Data detection method and device, electronic equipment and readable storage medium

Abstract

The invention provides a data detection method and device, electronic equipment and a readable storage medium, and the method comprises the steps: converting byte stream information under each industrial control protocol into vectorized data, and obtaining protocol label information corresponding to each vectorized data; for each to-be-detected data set, inputting vectorized data and protocol label information included in the to-be-detected data set into the trained CVAE model to output recovery data; for each to-be-detected data set, calculating a fusion loss value of the to-be-detected data set according to the vectorized data and the recovery data; and comparing the fusion loss value with a decision threshold, and determining a detection result of the to-be-detected data set corresponding to the fusion loss value according to a comparison result. According to the method, protocol label information can be used as an input reference to obtain recovery data, then a fusion loss value is obtained, and a detection result is determined according to a comparison result of the fusion loss value and a decision threshold, so that byte stream information under different industrial control protocols can be detected by using the same model.

Description

technical field [0001] The present application relates to the field of data detection, in particular, to a data detection method, device, electronic equipment and readable storage medium. Background technique [0002] Industrial Control Systems (ICS for short) is an automatic control system composed of computers and industrial process control components, which plays an important role in realizing equipment control functions and ensuring facility safety. With the continuous development of technology, ICS has gradually begun to adopt Ethernet, common protocols, wireless devices, etc., and the key infrastructure in ICS has also been exposed to the Internet, and the risk of network attacks faced by ICS has also greatly increased. [0003] In the prior art, the risk of an ICS being attacked by a network can be reduced as much as possible through network attack detection. The currently widely used network attack detection models can be roughly divided into the following categorie...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the embodiment of the present application is to provide a data detection method, device, electronic device and readable storage medium to improve the difficult problem in the prior art that multiple models need to be deployed at one time for network attack detection

Images