Industrial control network security detection method and device, electronic equipment and storage medium

Abstract

The invention discloses an industrial control network security detection method, which comprises the following steps of: receiving a first random parameter, and dynamically obtaining a heterogeneous base detector subset from a base detector library; receiving a second random parameter, and dynamically obtaining an integration algorithm from an integration algorithm library, the integration algorithm library being pre-configured; adaptively extracting a feature subset of the network session to be detected based on each base detector in the heterogeneous base detector subset; and inputting the feature subset into the heterogeneous base detector subset, and processing an obtained output result through the integration algorithm to obtain a detection result. According to the method, the heterogeneous base detectors and the heterogeneous integration method are dynamically selected, and the dynamic heterogeneous integration method is adopted for different base detectors, so that attackers arenot easy to capture vulnerabilities of a detection system to fight against attacks.

Description

technical field [0001] The present application relates to the field of industrial control, and in particular to an industrial control network security detection method, device, electronic equipment and storage medium. Background technique [0002] All network attacks will be manifested as abnormal communication behaviors, which is the basis for network security monitoring through passive traffic detection. Combined with the characteristics of the layered structure of the industrial control network, the current industrial control network attack scenarios mainly have three manifestations: one is the traditional network attack against the 3-4 layer network layer and the transport layer in the OSI seven-layer protocol, such as scanning detection, DDoS, Buffer overflow attacks; the second is network attacks based on industrial control depth protocols targeting the seventh layer of the OSI protocol, such as C&C communication, DDoS, S7 in SCADA systems, Modbus traffic tampering, an...

AI Technical Summary

Problems solved by technology

One is an anomaly detection technology that relies entirely on unsupervised learning. It does not need to mark the data in advance. It can use the internal connection of the data itself in the space-time dimension, through statistics-based, hierarchical, cluster-based, and isolation-based However, there are also the following disadvantages: the distribution of security data in different application scenarios varies greatly, and the selection and design of anomaly detection models is a challenge; the detection ability of a single anomaly detection model is limited, and the false alarm rate is high

Images