A Method of Industrial Communication Anomaly Detection Based on Dual Similarity Measures

Abstract

An industrial communication anomaly detection method based on dual similarity measures. This method analyzes the communication data in the industrial control network and extracts the industrial communication behavior characteristics according to the industrial communication interaction mode and the industrial protocol specification. Based on these characteristics, the behavior characteristic tree is constructed, respectively. Intra-tree similarity measurement and inter-tree similarity measurement, so as to discover abnormal communication conditions in industrial control networks. Through the above method, the present invention can comprehensively consider general network behavior characteristics and industrial protocol semantic characteristics, and detect industrial communication abnormalities caused by malicious attacks or misoperations and generate alarms through real-time analysis and abnormal judgment of industrial communication data to ensure Industrial control system security.

Description

technical field [0001] The invention relates to the technical field of industrial control system network security, and more particularly to an industrial communication anomaly detection method based on double similarity measurement. Background technique [0002] At present, the hidden dangers of information security risks in my country's industrial control systems are particularly prominent, and the situation is very serious. According to the security report of the Industrial Control System Cyber ​​Emergency Response Team under the U.S. Department of Homeland Security, information security incidents targeting industrial control systems have shown a step-by-step growth trend in recent years, among which energy, manufacturing and other industries account for the largest proportions. Especially in recent years, the integration of the Internet and industrial control systems has broken the original inherent closedness of industrial systems, and the information security problems h...

AI Technical Summary

Problems solved by technology

[0005] The above-mentioned industrial anomaly detection methods often only provide anomaly detection capabilities from a certain aspect of industrial network communication. For example, many statistical-based methods use the CUSUM algorithm to calculate abnormal change points of Changes in industrial activities (such as changes in function codes) to achieve anomaly discovery lack comprehensive consideration of all industrial communication characteristics, and its anomaly detection capabilities are limited. At the same time, the adoption of anomaly detection engine methods is also one-sided.

Images