Abnormal attack detection method and device

Abstract

The invention, which relates to the technical field of industrial control, provides a method and device for detecting an abnormal attack. The method comprises the following steps that: device data ofan industrial device are obtained, wherein the device data are used for expressing the state of the industrial device within a preset period of time; the device data are inputted into an attack detection model to obtain a detection result, wherein the detection result is obtained by analyzing the device data by the attack detection model based on historical device data of the industrial device; and according to the detection result, whether the industrial device is under an abnormal attack is determined. According to the invention, the attack detection model analyzes the current device data ofthe industrial device based on the historical device data of the industrial device, whether the industrial device is under an abnormal attack is determined, and the long-time running state of the industrial device in future is predicted, so that a problem that the user can not take corresponding measures based on the predicted abnormal state because the industrial device is predicted to will havean abnormal state within short time is solved; the time length of prediction by the terminal is prolonged; and the real-time performance of the abnormal attack detection by the terminal is improved.

Description

technical field [0001] The invention relates to the technical field of industrial control, in particular to a method and device for detecting abnormal attacks. Background technique [0002] With the continuous development of science and technology, neural network models have been gradually applied to industrial control systems, allowing users to predict the behavior of various industrial equipment in industrial control systems based on neural network models. [0003] In the related technology, the sensor can detect the state of the industrial equipment and obtain the data of the industrial equipment. Correspondingly, the data obtained by the sensor can be input into the neural network model, so that the neural network model can make predictions based on the obtained data and output the prediction results, so that according to The prediction result determines whether the industrial equipment is under abnormal attack, thereby reminding the user whether the industrial equipment...

AI Technical Summary

Problems solved by technology

[0005] The object of the present invention is to provide a method and device for detecting abnormal attacks in view of the deficiencies in the above-mentioned prior art, so as to solve the problem that the user cannot react to the upcoming abnormal situation of industrial equipment within the time period indicated by the prediction result. The problem of countermeasures

Images