Detecting and combating attack in protection system of an industrial control system

A computer program product for suspension of processes in an industrial control system, comprising:

• a non-transitory computer readable storage medium;
• first program instructions to send a command stream from a protection network of the industrial control system to at least one zone, said command stream comprising at least one command;
• second program instructions to concatenate the at least one command into at least one sequential command package comprising an ordered sequence delimiter comprising units of work delimiters;
• third program instructions to pass the at least one sequential command package to a crypto hash generator;
• fourth program instructions to generate units of work hash codes and sequence hash codes;
• fifth program instructions to compare the generated hash codes against a first database of existing valid unit of work hash codes and sequence hash codes and,
• sixth program instructions generate an alert and access a second database comprising emergency procedures if a command stream fault is detected,
• wherein said first, second, third, fourth, fifth, and sixth program instructions are stored on said non-transitory computer readable storage medium,
• wherein the second, third, fourth, and fifth program instructions are via a switch in communication with at least one firewall/gateway.