Abnormal behavior prediction method based on behavioral collaborative perception model

Abstract

The invention discloses an abnormal behavior prediction method based on a behavioral collaborative perception model. The method comprises the following steps of (A) collecting device behavior information, (B) determining a protocol type of the device behavior information, ending prediction if the protocol is a UDP protocol, and going to step (C) if the protocol is a TCP protocol, (C) determining whether a connection frequency or a transmission speed exceeds a threshold, ending the prediction if the connection frequency and the transmission speed do not exceed the threshold, otherwise, going tostep (D), (D) matching an abnormal behavior, ending the prediction if a match fails, otherwise, going to step (E), and (E) outputting device abnormal behavior warning. According to the method, the deficiencies of the prior art can be improved, and timely warning is carried out before a malicious behavior breaks out.

Description

technical field [0001] The invention relates to the field of network technology, in particular to a method for predicting abnormal behavior based on a behavior cooperative perception model. Background technique [0002] With the development of information technology, industrial control systems are gradually becoming networked. Many industrial control protocols are gradually running on industrial Ethernet, and attacks against industrial control systems are more common. [0003] Once the malicious threat software in the industrial control network successfully infiltrates, a large part of it will not immediately cause damage to the industrial network (such as the Stuxnet virus in the Iranian nuclear power plant, the oil production information leakage incident in a domestic oil field, and the Havex virus), but will lie dormant. Detect and wait for the right time (such as Internet connection, receiving instructions), and then suddenly launch violent destruction. [0004] At pre...

AI Technical Summary

Problems solved by technology

[0004] At present, there are mainly two methods for detecting abnormal behaviors of industrial control networks, whitelist and blacklist. These two methods have their own usage scenarios, and there are also great restrictions on their use.

In addition, these two techniques can only be detected when an attack occurs, at which point the industrial control network may have been compromised

Images