Data detection method, device, electronic device and readable storage medium

Abstract

The present application provides a data detection method, device, electronic device and readable storage medium, including: converting byte stream information under each industrial control protocol into vectorized data, and obtaining protocol label information corresponding to each vectorized data ; For each data group to be detected, input the vectorized data and protocol label information it includes into the CVAE model that the training is completed to output the recovered data; for each data group to be detected, according to the vectorized data and the recovered data, calculate The fusion loss value of the data set to be detected; the fusion loss value is compared with the decision threshold, and the detection result of the data set to be detected corresponding to the fusion loss value is determined according to the comparison result. The method can use the protocol label information as an input reference to obtain the recovered data, and then obtain the fusion loss value, and determine the detection result according to the comparison result with the decision threshold, so that the same model can be used to analyze the byte stream information under different industrial control protocols. detection.

Description

technical field [0001] The present application relates to the field of data detection, in particular, to a data detection method, device, electronic equipment and readable storage medium. Background technique [0002] Industrial Control Systems (ICS for short) is an automatic control system composed of computers and industrial process control components, which plays an important role in realizing equipment control functions and ensuring facility safety. With the continuous development of technology, ICS has gradually begun to adopt Ethernet, common protocols, wireless devices, etc., and the key infrastructure in ICS has also been exposed to the Internet, and the risk of network attacks faced by ICS has also greatly increased. [0003] In the prior art, the risk of an ICS being attacked by a network can be reduced as much as possible through network attack detection. The currently widely used network attack detection models can be roughly divided into the following categorie...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the embodiment of the present application is to provide a data detection method, device, electronic device and readable storage medium to improve the difficult problem in the prior art that multiple models need to be deployed at one time for network attack detection

Images