FCM-GASVM-based industrial control system intrusion detection method

Abstract

The invention relates to an FCM-GASVM-based industrial control system intrusion detection method, in particular, a CM-GASVM-based industrial control system application layer network intrusion detection method. According to the method, unsupervised fuzzy C-mean clustering and a supervised support vector machine are combined so as to extract the communication traffic data of the Modbus/TCP of an industrial control system; FCM clustering is performed on the communication data; and a part of the data, which meet a threshold condition, are classified through a genetic algorithm optimized-support vector machine. Since unsupervised learning and supervised learning are combined together, training time can be effectively reduced with category labels not required to be known in advance, and classification accuracy can be improved.

Description

technical field [0001] The invention relates to an FCM-GASVM-based intrusion detection method for an industrial control system, which uses a fuzzy C-mean value and a genetic algorithm-optimized support vector machine to detect abnormal behavior, and belongs to the field of industrial control network security. Background technique [0002] The traditional industrial control system is generally based on the factory area, which is independent of each other and has no physical connection with the outside world. However, with the rapid development of industrial informatization and network technology, more and more general-purpose hardware and general-purpose software are used in industrial control systems. The openness of industrial control systems is increasing day by day, and system security vulnerabilities and defects are easily exploited by viruses. It is also used in various large-scale manufacturing industries such as electric power, transportation, petroleum, heating, and ...

AI Technical Summary

Problems solved by technology

However, with the rapid development of industrial informatization and network technology, more and more general-purpose hardware and general-purpose software are used in industrial control systems. The openness of industrial control systems is increasing day by day, and system security vulnerabilities and defects are easily exploited by viruses. It is also used in various large-scale manufacturing industries such as electric power, transportation, petroleum, heating, and pharmaceuticals in the country. Once attacked, it will bring huge losses. Therefore, effective methods are needed to ensure the network security of industrial control systems.

[0003] There are many ways to protect the network security of industrial control systems. The most commonly used methods are firewalls, log processing and other linkage methods. However, firewalls are based on third-party routing access control and cannot detect attacks from within the system. They can only filter them. function, unable to effectively reduce the security risk of the system

Images