols such as DNP3, ICCP, Modbus, and also includes products from multiple manufacturers, such as Advantech, Schneider, Siemens, ABB, and others.

Intelligent construction of security baseline:By using deep self-learning technology, communication messages are deeply parsed to achieve real-time monitoring and recording of industrial control data. Customized adjustments and security detection strategies are made, and real-time detection of industrial control data streams is carried out based on self-learning rule models. When abnormalities are detected, an alarm is issued. Simultaneously record all network communication behaviors in detail, including command level industrial control protocol communication records. Help users understand and grasp the business communication status in the network in the most intuitive way, and discover potential security risks in industrial control networks.

Deep analysis of industrial control protocol:The product is embedded with a deep protocol parsing engine, which can parse two types of communication protocols in industrial control. It supports deep parsing of mainstream industrial control protocols (such as OPC, Modbus, S7, DNP3, CIP, MMS, etc.) and analyzes data packet integrity, function code legality, register value legality, and other levels to timely detect abnormal communication behavior.

Status detection traffic audit:Based on the state detection mechanism, sessions can be analyzed to track the entire process from establishment, maintenance to termination. Subsequent data communication with established legal connections can be directly released, greatly simplifying configuration and improving efficiency. All sessions will be maintained in the session table for administrators to analyze and troubleshoot.

典型部署