Exception detection feature construction method, module, storage medium, device and system

Abstract

The invention discloses an exception detection feature construction method, module, storage medium, device and system, and the method comprises the following steps: S1, extracting the flow data of a sliding time window, and aggregating the flow taking a lower computer / slave computer as a source address in each sliding time window; and S2, in the current sliding time window, for each lower computer / slave computer serving as a source address, extracting the first n pieces of flow data of the current data flow time t0 to perform n-gram communication behavior feature construction, wherein n is a positive real number larger than 2, and the constructed n-gram communication behavior features are combined with a detection algorithm model to construct and adjust anomaly detection features and the like. The method is suitable for characterization of communication behaviors of different industrial control scenes, solves the problem that only a very small number of abnormal communication samples cannot be obtained or can be obtained in a real scene, can detect complex man-in-the-middle attacks, enhances the detection effect, improves the detection precision and the like.

Description

technical field [0001] The present invention relates to the field of industrial network security, and more specifically, to a construction method, module, storage medium, equipment and system of anomaly detection features. Background technique [0002] Among industrial control systems (ICS), the ones that contain the most vulnerabilities are human-machine interfaces, electronic devices, and SCADA systems. Due to the lack of security of SCADA systems and their increasing connectivity to the Internet, they are vulnerable to internal and external cyber-attacks. [0003] Compared with the data in the IT network, the control process in the SCADA system has regularity, and this regularity is also reflected in the underlying network data. Therefore, the network data of the industrial control system has the characteristics of limited state and limited behavior. The main detection methods can be divided into misuse detection and anomaly detection. [0004] Misuse detection is to es...

AI Technical Summary

Problems solved by technology

The traditional Modbus anomaly detection model usually expresses the control behavior characteristics by constructing n-gram sequence of function codes, and statistical characteristics such as the duration and time interval of the current session flow, and cannot cope with complex man-in-the-middle attacks (such as replay attacks, unchanged Detection of Complex Response Injection Attack of Function Code

Images