Abnormal traffic filtering mechanism for protecting ICS networks

The development of IT (Information Technology) has made access to control systems easier. However, because such advancement of control systems gave rise to many security vulnerabilities, the threat of cyber-attack is increasing as well. In order to respond these threats, we discusses the mechanism for protecting ICS (Industrial Control System) network. Most of all, since availability is the most critical factor in a control system, independent network security technology is required. In this viewpoint, this paper presents our industrial firewall system, named the IndusCAP-Gate (Industrial Cyber Attack Prevention-Gate) system, that fundamentally prevents unauthorized access to a control system. Our system applies access control filters of various levels. Most of all, the proposed system has an abnormal traffic filtering mechanism about Modbus and DNP3 protocol of the most widely used protocols in ICS network. Therefore, it facilitates the provision of security policy specific to each zone of the control system intranet.