Intrusion detection method based on Markov chains

Abstract

The invention provides an intrusion detection method based on Markov chains. Network data package characteristics are extracted, and data models based on the Markov chains are constructed. Markov chain models are respectively constructed in a training phase and a detection phase. An intrusion detection algorithm is improved according to event importance. By adopting the improved intrusion detection algorithm, the abnormity detection of the Markov chains in the training phase and the detection phase is carried out to acquire abnormity results. The intrusion detection method mainly focuses on special attack types of an industrial control field ICS system, and under a condition of completely normal network communication data package formats, sequence attacks based on a sequence and time can still happen. According to experimental verification, the intrusion detection method is advantageous in that a false alarm rate is effectively reduced, higher detection efficiency and higher accuracy are provided.

Description

technical field [0001] The invention relates to an ICS system intrusion detection method, in particular to an intrusion detection method for establishing a Markov chain model in the ICS system. Background technique [0002] In today's world, the field of information security has ushered in a new challenge that has attracted the attention of various countries, companies and organizations - Advanced Persistent Threats (APT). APT attacks are constantly attracting the attention of various security companies and organizations because of their clear attack targets, good organization, very advanced hacking techniques, diverse and complex attack methods, and attack persistence and concealment. APT attacks not only exist in traditional information technology (referred to as IT) systems, but also in the field of industrial control. Industrial Control Systems (ICS for short) are widely used in automating industrial processes, covering the country's critical infrastructure, such as pow...

AI Technical Summary

Problems solved by technology

1. The fully supervised mode training technology assumes that the data set used for training contains not only normal class but also abnormal class label instances, but the disadvantage of this technology is that the number of abnormal data instances in the training data is much smaller than the number of normal data instances. And it is usually difficult to get accurate and representative labels through abnormal class analysis; 2. Unsupervised mode training technology does not require training data, but it must ensure that the number of normal data instances is far greater than the number of abnormal data instances; 3. Semi The supervised mode training technique assumes that only the data instances belonging to the normal class have labels in the training data set

Images