Topsec Industrial Control System Intrusion Detection and Auditing Platform

Integrating multiple security detection technologies such as intrusion detection, behavior detection, and database auditing, the system conducts real-time detection of ICS operating status in accordance with specific security policies. It can effectively identify security threats such as network or database-level intrusion attacks, abnormal traffic, unauthorized operations, and SQL injection.

Adopting deep self-learning technology, the system establishes traffic baselines, protocol baselines, and behavior baselines, which can be custom-tuned according to the business requirements of ICS. It effectively detects violations such as unauthorized external connections, malicious programs, and misoperations, helping customers real-time grasp the network operation status and identify potential security threats.

Utilizing business behavior auditing technology, the system conducts in-depth analysis of write operations, write frequency, parameter ranges, variation ranges, and rate of change ranges of ICS communication content. It solves the accurate identification of destructive behaviors such as misoperations, unauthorized operations through legitimate channels, changes to control commands, and PLC downloading.

The system embeds a deep protocol parsing engine, which performs in-depth analysis of industrial protocol data packets from multiple levels including integrity, function codes, address ranges, value ranges, and variation trends, to timely detect abnormal communication behaviors. Supported industrial protocols include Modbus, OPC, S7, Profinet, IEC 104, DNP3, CIP, MMS, etc.

Using the database protocol identification, feature detection and in-depth analysis technologies, configure a full range of alarm policies for all elements such as login users, SQL statements, operation types, and operation objects, record all operational behaviors on the database, detect potential threats in time, and quickly and accurately locate security events.

The system uses active lossless detection and passive matching technology to effectively identify the IP address, protocol, port, manufacturer information, model, version, and other information of assets, and analyzes asset relationships, to automatically generate asset topology and establish a complete industrial asset ledger to help customers thoroughly grasp assets conditions.