An industrial control system intrusion detection method based on integrated learning

Abstract

The invention discloses an industrial control system intrusion detection method based on integrated learning. The method comprises the following steps: acquiring field data of an industrial control system; carrying out message analysis on communication data to obtain a structured sample, selecting an appropriate feature set through feature screening and extraction, inputting the feature set into an integrated learning model consisting of a plurality of machine learning algorithms, and finally judging whether the communication data of a specific industrial control system is normal or abnormal through the learning algorithm. Effective information of communication data of the industrial control system is fully mined by utilizing an intelligent learning algorithm, the intrusion detection accuracy is effectively improved through an integrated learning model fusion method, and the missing report rate is reduced.

Description

technical field [0001] The invention belongs to the field of industrial control system security, and relates to an intrusion detection method of an industrial control system based on integrated learning. Background technique [0002] An industrial control system is a control system used in industrial production. Through advanced computer and network technology, people use industrial control systems to control traditional industrial processes reliably and efficiently. It includes data monitoring and acquisition system, distributed control system, programmable logic controller, human-computer interaction interface, intelligent terminal and other systems. Industrial control systems have been widely used in various industries, such as transportation, electric power, petrochemical, water treatment, natural gas transmission, etc. It makes important contributions to the construction of key national infrastructure, affects all aspects of people's lives, and is an important guarant...

AI Technical Summary

Problems solved by technology

Due to the addition of advanced information technology and communication network technology (such as Ethernet), the openness of industrial control systems has been greatly improved, and it is also exposed to more security risks

Specifically, for example, fieldbus and equipment communication protocols (Modbus, etc.) commonly used in industrial control systems did not consider security issues as an important factor at the beginning of the design. Most of the communication messages are transmitted in plain text format, and there is no effective and strict Authentication

On the other hand, the control machine operating system in the industrial control system usually lacks timely updates and bug fixes, giving external attackers an opportunity

Images