Limited known industrial communication protocol abnormal behavior detection method based on feature association

Abstract

The invention discloses a limited known industrial communication protocol abnormal behavior detection method based on feature association. For a feature that a message format of a limited known industrial communication protocol has a known part and an unknown part, through association of the two parts of information, abnormality detection is carried out on communication behaviors of the limited known industrial communication protocol. The method specifically comprises a decision tree establishment phase and an abnormality judgment phase. In the decision tree establishment phase, feature extraction is carried out on original communication data in a control system, known features and unknown features are bound through feature association identities, a feature association decision tree is established, and a mass center and a distance threshold of an unknown feature space are obtained. In the abnormality judgment phase, decision tree searching and mahalanobis distance calculation are carried out on data preprocessed feature information, and through comparison with the distance threshold, the abnormality detection is carried out on limited known protocol communication behaviors. According to the method, analysis, modeling and detection can be carried out on industrial control communication data, this kind of industrial communication behavior abnormalities can be discovered in real time, alarm is generated, and network security is ensured.

Description

technical field [0001] The invention relates to the technical field of industrial control system network security, and more specifically relates to a method for detecting abnormal behaviors of limited-knowledge industrial communication protocols based on feature association. Background technique [0002] At this stage, industrial control systems have been widely used in many modern industrial industries such as electric power, metallurgy, rail transit, petrochemical, nuclear facilities, etc. According to statistics, more than 80% of the key infrastructure related to the national economy and people's livelihood rely on industrial control systems to realize automatic operations . With the deep integration of informatization and industrialization and the rapid development of the Internet of Things, the degree of interconnection and interoperability of industrial control systems is getting higher and higher, and its security is also facing severe challenges. In recent years, va...

AI Technical Summary

Problems solved by technology

First of all, in terms of protection, the typical protection technology is industrial firewall technology. Although it realizes communication access control and network isolation, it also has shortcomings: (1) The rule setting of the white list is done manually. If there is a deviation, It will lead to errors in security rules; (2) As a kind of network security middleware, it will have an impact on the real-time operation of industrial control systems

However, most of the above-mentioned anomaly detection technologies for industrial control systems are limited to the research of anomaly detection methods for known and unknown protocols, and rarely involve the research of anomaly detection for limited-knowledge industrial communication protocols.

Images