Industrial control system equipment behavior modeling method and device based on secondary labeling of state time delay conversion diagram

Abstract

The invention relates to an industrial control system equipment behavior modeling method and device based on secondary labeling of a state delay conversion diagram. The method comprises the following steps: (1) preprocessing state data; performing discrete variable binarization and continuous variable binarization operation on the state data to generate multiple groups of binary state sets; (2) constructing a state time delay conversion diagram; constructing a state delay conversion diagram corresponding to each binary state set for the binary state set; (3) performing primary labeling based on ring discovery; carrying out primary labeling by adopting a labeling process of state conversion edges and rings; and (4) performing secondary labeling based on time delay feature clustering; and the output is each parameter in the behavior model. According to the method, description of equipment state conversion and corresponding duration is achieved, state data generated by process equipment in a real-time water distribution system in real time are input into the behavior model, whether the current state of the process equipment conforms to the data relation and conversion relation described in the behavior model can be effectively found, and abnormity detection is achieved.

Description

technical field [0001] The invention relates to a state-based delay conversion Figure II The industrial control system equipment behavior modeling method and device marked this time belong to the field of information security technology. Background technique [0002] In the research of anomaly detection in industrial control systems, the normal behavior modeling of equipment is generally used to detect unknown abnormal states. The quality of the behavior model directly affects the accuracy of the detection results. The various types of equipment subjects in the industrial control system lead to various equipment behavior modeling methods. Generally, the control behavior operation mode is used as the modeling object. According to different modeling methods, researchers have conducted in-depth research from multiple perspectives in the fields of statistics, machine learning, and cybernetics: using deterministic models without random components, such as And / or graphs, finite ...

AI Technical Summary

Problems solved by technology

The detection accuracy based on state rules is high, but the construction often requires the assistance of domain experts

[0004] In order to solve the problem of strong artificial dependence in construction, the Almalawi team adopted a clustering algorithm to effectively distinguish between normal and critical states, and extracted critical state detection rules based on cluster features, which promoted the development of critical state detection methods However, its accuracy is highly dependent on the clustering algorithm; Xu's team used Apriori, PrefixSpan and other rule mining algorithms and the control logic program specification algorithm of the control equipment to automatically construct the control equipment state rules, and achieved good results; Yang The security team combined the equipment status information to identify the abnormal state of the industrial control equipment in the operation interval to realize abnormal detection. However, they focused on detecting the operation sequence and the corresponding state changes, without considering the characteristics of the state delay

Although Zhang Renbin's team considered the state delay characteristics, the method of using the mean value to describe the delay characteristics cannot fully express the operating characteristics of the industrial control system

Images