Repeated machining process concealment attack detection method based on hidden Markov model

Abstract

A repeated machining process concealment attack detection method based on a hidden Markov model is divided into a model training stage, a threshold determination stage and an intrusion detection stage, and each stage needs to be subjected to data preprocessing operation; in order to retain useful information and prevent distortion, a mean filtering method is proposed to obtain a theoretical mean value, then a residual error is calculated, namely the mean value is substracted from a sampling value, and an absolute value is taken to obtain a residual error value sequence; after data preprocessing, Baum-Welch algorithm is used for training to obtain model parameters, a forward algorithm is used for estimating a probability value, a threshold value is determined, and finally whether an attack exists or not is judged by judging the affinity of a real-time observation sequence and a model. According to the method, disturbance and attacks can be extracted, concealment attacks can be effectively detected, adjustment can be conducted according to specific data in the aspects of a quantification method and a final judgment decision, and the application range is wide.

Description

technical field [0001] The invention belongs to the technical field of industrial control system security, and in particular relates to a hidden Markov model-based detection method for concealed attacks in repeated processing processes. Background technique [0002] In the industrial control system, with the deep integration of informatization and automation, the originally relatively independent industrial control system is increasingly interconnected with the enterprise management network, making the threat of security issues gradually spread to the industrial control system, and the security of the industrial control system The problem is becoming more and more prominent. Covert network attacks are high-tech attacks that use adversarial covert evasion techniques and use network control to steal confidential information or long-term control and destruction attacks. Under normal circumstances, hidden attacks are highly technical, highly concealed, and long-term persistent....

AI Technical Summary

Problems solved by technology

[0004] In order to overcome the inability of the existing intrusion detection methods to detect covert attacks, it is assumed that covert attacks invade the control system and tamper with the output data of the control, and at the same time escape the detection of the industrial control system, while the sampling data of the external sensor is not detected. In order to effectively detect such attacks in industrial control systems, the present invention proposes a concealed attack detection method based on hidden Markov model, which detects whether there is an attack from the data characteristics sampled by the sensor. It is divided into three stages: model training, threshold determination and intrusion detection, and each stage requires data preprocessing

Images