Abnormal behavior detection method for unknown industrial communication protocol specification

Abstract

The invention discloses an abnormal behavior detection method for an unknown industrial communication protocol specification. The abnormal behavior detection method is divided into an online self-learning stage and a real-time detection stage, wherein the online self-learning stage mainly completes the analysis and feature extraction of network original network communication data, forms an event sequence, takes the event sequence as the input of a hidden Markov model to train the model, and finally obtains the optimized hidden Markov model and a behavior probability threshold through iteration; and the real-time detection stage uses the optimized hidden Markov model to perform behavior probability calculation on the event sequence which is processed in real time, and completes the abnormal detection of an industrial communication behavior by comparing the behavior probability with the behavior probability threshold. The abnormal behavior detection method for the unknown industrial communication protocol specification provided by the invention can detect the legitimacy of an industrial communication data stream using the unknown industrial communication protocol specification, and detect the abnormal industrial communication behavior and give an alarm in real time, so as to guarantee the network communication security of an industrial control system.

Description

technical field [0001] The invention relates to the technical field of industrial control system network security, and more specifically relates to an abnormal behavior detection method for unknown industrial communication protocols. Background technique [0002] With the development of modern communication, computing, network and control technology, and the continuous development of the application field of information technology, the integration of industrialization and informatization has become an inevitable trend of development. As a symbolic product, the networked industrial control system has been highly valued by the state and has become one of the strategic plans for future national economic and social development. However, the development of networking and informatization has gradually broken the original inherent closedness of industrial control systems, and the subsequent information security issues have also been increasingly exposed, showing an intensifying tre...

AI Technical Summary

Problems solved by technology

Although the above two methods can protect the industrial control system from network attacks to a certain extent, there are also shortcomings: first, the rule setting of the white list is done manually, and any deviation will lead to errors in security rules; second, as a network Security middleware, which affects the real-time operation of the system

Most of the above-mentioned anomaly detection technologies for industrial control systems are limited to the research on anomaly detection methods of known industrial communication protocol protocols, and rarely involve research on anomaly detection of unknown industrial communication protocol protocols.

Images