On-line monitoring method of communication flow in industrial control system based on sarima

Abstract

The invention discloses a method for on-line monitoring of communication flow of an industrial control system (ICS) based on SARIMA. In this method, SARIMA(p,d,q)x(P,D,Q) s Modeling analysis; and from the training and prediction step size and confidence interval defined by the small period, a traffic threshold model based on different confidence levels is generated. The monitoring host collects communication traffic data in real time from the industrial switch, and runs multiple small-period SARIMA models in a distributed manner, and generates real-time threshold intervals to perform anomaly detection and analysis on the current real-time collected communication traffic. The present invention conducts experimental analysis on a shooting range test bench that combines virtual reality with industrial control safety in Zhejiang Province, and provides a detailed algorithm description for the test data; finally, it is deployed and applied in a chemical group in Zhejiang Province to verify the reliability and accuracy of the algorithm sex.

Description

technical field [0001] The invention relates to network flow prediction of an industrial control system, in particular to a SARIMA-based method for on-line monitoring of communication flow of an industrial control system, which belongs to the field of industrial information security detection. Background technique [0002] Key infrastructure such as energy, refining and transportation is the nerve center for the stable operation of the country, and it is the top priority of my country's network security. With the advancement of automation, interconnection, and intelligent construction of large-scale national infrastructure (smart substations, intelligent chemical process industrial systems, and industrial distributed control systems), the issue of cyberspace security has become increasingly prominent. In recent years, a series of cyber-attacks against the country's critical infrastructure have caused enormous national economic losses and irreversible damage to society. Thes...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to solve the problem of dynamic modeling of ICS communication traffic collected in real time without prior knowledge, and the existing ICS communication traffic anomaly detection algorithm is too dependent on prior knowledge and the algorithm complexity is too high to be practically deployed proposed a comprehensive analysis method; the generated dynamic ICS communication traffic threshold model has guiding significance for the network security protection and anomaly detection of major national industrial infrastructures

Images