Automatic establishing method of intrusion detection model based on industrial control network and apparatus thereof

Abstract

The invention discloses an automatic establishing method of an intrusion detection model based on an industrial control network. The method comprises the following steps of determining whether a first intrusion detection model accords with a preset detection requirement, and if the first intrusion detection model does not accord with the preset detection requirement, extracting communication behavior flow data in real time; according to the communication behavior flow data, setting a training data set and a test data set; according to the training data set, creating an initial intrusion detection model; and using the test data set to test the initial intrusion detection model, and according to a test result, creating a second intrusion detection model according with a preset detection requirement. Detection precision of the second intrusion detection model is high so that an intrusion detection rate of abnormal behaviors is increased, and a false alarm rate and a missing report rate are reduced.

Description

technical field [0001] The application relates to a method and device for automatically establishing an intrusion detection model based on an industrial control network, and belongs to the technical field of industrial control network security protection. Background technique [0002] Industrial Control Systems (hereinafter referred to as ICS) is an automatic control system composed of computer equipment and industrial process control components. It is widely used in industrial basic fields such as industry, energy, transportation, and petrochemical industry. Since ICS is more and more connected with enterprise network and the Internet, forming an open network environment, the network security protection technology of ICS is of great significance to ensure the safe, reliable and stable operation of ICS. [0003] At present, intrusion detection technology is mainly used to ensure the network security of ICS. Intrusion detection is an active security protection technology. By...

AI Technical Summary

Problems solved by technology

[0004] In the prior art, the intrusion detection model is established according to the network communication traffic data, and then the intrusion detection model is always used for intrusion detection of abnormal behaviors. However, industrial communication is real-time, and the traffic data of communication behavior is also continuously changing. Therefore, the existing technology The false positive rate and false negative rate of intrusion detection are high

Images