A method for detecting abnormal behavior of industrial control based on multiple machine learning algorithms

Abstract

The invention discloses a method for detecting abnormal behavior of industrial control based on various machine learning algorithms. Firstly, the flow data of the distributed control system of power generation is collected and calibrated, and then the calibrated flow data are used to respectively construct a training sample set and a test sample set, and then The samples are subjected to multi-dimensional feature extraction and vectorization processing, and then a classification model based on a variety of machine classification learning methods is established. Finally, the real-time traffic data of the power generation distributed control system will be collected and input into the classification model. If the output classification result is malicious traffic, then It is determined that industrial control abnormal behavior occurs, otherwise, it is determined that industrial control abnormal behavior does not occur; the invention can effectively classify and detect samples, quickly detect abnormal behavior problems existing in industrial control systems, and accurately identify potential malicious and abnormal behaviors.

Description

technical field [0001] The invention relates to the technical field of abnormal network traffic detection of industrial control systems, in particular to a method for detecting abnormal behavior of industrial control based on various machine learning algorithms. Background technique [0002] Industrial control system, referred to as industrial control system. At present, industrial control systems have been widely used in key infrastructures in many industries such as electric power, transportation, energy, intelligent machinery, bioengineering, aerospace, chemical industry, and finance. Industrial control systems have also become an important part of national key infrastructures. Therefore, the industrial control system plays a decisive role in the national economy and the people's livelihood, especially the power grid industrial control system. Every security incident will bring huge impact and harm. What's more serious is that because the industrial control system did no...

AI Technical Summary

Problems solved by technology

[0004] In addition, previous researchers mostly focused on traditional control systems such as SCADA systems and traditional control protocols, and there are still a lot of gaps in the research on abnormal behavior of industrial control networks. The multi-dimensional characteristics of the traffic, although the detection method using the traditional characteristics can achieve good results, but this relatively simple characteristic cannot fully describe the behavior of the industrial control system

At present, although some researchers have introduced its learning algorithm into industrial control malicious traffic detection and classification, most of them are limited to the realization of a single machine learning algorithm.

Images