Method for detecting abnormal traffic on control system protocol

Patent metadata

Field	Value
Publication number	US-9298175-B2
Application number	US-201313933822-A
Country	US
Kind code	B2
Filing date	Jul 2, 2013
Priority date	Mar 26, 2013
Publication date	Mar 29, 2016
Grant date	Mar 29, 2016

Abstract

A method for detecting an abnormal traffic on a control system protocol, includes: checking whether session information exists in a management table; adding a new entry to the management table; checking whether a transaction ID in a table entry is the same as that of the received MODBUS request message; and checking whether data and length thereof of the received MODBUS request message are the same as those in the table entry. Further, the method includes detecting an abnormal traffic; and updating the table entry with packet information of the MODBUS request message.

First claim

What is claimed is:

1. A method for detecting an abnormal traffic on a control system protocol, the method comprising:
checking whether session information exists in a management table when a received packet is a MODBUS request message;
adding a new entry to the management table when the session information does not exist in the management table;
checking whether a transaction ID in a table entry is the same as that of the received MODBUS request message when the session information exists in the management table;
checking whether data and length thereof of the received MODBUS request message are the same as those in the table entry when the transaction ID of the table entry is not the same as that of the MODBUS request message;
detecting an abnormal traffic when the transaction ID of the table entry is the same as that of the MODBUS request message, or the data of the table entry is the same as that of the MODBUS request message; and
updating the table entry with packet information of the MODBUS request message when the data of the table entry is not the same as that of the MODBUS request message.

2. The method of claim 1 , further comprising:
deleting the MODBUS request message detected as the abnormal traffic, or alerting detection of the abnormal traffic.

3. The method of claim 1 , wherein the table entry managed in the management table is deleted by a timer or using session termination information.

4. A method for detecting an abnormal traffic on a control system protocol, the method comprising:
checking whether session information exists in a management table when a received packet is a MODBUS request message;
checking whether a transaction ID in a table entry is the same as that of the received MODBUS request message when the session information exists in the management table;
checking whether data and length thereof of the received MODBUS request message are the same as those in the table entry when the transaction ID of the table entry is not the same as that of the MODBUS request message;
adding a new entry to the management table when the session information does not exist in the management table or when the data and length thereof of the received MODBUS request message are not the same as those in the table entry; and
detecting an abnormal traffic when the transaction ID in the table entry is the same as that of the MODBUS request message and when the data of the received MODBUS request message is the same as that in the table entry.

5. The method of claim 4 , further comprising:
checking whether session information exists in the management table when the received packet is a MODBUS reply message;
deleting, when an entry having the same session information as that of the MODBUS reply message exists in the management table, the entry; and
detecting, when an entry having the same session information as that of the MODBUS reply message exists in the management table, an abnormal traffic when an entry having the same session information as that of the MODBUS reply message exists in the management table while an entry having the same transaction ID as that of the MODBUS reply message is not registered.

6. The method of claim 4 , further comprising:
deleting the MODBUS request message detected as an abnormal traffic or alerting an abnormal traffic detection.

7. The method of claim 4 , wherein the table entry managed in the management table is deleted by a timer or using session termination information.

8. A method for detecting an abnormal traffic on a control system protocol, the method comprising:
checking whether session information exists in an exception table when a received packet is a MODBUS request message;
checking whether data of the MODBUS request message is the same as that in an entry existing in the exception table when the session information exists in the management table;
adding a new entry having information of the relevant message to the exception table when the session information does not exist in the management table, or the data of the MODBUS request message is not the same as that in an entry existing in the exception table even though the session information exists in the management table; and
detecting an abnormal traffic when the session information exists in the management table and an entry having the same data as the MODBUS request message exists in the management table.

9. The method of claim 8 , further comprising:
checking whether session information exists in the management table when the received packet is a MODBUS reply message;
detecting an abnormal traffic when an entry having the same session information as the MODBUS reply message does not exist in the management table;
checking whether a function code of the MODBUS reply message indicates an error when an entry having the same session information as the MODBUS reply message exists in the management table and when an entry having the same transaction ID as the MODBUS reply message exists in the message table; and
generating an exception entry based on information of the relevant entry and adding the exception entry to an exception table when a function code of the MODBUS reply message indicates an error.

10. The method of claim 9 , further comprising:
deleting an entry of the management table when a function code of the MODBUS reply message does not indicate an error or after the exception entry is added to the exception table.

11. The method of claim 8 , further comprising:
deleting the MODBUS request message that is detected as an abnormal traffic or alerting an abnormal traffic detection.

12. The method of claim 8 , wherein the table entry managed in the management table is deleted by a timer or using session.

Assignees

• Korea Electronics Telecomm

Inventors

• Kim Byoung-Koo
• Kang Dong Ho
• Sohn Seon-Gyoung
• Heo Youngjun
• Na Jung-Chan
• Kim Ik Kyun

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G05B15/02 Primary

  electric · CPC title

• H04L2012/40228

  Modbus · CPC title