Method for deep packet inspection as means of ensuring the adequacy of specifications transmitted in industrial networks.

Aim. To improve the adequacy of specifications transmitted within safety-critical process automation systems. Methods. Integration of deep packet inspection technology into the operation of an open communications platform with a uniform architecture. The application of such a platform in industrial networks is defined by the requirements of the Russian standards as regards the implementation of messaging traffic. The paper employed an approach that is based on the statistical analysis of existing threats to the use of software technologies and single interfaces as part of process automation tools. Content-based deep packet inspection allowed developing an algorithm for accumulating statistical data that define the efficiency of traffic regulation and filtering. Using the above technology along with the proposed method for calculating risks affecting automation systems would allow taking into account the technological and operational aspects of the external factors. Results. It was shown that compliance with the proposed regulatory requirements, as well as provisions defining the stability of transactions will allow Internet providers visualising existing traffic, identifying its bottlenecks, algorithmising the use of network resources, including its effect on network performance and compatibility with various protocols. Based on the results of deep packet inspection, the paper examined the feasibility of effective analysis of packet content and metadata. An algorithm was developed for deep packet inspection that demonstrates capturing, analysis, and processing of network traffic along with a diagram of the allocation of the means and facilities implementing the algorithm in a network of open distributed systems that includes integration points between industrial controllers, servers, and clients, as well as cloud services. The diagram helps visualising the integration of deep packet inspection technology at all levels of interaction between the elements of process automation systems. To control the risk dynamics, an algorithm was proposed that takes into account the evolution of threats to each of the elements, as well as building countermeasures within process automation systems. The characteristics of the facilities that represent such countermeasures to external threats are defined by the compliance of the transmitted data packets with the requirements that define the protocol specifications of an open platform server. The obtained information helps administrators inspect traffic, identify anomalies and plan the capacity of communication channels within the examined process automation systems. The above approach to building a cyber threat detection framework is a strategic basis for ensuring the security of critical applications. Conclusions. Given the demand for ensuring the safety of process automation systems, the introduction of requirements defining the deep packet inspection process into Russian digital manufacturing standards would be a significant step towards improving the adequacy of specifications transmitted within industrial networks in the face of growing cyber threats.