Industrial control system sequence attack detection method and device

Abstract

The invention provides an industrial control system sequence attack detection method and device. The method comprises the steps of (S1) obtaining multiple observed quantities of sensors controlled by multiple programmable logic controllers as a test set, and obtaining a first continuous quantum set and a first discrete quantum set in the test set according to each observation value model obtained by a value classification method in advance, (S2) obtaining respective corresponding first matching probability and second matching probability by using a trained hidden Markov model based on the first continuous quantum set and the first discrete quantum set, and (S3) obtaining a detection result of industrial control system sequence attack with the combination of weights of the discrete quantum set and the continuous quantum set based on the first matching probability and the second matching probability. According to the method provided by the invention, while a condition that the industrial control system sequence attack detection is failed after a single observation quantity is tampered is avoided, and the sequence attack of an industrial control system can be efficiently and accurately identified.

Description

technical field [0001] The invention relates to the technical field of intrusion detection, and more specifically, to a method and equipment for detecting sequence attacks of industrial control systems. Background technique [0002] The industrial control system (ICS) has continuously introduced open communication protocols such as industrial Ethernet and Transmission Control Protocol / Internet Protocol (TCP / IP) in the past ten years, and the system platform tends to Due to openness and standardization, the connection with external networks has become closer and more frequent. In particular, the newly proposed concept of Industry 4.0 integrates ideas such as smart factories, smart production, and smart logistics. These phenomena make the system's inherent loopholes and attack surface increasing day by day, and the security attacks faced by the Internet are introduced into ICS. Sequence attack is a special attack in industrial control systems. The attack is highly dependent o...

AI Technical Summary

Problems solved by technology

[0004] Sequential attacks mainly use detection technology based on single-observation information, but skilled attackers can capture PLCs and tamper with observations, resulting in the failure of existing observation detection technologies and the inability to identify sequence attacks, resulting in serious business interruptions and equipment failures. destroy

Images