RBF improvement method, device and equipment based on industrial control anomaly detection

Abstract

The invention relates to the technical field of industrial control anomaly detection, in particular to an RBF improvement method, device and equipment based on industrial control anomaly detection, and the method comprises the steps: collecting network data of an industrial control system, carrying out the preprocessing of the network data to obtain sample network data, determining a clustering center of the hidden node in the sample network data based on a declustering algorithm, determining an expansion constant of the hidden node according to the clustering center, further determining an output weight of the hidden node based on a grey wolf algorithm, and determining an improved RBF optimization model according to the clustering center, the expansion constant and the output weight. According to the technical scheme provided by the invention, the clustering center, the expansion constant, the output weight and other network parameters of the RBF model are optimized through the subtractive clustering algorithm and the grey wolf optimization algorithm, the minimum value is avoided, the operation efficiency and the classification accuracy are improved, and the method, device and equipment are suitable for a high-dimensional redundant industrial control data set. Whether the network behavior of the industrial control system is abnormal or not can be quickly judged, and losses caused by network attacks are avoided.

Description

technical field [0001] The invention relates to the technical field of industrial control anomaly detection, in particular to an RBF improvement method, device and equipment based on industrial control anomaly detection. Background technique [0002] The industrial control system (ICS) is gradually developing towards a networked and open architecture. The original closedness is broken, and network threats such as loopholes, viruses, Trojan horses, and APTs also enter the industrial control system along with the normal information flow. At present, the manufacturing industry has become the industry most vulnerable to cyber attacks, and the intrusions of ICS and manufacturing computers account for one-third of all attacks. Once ICS is attacked, the loss will be immeasurable. Anomaly detection is a protection technology that ensures ICS security through security monitoring and abnormal alarms, that is, by collecting equipment and network-related information, analyzing and iden...

AI Technical Summary

Problems solved by technology

[0005] In view of this, the object of the present invention is to provide an improved RBF method, device and equipment based on industrial control anomaly detection, to overcome the existing industrial control network data sets with redundant attributes and poor correlation, the variable weight is difficult to determine, and it is easy to cause RBF network has a local optimal problem

Images