Snort improvement on Profinet RT for Industrial Control System Intrusion Detection
Zihao Feng, Su‐Juan Qin, Xuesong Huo, Pei Pei, Ye Liang, Liming Wang · 2016
In recent years, the number of information security incidents of industry controlling system has increased dramatically. The intrusion detection system for industrial control systems has received extensive attention. As one of powerful and light weight Network Intrusion Detection System, Snort has good expansibility and translatability, and can be used in various environments. However, Snort has clear deficiency on the intrusion detection of Profinet RT signal. Profinet DCP is an important part of Profinet RT. The intrusion detection for Profinet DCP is very important for the industry controlling systems which use Profinet to connect. To realize the detection for Profinet RT signal, this paper expanded the snort packet decoding engine, and designed a preprocessor plug-ins for Profinet RT signal. Experimental result shows that the improved Snort can support the intrusion detection for Profinet RT signal.