公开(公告)号：US20190166138A1

公开(公告)日：2019-05-30

申请号：US15835377

申请日：2017-12-07

Applicant: Institute For Information Industry

Inventor： Chih-Ta LIN ,  Sung-Lin WU ,  Mei-Ling LEE

IPC: H04L29/06

Abstract: A system and method for identifying application layer behavior are disclosed. In order to detect intrusion into an industrial control system, the system and method determine a current status of application layer behavior of the industrial control system by analyzing a current packet which is propagated between a master device and a slave device in the industrial control system, and identify whether the current status of the application layer behavior is normal according to a normal behavior status list.