Industrial control system communication network anomaly classification method based on statistical learning and deep learning

Abstract

The invention discloses an industrial control system (ICS) communication network anomaly classification method based on statistical learning and deep learning. According to the invention, the method comprises the steps: designing LSTM deep learning structure parameters on the basis of the flow of a large-data-volume industrial control system communication network during normal operation, and performing modeling analysis; designing a correlation algorithm to analyze a numerical relationship between background traffic and real-time traffic by analyzing a real-time communication traffic data threshold generated based on a SARIMA online statistical learning model in the early stage; and carrying out specific classification on the ICS communication network anomaly according to an ICS network anomaly event classification algorithm. According to the invention, experimental analysis is carried out by using a target range test board combining industrial control safety virtuality and reality inZhejiang Province; meanwhile, a physical simulation platform is built in a laboratory environment to carry out a verification experiment, and detailed examples are given to verify the reliability andaccuracy of the algorithm.

Description

technical field [0001] The invention relates to anomaly detection of an industrial control system network, in particular to a method for classifying abnormal communication traffic of an industrial control system based on statistical learning and deep learning, and belongs to the field of industrial information security detection. Background technique [0002] Key infrastructure such as energy, refining and transportation is the nerve center for the stable operation of the country, and it is the top priority of my country's network security. With the advancement of automation, interconnection, and intelligent construction of large-scale national infrastructure (smart substations, intelligent chemical process industrial systems, and industrial distributed control systems), the issue of cyberspace security has become increasingly prominent. In recent years, a series of cyber-attacks against the country's critical infrastructure have caused enormous national economic losses and ...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to solve the problem of dynamic modeling and abnormal classification detection of ICS communication traffic collected in real time without prior knowledge, because the existing ICS abnormal event classification detection algorithm is too dependent on prior knowledge, and the classification accuracy is not high. A comprehensive analysis method was proposed due to the high complexity of the algorithm and the impossibility of actual deployment; the designed ICS network anomaly event classification algorithm model based on statistical learning and deep learning has guidance for the network security protection and anomaly detection of major national industrial infrastructures significance

Images