Industrial control network brute force cracking flow detection method based on random forest

Abstract

The invention discloses an industrial control network brute force cracking flow detection method based on a random forest. The industrial control network brute force cracking flow detection method mainly comprises two parts: 1, training a brute force cracking detection model based on the random forest; and 2, carrying out brute force cracking detection on the real-time network flow data by using the brute force cracking detection model. The brute force cracking detection model is generated based on the random forest algorithm, brute force cracking can be detected in real time, brute force cracking flow can be recognized in the first time, and real-time response is made according to the provided solution.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a random forest-based traffic detection method for brute force cracking of an industrial control network. Background technique [0002] The challenges facing industrial control network security include the invasion of new types of Trojan horses and worms. For example, the "Mirai" virus that caused the large-scale Internet paralysis in the eastern United States made full use of the hardware coding loopholes in existing smart terminal devices such as network cameras and smart switches. The way of breaking through the access control authority of related devices, thus forming a botnet of hundreds of thousands of devices. [0003] Industrial control network information security protection has its particularity. First, the subject of protection and attack is special. Unlike traditional network attacks, industrial intruders are not traditional hackers, but are likel...

AI Technical Summary

Problems solved by technology

[0004] In recent years, emerging technologies such as cloud computing and network security protection based on big data theory have been applied to the field of traditional information security. These new technologies can effectively identify malicious files on terminals, but these technologies are rarely used in the field of industrial control systems.

Images