Abnormal instruction detection method of source network load interaction industrial control system

Abstract

The invention relates to an abnormal instruction detection method of a source network load interaction industrial control system. A machine learning open source framework is adopted to build an abnormal instruction detection model of the source network load interaction industrial control system based on a bidirectional short-long-term memory neural network; an instruction sequence of the source network load industrial control system is taken as an input layer of the bidirectional short-long-term memory neural network; an output layer is a detected instruction property; and the trained detection model as an abnormal instruction detection classifier is sent to an instruction anomaly analysis module of each operation unit for carrying out instruction anomaly detection and reporting anomaly information. According to the method, the instruction property is detected by comprehensively considering a context relationship of the instruction sequence, so that the influence on the detection precision due to the long-term dependence problem of the instruction sequence can be effectively solved. A set of closed-loop scheme for collection, identification, feedback and update training is furtherformed, so that the abnormal instruction detection model is continuously subjected to iterative optimization, and the abnormal instruction identification precision and adaptability can be effectivelyimproved.

Description

technical field [0001] The invention belongs to the technical field of power system information security detection and defense, relates to a power grid industrial control system, and is an abnormal instruction detection method of a source-grid-load interactive industrial control system based on a bidirectional long-short-term memory neural network. Background technique [0002] The proposal of the global energy Internet strategy has promoted the continuous expansion of the scale of grid interconnection, and the gradual deepening of the application of information and communication technology in the grid, followed by the increasing security threats to the grid industrial control system. Compared with the traditional power grid industrial control system, the source-network-load interactive industrial control system needs to interact more frequently with the user side, and the task load of dispatching work is also increasing, which further increases the threat to network security...

AI Technical Summary

Problems solved by technology

[0005] The problem to be solved by the present invention is that the existing abnormal instruction detection method cannot be directly applied to the source-network-load interactive industrial control system, and cannot solve the long-term dependence problem faced by serialized operation instructions, so that the accuracy of abnormal instruction detection cannot be improved

Images