Let’s discuss the issue of installing antivirus software on DCS systems.

We use Hollyland’s, and they don’t allow antivirus software to be installed. Afraid it will affect the operation of the DCS. Connecting to the management network can expose it to viruses; it’s best for the DCS to have its own separate network. If it affects the DCS, the responsibility is significant. I uninstalled the antivirus software after using it, and the virus files were handled by isolation. This post was last edited by aaaas on 2008-1-18 11:41]

Firstly, since most antivirus software relies on virus signature databases to detect threats, and the DCS system requires the continuous creation of numerous new files as well as real-time modifications, which go unnoticed by antivirus software and are often mistaken for virus signatures, from a system security perspective, it is generally not recommended to install antivirus software on DCS systems. The issue of updating virus databases is not the main problem, as manual update packages can be downloaded from other machines and copied to the server/operating station using secure storage methods. Additionally, you can consult the DCS manufacturer or supplier to find out if there is any specified antivirus software, or an antivirus software developed in-house by the manufacturer. In fact, there is no real need to install antivirus software on DCS. Because computers should be dedicated and not connected to other networks, including the Internet; also, do not use unauthorized discs or flash drives. With proper management, poisoning can be completely avoided. This post was last edited by sailonever on 2008-1-18 12:26]

Antivirus software is not allowed on DCS; as long as management is strict, there will be no viruses. If the DCS is to communicate, it does so through a communication card or a dedicated gateway, preventing external entities from accessing the DCS system.

Install the online version of antivirus software – managing the server side is all that’s needed! :victory:

Personal opinion: 1. The management information network has only read access to the process network; there should be a gateway for this purpose； 2. A dedicated communication network, where commands are identified through messages; there must be specialized viruses for it. I’m not very familiar with current technologies such as OPC and Ethernet, nor do I understand the principles behind data transmission/sharement; I’m not sure if it relies on a general-purpose operating system environment.

Your leaders really know how to joke – it’s like an expert giving instructions to a novice; complete nonsense. 1. Many of the encryption methods used in DCS systems are trade secrets, and there’s a high risk of accidental damage (some rely on licenses, while others use encryption keys). 2. Current antivirus software primarily uses virtual machines, as well as heuristic and proactive defense techniques; it’s necessary to first execute the code in a simulated environment, and only if everything is fine can it be executed in reality. (See below for details.) The machine will slow down, memory management will become highly unsafe, threads will get out of control, and processes will be interrupted, resulting in the DCS crashing. Of course, it’s not completely impossible to install it; this requires specific management regulations and particular equipment. III. Virtual Machine Unpacking Engine (VUE) technology: For viruses, if they are allowed to run, the user’s computer will become infected. Therefore, a new approach was proposed: to create a simulated environment for the virus in order to trick it into removing its \"mask\". Furthermore, the “virtual environment” is isolated from the user’s computer, so any actions carried out in the virtual machine have no impact on the user’s computer. “The “VM unpacking” technique has become the most effective tool recognized by the global security industry in recent years for solving this problem. However, developing a virtual machine system requires overcoming various challenges related to virtual CPUs, virtual peripheral hardware devices, virtual drivers, and more. IV. Heuristic Antivirus Detection: The differences between viruses and legitimate programs can be seen in many aspects. Common examples include the fact that an ordinary application, in its initial instructions, will check whether there are any parameters in the command-line input, clear the screen, and save the previous screen display; whereas a virus program does not do such things. Its initial instructions usually involve direct disk operations, decoding commands, or sequences of instructions for searching for executable programs in certain paths. A skilled programmer can spot these significant differences at a glance while in debugging mode. Heuristic code scanning technology is essentially the practical implementation of such experience and knowledge in a virus detection software. Heuristics refer to the “ability to discover things on one’s own” or the “knowledge and skills needed to determine things using certain methods or approaches.” ”A virus detection software that uses heuristic scanning techniques is, in essence, a dynamic disassembler or decompiler implemented in a specific way, which gradually understands and determines the true purpose behind certain instruction sequences by decompiling them. For example, if a program starts with the sequence MOV AH,5/INT,13h, which invokes the BIOS instruction for formatting disk operations, then such a program is highly suspicious and warrants attention. Especially if there are no commands to retrieve parameter options from the command line prior to this instruction, nor any requests for user input to proceed, it can be confidently assumed that it is a virus or a malicious program. Heuristic antivirus represents an inevitable trend in the development of anti-virus technology. Anti-virus technologies with certain artificial intelligence features show us the possibility of a universal virus detection technique and products that do not require upgrades – or are less dependent on upgrades. Due to its powerful advantages that many traditional technologies cannot match, it will surely see widespread adoption and rapid development. The application of pure heuristic code analysis techniques (without any prior research or understanding of the virus sample being analyzed) can achieve a virus detection rate of over 80%, while the false positive rate can be easily kept below 0.1%. This represents a qualitative leap compared to antivirus software that relies solely on traditional feature scanning techniques, which involve identifying \"signature strings\" based on knowledge of known viruses. In an era where new viruses and variants keep emerging and the number of viruses continues to rise, the development and application of this new technology hold even greater significance. V. The concept of proactive defense technology: Proactive defense technology is a concept that has gained considerable attention these days. Conceptually, it refers to the prevention of unknown viruses, preventing them from functioning before virus samples are obtained. Currently, proactive defense technologies are mainly virus prevention and elimination techniques designed to deal with unknown viruses. In other words, as some people put it: determine whether a file is a virus based on its behavioral characteristics and take appropriate action accordingly. Virus behavior blocking technology identifies computer viruses by extracting their common characteristics, such as modifying the registry, self-replication, and continuous network connections, and then using these behavioral traits to determine whether a file is a virus. Kang’s antivirus experts say that the core technologies for proactive defense include “virtual machine technology” and “virus behavior blocking technology”, among others. Virtual machine technology uses software to create a virtual CPU environment, activates viruses, determines whether they are viruses, and removes them. Kaspersky virus experts say that “proactive defense” involves, in the case of unknown viruses and programs, using “behavioral analysis” techniques to identify most of the unidentified viruses and variants that have not been intercepted. On the other hand, by monitoring vulnerability exploitation attempts, it is possible to prevent viruses from using system vulnerabilities to attack other computers, thereby stopping the spread of viruses.

