An abnormal detection system for industrial control behavior based on data dependence

Abstract

The invention discloses an industrial control behavior anomaly detection system based on data dependence. The system comprises a data collection module, a behavior data extraction module, a rule learning module and a rule detection module, wherein the data collection module is used for acquiring a network data packet; the behavior data extraction module is used for extracting behavior data in the network data packet, and building an input output behavior data list used for learning a rule and an input output behavior data list used for detecting the rule; the rule learning module is used for generating a rule file according to the pre-stored input output behavior data lists used for learning a configuration file and learning the rule; and the rule detection module is used for detecting anomaly of the behavior data according to the input output behavior data list used for detecting the rule of the rule file. According to the technical scheme of the system of the invention, anomaly detection on process behaviors of controllers (PLCs and the like) and controlled objects (valves and the like) can be effectively implemented, and the system has the characteristics of high detection accuracy and strong real-time.

Description

technical field [0001] The invention relates to the technical field of industrial control networks, in particular to a data-dependent-based industrial control system behavior anomaly detection system. Background technique [0002] Industrial Control System (Industrial Control System) is composed of various automation control components and process control components for real-time data acquisition and monitoring. Industrial control system is a management and control system, which can ensure the normal operation of industrial equipment, control and monitor industrial production process. The industrial control system is mainly composed of SCADA (Supervisory Control And Data Acquisition), DCS (Distribution Control System), PLC (Programmable Logic Controller), RTU (Remote Terminal Unit), IED (Intelligent Electronic Device) and interface technology. Industrial control systems are ubiquitous in petroleum, nuclear power plants, chemical industry, transportation and electric power, ...

AI Technical Summary

Problems solved by technology

However, the traditional anomaly detection technology only statistically builds a model for network behavior characteristics for anomaly detection, but the tampering of the process behavior of the industrial control system will not cause changes in the network behavior characteristics, so the traditional anomaly detection technology cannot identify the tampering attack of the process behavior

Images