Industrial control system communication flow online monitoring method based on SARIMA

Abstract

The invention discloses an industrial control system (ICS) communication flow online monitoring method based on SARIMA. The method comprises the following steps: carrying out small-period SARIMA(p, d,q)x(P, D, Q)s modeling analysis on an industrial control network flow sequence; and generating a flow threshold model based on different confidence coefficients according to the training and prediction step length defined by the small period and the confidence interval. The monitoring host collects communication flow data from the industrial switch in real time, operates a plurality of small-period SARIMA models in a distributed manner, generates a real-time threshold interval, and carries out anomaly detection analysis on the communication flow collected in real time at present. According tothe invention, experimental analysis is carried out by using a target range test board combining industrial control safety virtuality and reality in Zhejiang Province, and detailed algorithm description is provided for test data; and finally, field deployment and application is performed in a certain chemical group in Zhejiang Province to verify the reliability and accuracy of the algorithm.

Description

technical field [0001] The invention relates to network flow prediction of an industrial control system, in particular to a SARIMA-based method for on-line monitoring of communication flow of an industrial control system, which belongs to the field of industrial information security detection. Background technique [0002] Key infrastructure such as energy, refining and transportation is the nerve center for the stable operation of the country, and it is the top priority of my country's network security. With the advancement of automation, interconnection, and intelligent construction of large-scale national infrastructure (smart substations, intelligent chemical process industrial systems, and industrial distributed control systems), the issue of cyberspace security has become increasingly prominent. In recent years, a series of cyber-attacks against the country's critical infrastructure have caused enormous national economic losses and irreversible damage to society. Thes...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to solve the problem of dynamic modeling of ICS communication traffic collected in real time without prior knowledge, and the existing ICS communication traffic anomaly detection algorithm is too dependent on prior knowledge and the algorithm complexity is too high to be practically deployed proposed a comprehensive analysis method; the generated dynamic ICS communication traffic threshold model has guiding significance for the network security protection and anomaly detection of major national industrial infrastructures

Images