Abnormal attack detection method and device

A technology of attack detection and detection method, which is applied in electrical testing/monitoring, testing/monitoring control systems, instruments, etc., can solve problems such as the inability to take countermeasures for abnormal conditions of industrial equipment, and achieve the goal of prolonging the length of time and improving real-time performance Effect

CN109375609BActive Publication Date: 2021-02-02北京鼎力互联技术有限公司
5 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Publication Date
2021-02-02

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention, which relates to the technical field of industrial control, provides a method and device for detecting an abnormal attack. The method comprises the following steps that: device data ofan industrial device are obtained, wherein the device data are used for expressing the state of the industrial device within a preset period of time; the device data are inputted into an attack detection model to obtain a detection result, wherein the detection result is obtained by analyzing the device data by the attack detection model based on historical device data of the industrial device; and according to the detection result, whether the industrial device is under an abnormal attack is determined. According to the invention, the attack detection model analyzes the current device data ofthe industrial device based on the historical device data of the industrial device, whether the industrial device is under an abnormal attack is determined, and the long-time running state of the industrial device in future is predicted, so that a problem that the user can not take corresponding measures based on the predicted abnormal state because the industrial device is predicted to will havean abnormal state within short time is solved; the time length of prediction by the terminal is prolonged; and the real-time performance of the abnormal attack detection by the terminal is improved.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The invention relates to the technical field of industrial control, in particular to a method and device for detecting abnormal attacks. Background technique

[0002] With the continuous development of science and technology, neural network models have been gradually applied to industrial control systems, allowing users to predict the behavior of various industrial equipment in industrial control systems based on neural network models.

[0003] In the related technology, the sensor can detect the state of the industrial equipment and obtain the data of the industrial equipment. Correspondingly, the data obtained by the sensor can be input into the neural network model, so that the neural network model can make predictions based on the obtained data and output the prediction results, so that according to The prediction result determines whether the industrial equipment is under abnormal attack, thereby reminding the user whether the industrial equipment...

Examples

Embodiment Construction

[0048] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments.

[0049] figure 1 A schematic diagram of the scene involved in the detection method of an abnormal attack provided by the present invention; figure 1 As shown, the scene includes: industrial equipment 110 , sensors 120 and terminals 130 .

[0050] Wherein, the sensor 120 is respectively connected with the industrial equipment 110 and the terminal 130 for detecting and acquiring data during the operation of the industrial equipment 110 and sending the acquired data to the terminal 130 .

[0051] Specifically, during the operation of the industrial eq...