Anomaly detection method applied to industrial control environment

Abstract

The invention discloses an anomaly detection method applied to an industrial control environment. The method comprises the following steps of: 1, establishing an environment baseline by adopting an autonomous learning mode based on a production field network environment; wherein the environment baseline comprises a production field device set, a communication connection set, a communication protocol set, a connection data packet set and a communication content set; 2, monitoring each communication connection, judging whether the communication devices, the communication connections, the communication protocols, the sent and received data packets and the sent and received data packet contents of the two communication parties are normal or not by utilizing the established environment base line, and sending abnormal information when an abnormality is monitored; and 3, judging whether the received abnormal information is correct abnormal information or not, and if the received abnormal information is misreported abnormal information, marking the abnormal information as misreported abnormal information and feeding back the misreported abnormal information to a system for environment baseline calibration. According to the invention, the environment baseline is established to carry out anomaly detection of multi-feature fusion, and communication anomaly behavior detection in the industrial environment can be realized.

Description

technical field [0001] The invention relates to the technical field of industrial network security, in particular to an anomaly detection method applied to an industrial control environment. Background technique [0002] The communication of the power system in the industrial environment is relatively stable, and the abnormal communication is sporadic and sporadic. At this time, most of them correspond to operation and maintenance or malicious attacks. Such sporadic behaviors have huge potential threats. With the gradual construction of the ubiquitous power Internet of Things, the power system will enter a new era of Internet of Everything, and the operating environment will gradually transition from relatively independent to electric power interconnection, and the potential threats it faces will also increase sharply. Traditional anomaly detection methods are mostly based on industry experience or single features, and deal with a single abnormal behavior, which is not unive...

AI Technical Summary

Problems solved by technology

Traditional anomaly detection methods are mostly based on industry experience or single features, and deal with a single abnormal behavior, which is not universal

Images