Rapid feature matching industrial network DDoS intrusion detection method

Abstract

The invention provides a rapid feature matching industrial network DDoS intrusion detection method, relates to the field of industrial network communication and belongs to the aspect of information security. According to the method, a traditional database lookup feature matching model for intrusion detection is replaced through utilization of a deep learning model, thereby finishing designing theintrusion detection system in an industrial network. According to the method, data packet features are extracted; features are screened; a feature matrix is established; the feature matrix is input into the deep learning model for judgment; and the model is trained by a KDD99 data set, and the model has a very high identification rate for a DDoS attack type. According to the method, the defect that the traditional database lookup feature matching speed is low is improved, a system does not need to waste time for waiting for the looking up in a database, a matching rate is greatly improved, thematching precision is high, a false alarm rate is low, the deployment is convenient, the use of system resources is effectively reduced, and a demand of the industrial network for network timelinessis satisfied.

Description

technical field [0001] The invention relates to the field of industrial network communication, and belongs to the aspect of information security, in particular to an industrial network DDoS intrusion detection method for rapid feature matching. Background technique [0002] Industrial network refers to a digital, two-way, multi-station communication system installed in the manufacturing environment. With the development of the times, industrial networks have become more and more closely and frequently connected with external networks. In the past, there was usually no physical connection between industrial networks and the external Internet, and they only existed as isolated LANs. But now, the industrial network not only connects internal manufacturing equipment, but also connects to all parts of the world through the Internet to achieve tasks such as remote monitoring, remote software upgrades, unified resource allocation, and collaborative division of labor. However, whil...

AI Technical Summary

Problems solved by technology

The general target of DDoS attacks is the core facilities of the network. In the field of industrial control, the targets that can be attacked include core switches, data servers, etc. Once the network stops serving, various production data, messages, and instructions cannot be transmitted normally. The damage caused on site will be incalculable

At present, the research on this type of intrusion detection system for industrial networks is still in its infancy at home and abroad. The currently applied solution is to use the anomaly detection system to monitor system parameters, such as CPU usage, login failure times, etc. The defects of this scheme The false alarm rate and false negative rate are high; in addition, an attack feature database is established to analyze and match inbound data. This method consumes system resources and the detection efficiency is low. This is an industrial network with high real-time requirements. is not allowed in

Images