An ics network data detection method and device

Abstract

The embodiment of the present invention provides an ICS network data detection method and device, wherein the method includes: using non-abnormal data to retrain the preset tree integration data recognition model, when the retrained tree integration data recognition model In each binary tree sub-model, if there is a binary tree sub-model whose number of network data corresponding to the leaf nodes is greater than the second threshold, the binary tree sub-model is out of balance, which means that the binary tree sub-model has a negative impact on the accuracy of the tree integration data recognition model. Larger impact, the binary tree sub-model is deleted from the retrained tree ensemble data recognition model, and a new tree ensemble data recognition model is obtained, which improves the accuracy of the new preset tree ensemble data recognition model, so the recognition can be improved The accuracy of ICS network data improves the accuracy of ICS security protection.

Description

technical field [0001] The invention relates to the field of control technology, in particular to an ICS network data detection method and device. Background technique [0002] As the functional requirements of ICS (Industrial Control System, industrial control system) increase, ICS is increasingly connected to enterprise networks and the Internet. Therefore, the network environment of ICS becomes an open network environment, which is vulnerable to network attacks. [0003] In order to reduce the potential safety hazards caused by ICS being attacked by the network, the existing technology will protect the security of the ICS. The technical means adopted are: use the historical network data in the log information of the ICS as a training set, train the data recognition model, and then use The data identification model identifies the network data at the current moment in the industrial control system. If abnormal data is identified, the abnormal data is marked. The abnormal da...

AI Technical Summary

Problems solved by technology

[0004] Most of the network data of ICS is non-abnormal data, and the occurrence of abnormal data is rare. When ICS is continuously attacked by the network for a period of time, the network data of ICS will be marked as abnormal data within this period of time. The existing technology Use the continuous abnormal data during this period to retrain the data recognition model and adjust the parameters in the data recognition model. However, when the abnormal data is used to retrain the data recognition model, some parameters in the data recognition model will appear larger. For example, when normal data is used to train the data recognition model, the range of parameters in the data recognition model is between 0.2-0.5, and when the abnormal data is continuously used to retrain the data recognition model, the data recognition model Some of the parameters far exceed the variation range of the parameters, resulting in a greater impact on the accuracy of the data recognition model, resulting in a reduction in the accuracy of the retrained data recognition model, which further leads to the safety protection of ICS. reduced accuracy

Images