A Method for Abnormal Behavior Detection of Finite-knowledge Industrial Communication Protocols Based on Feature Association

Abstract

A method for detecting abnormal behaviors of limited-knowledge industrial communication protocols based on feature association. This method is oriented to the characteristics of known and unknown parts in the message format of limited-knowledge industrial communication protocols. Anomaly detection of communication behavior, specifically including the decision tree construction stage and the abnormal judgment stage, in which the decision tree construction mainly realizes the feature extraction of the original communication data in the control system, binds known features and unknown features through feature association identification, and constructs feature association The decision tree obtains the centroid and distance threshold of the unknown feature space; the anomaly judgment performs decision tree search and Mahalanobis distance calculation on the feature information after data preprocessing, and completes the abnormal detection of the communication behavior of the finite-knowledge protocol by comparing with the distance threshold. This method can analyze, model and detect industrial control communication data, find abnormal industrial communication behaviors in real time and generate alarms to ensure network security.

Description

technical field [0001] The invention relates to the technical field of industrial control system network security, and more specifically relates to a method for detecting abnormal behaviors of limited-knowledge industrial communication protocols based on feature association. Background technique [0002] At this stage, industrial control systems have been widely used in many modern industrial industries such as electric power, metallurgy, rail transit, petrochemical, nuclear facilities, etc. According to statistics, more than 80% of the key infrastructure related to the national economy and people's livelihood rely on industrial control systems to realize automatic operations . With the deep integration of informatization and industrialization and the rapid development of the Internet of Things, the degree of interconnection and interoperability of industrial control systems is getting higher and higher, and its security is also facing severe challenges. In recent years, va...

AI Technical Summary

Problems solved by technology

First of all, in terms of protection, the typical protection technology is industrial firewall technology. Although it realizes communication access control and network isolation, it also has shortcomings: (1) The rule setting of the white list is done manually. If there is a deviation, It will lead to errors in security rules; (2) As a kind of network security middleware, it will have an impact on the real-time operation of industrial control systems

However, most of the above-mentioned anomaly detection technologies for industrial control systems are limited to the research of anomaly detection methods for known and unknown protocols, and rarely involve the research of anomaly detection for limited-knowledge industrial communication protocols.

Images