Industrial control intrusion detection method for hierarchical dependency relationship modeling

Abstract

The invention relates to an industrial control intrusion detection method for hierarchical dependency relationship modeling. The communication traffic is monitored in a data packet window mode, features are extracted from three aspects of a traffic layer, a data packet layer and a content layer, and dependency relationships of the three dimensions are respectively constructed through a parallel LSTM neural network in order to convert the relationship features of each single aspect into a multilayer dependency relationship model; and the outputs of different LSTM neural networks are integratedthrough a depth auto-encoder to form a final abnormal value output result. The attack traffic with different dependency relationships can be detected by analyzing the network flow sequence of the given data packet windows, and the implicit relationship of the traffic is analyzed from multiple dimensions and side surfaces, so that the range of traditional traffic detection is expanded, and the accuracy of attack traffic detection is improved; and the long-sequence learning capability of the LSTM neural networks is utilized to the maximum extent, and the change of the data flow is explained fromthe perspective of time dimension.

Description

technical field [0001] The invention relates to the technical field of industrial control system security, in particular to an industrial control intrusion detection method based on layered dependency modeling. Background technique [0002] With the development of the industrial Internet, the connection between the industrial control system and the external network is more frequent, and these phenomena make the security problems faced by the industrial control system more severe. Emerging attacks such as Stuxnet, PLC Blaster, PLC Inject, SABOT, LadderLogic Bomb, Dynamic Payloads, and Click pose a great threat to PLC security. [0003] In order to solve these problems, an intrusion detection system is proposed. By deploying the intrusion detection system on the key nodes of the network to monitor the incoming and outgoing traffic, it is possible to detect whether there is an attack or even establish the corresponding attack type, so as to carry out emergency response. In th...

AI Technical Summary

Problems solved by technology

[0007] However, these industrial control intrusion detection algorithms for traffic have the problem that the detection range is too narrow, and they do not take into account the multiple dependencies within the traffic flow, which easily leads to unsatisfactory detection results

Images