I’m personally quite interested in software and hardware, especially in the area of networking. Let me explain it to you and suggest a solution. Installing antivirus software is absolutely not allowed; this is something that every DCS manufacturer knows, due to the numerous patented technologies, as some of the people mentioned above have said. In order to ensure safety, some antivirus software fails to meet certain certifications required for use in industrial settings, namely those related to stability (certifications such as DCS are necessary; without them, manufacturers would likely refrain from using such software as they cannot take the responsibility). Relevant international agreements on this topic can be found in abundance. If a antivirus program causes the DCS to crash, the plant manager will never allow it. Moreover, including Windows, many manufacturers prefer to use a specific version of the operating system – this is due to various issues related to patches for that system. What’s more, software that works under Win2000 must not be installed on XP, even though it might be compatible from a compatibility standpoint, unless the DCS manufacturer states that it has been certified or that the system supports XP. Solution: Hardware antivirus. Now, major antivirus manufacturers offer ready-made hardware-based antivirus solutions. However, one thing is that the use of USB drives and similar devices is not allowed; only the internet can be used. Hardware antivirus is something like a hardware gateway; once the DCS network cable is plugged in, that’s it, and the other end of this hardware is connected to another network. The manufacturer will provide the corresponding software, allowing access to the hardware’s web interface via a dedicated port for making settings. Over time, it is also necessary to upgrade the antivirus software installed on the hardware. Principle: Filtering and antivirus protection. Advantages: It filters and scans the information used for communication for viruses; its antivirus capabilities are generally stronger than those of software, and it usually does not significantly affect internet speed. Maintenance-free. Disadvantages: It is relatively expensive, requires regular updates, and does not allow the use of removable storage devices on the host (it is ineffective against viruses already present on the host, only effective during transmission). ) Manufacturers: Norton, Kaspersky, Panda, and so on (Even domestic ones are not recommended, as their core technologies are based on those that have been phased out by other companies)