Intrusion detection method and device for industrial control system
An industrial control system and intrusion detection technology, applied in general control systems, control/regulation systems, program control, etc., can solve problems such as poor intrusion detection effects and inapplicability of intrusion detection mechanisms.
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0045] See figure 1 , figure 1 It is a flow chart of an intrusion detection method for an industrial control system provided in the embodiment of this application. It should be noted that the following steps in this embodiment are executed by the industrial control master station in the industrial control system, and include the following steps:
[0046] S101: Obtain the response data packet returned by the slave station in the actual running state and the request data packet corresponding to the response data packet;
[0047] The request data packet is the data packet sent by the industrial control master station to the corresponding industrial control slave station according to the control requirements, and the response data packet is the response made by the industrial control slave station receiving the request data packet in response to the control command in the request data packet. It should be noted that the response data packets and request data packets obtained in t...
Embodiment 2
[0070] See image 3 , image 3 A flow chart of a method for obtaining intrusion training samples according to intrusion characteristic parameters provided by the embodiment of the present application. On the basis of the first embodiment proposing to obtain as many intrusion training samples as possible through incremental processing, this embodiment gives An implementation scheme is proposed, including the following steps:
[0071] S301: Expressing the intrusion feature parameters as intrusion feature vectors, and obtaining true intrusion feature points according to the intrusion feature vectors;
[0072] The reason why it is called a real intrusion feature point is to distinguish it from the false intrusion feature point obtained by subsequent incremental processing. Among them, the real intrusion feature points are obtained by processing the intrusion feature parameters collected when the industrial control system is known to be in an intruded state, and are real, effecti...
Embodiment 3
[0078] See Figure 4 , Figure 4 A flow chart of a method for obtaining pseudo-intrusion feature points provided in the embodiment of the present application. On the basis of Embodiment 2, this embodiment specifically provides a preferred method for obtaining pseudo-intrusion feature points, including the following steps:
[0079] S401: Obtain the artificial intrusion feature points obtained when the artificially controlled industrial control system is in a preset intrusion state;
[0080] This step is the slightly complicated incremental processing method mentioned in the second embodiment, but the obtained feature points are not directly used as pseudo-intrusion feature points, but are used as a precursor to obtain pseudo-intrusion feature points. In order to obtain more suitable pseudo-intrusion feature points that are closer to the actual situation.
[0081] S402: Make a connection between each real intrusion feature point and its nearest artificial intrusion feature poi...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More