A method and device for detecting abnormal flow in industrial control network based on sequence prediction

Abstract

The present invention discloses a method and device for detecting abnormal traffic in an industrial control network based on sequence prediction, which increases the recall rate and detection accuracy of abnormal detection in industrial control systems. The present invention targets the traffic packet characteristics of industrial control systems, and on the basis of considering quintuple information, considers the unique function codes of industrial control protocols, the time characteristics of data packets caused by the long-term stable operation of industrial control systems, and the coupling of function codes and data packet lengths, etc., uses a multi-level whitelist to preliminarily screen the messages, improves detection efficiency, and reduces the impact of abnormal data on model performance; uses an LSTM‑SVM model structure, uses a neural network that considers timing information to extract the hidden logical relationship between data packets, and uses SVM to output classification results to improve detection accuracy.

Description

Technical Field

[0001] The present invention belongs to the field of industrial control system security, and relates to a method and device for detecting industrial control network flow anomaly based on sequence prediction. Background Art

[0002] Industrial control systems are composed of multiple control loops. The control loops are implemented by controllers, sensors, and actuators. The sensors transmit the measured physical information to the controllers; the controllers calculate and process the information received from the sensors according to the control algorithms to obtain control signals and transmit them to the actuators; the actuators perform operations based on the information and ultimately achieve the control purpose.

[0003] Distributed Control Systems (DCS) and Supervisory Control and Data Acquisition (SCADA) are common control system structures. DCS is a system that controls production processes in the same geographical location. SCADA is a system that collects data, monitors and controls. SCADA can contain multiple DCS systems for local control and use remote control units (RTU) for remote control. PLC is an important control component, usually used in SCADA and DCS systems to implement specific operations and provide local process management through loop control.

[0004] At the beginning of the design of industrial control systems, due to their physical isolation from the outside world, only reliability and physical security issues were considered in terms of security issues. With the development of digitalization, information technology is increasingly used in industrial control systems in order to better grasp production data and apply production data to enterprise management. With the use of information technology, industrial control systems are threatened by viruses, Trojans, and other threats faced by traditional information systems. In order to ensure the security of industrial control systems, effective defense measures must be considered.

[0005] Intrusion detection technology is a defense method first applied in the field of information systems. Intrusion detection can detect potential threats when abnormal behavior occurs and take certain measures to further defend against it without making too many changes to the original system. With the promotion of Ethernet and TCP / IP networks in industrial control systems, intrusion detection technology can be applied to industrial control systems. Intrusion detection technology is divided into two categories: host-based and network-based intrusion detection technology. Due to the particularity of industrial control, host-based intrusion detection technology that requires frequent updates of host configuration is not suitable for application in industrial control systems. Network-based intrusion detection technology obtains network flow information through network switching devices and analyzes suspicious behavior patterns based on this information. Summary of the invention

[0006] The purpose of the present invention is to provide a method and device for detecting anomaly of industrial control network traffic based on sequence prediction in view of the deficiencies and insufficiencies of the current industrial control system security.

[0007] The objective of the present invention is achieved through the following technical solutions:

[0008] According to a first aspect of the present specification, a method for detecting anomaly in industrial control network traffic based on sequence prediction is provided, the method comprising the following steps:

[0009] (1) The communication data of the industrial control system is collected using packet capture software in promiscuous mode, including data packets in long-term normal operation and data packets in abnormal state. The normal communication behavior of the intranet host automatically querying the default gateway is removed, and each data packet in the communication data is marked with a category label to construct a training set.

[0010] (2) Perform protocol analysis on each data packet of the industrial control system to identify and extract effective features, including: source IP, destination IP, source port, destination port, protocol type, industrial control protocol function code, data packet length, time interval between two data packets, and industrial control protocol data segment length;

[0011] (3) Creating a whitelist and using it for preliminary screening; the whitelist includes three parts arranged in sequence: a five-tuple whitelist, an industrial control protocol function code whitelist, and an industrial control protocol data segment length whitelist. Only data packets within the whitelist range can pass the screening, and the screened data packets are marked as abnormal data packets;

[0012] (4) Preprocess the effective features extracted from each data packet and convert them into a standardized vector data;

[0013] (4.1) The preprocessing method of the time interval feature includes: calculating the time interval between the reception time of the current data packet and the reception time of the previous data packet; taking the logarithm of 10 for the time interval feature and performing maximum and minimum normalization processing, dividing the normalized time interval feature into a number of distribution intervals using a clustering algorithm, and updating the distribution interval number to the original corresponding data packet;

[0014] (4.2) The preprocessing method of the data packet length feature includes: for data packets of different lengths, the length features are uniformly compressed into different digital intervals in proportion, and the compressed length feature values ​​are normalized to the maximum and minimum values ​​and then used as the data packet length feature;

[0015] (4.3) Connect all the categories of each data packet, the distribution interval number processed by step (4.1), and the data packet length feature processed by step (4.2) into a hashable string, number the data packets, and convert them into one-hot vectors;

[0016] (5) Using the one-hot vector obtained in step (4), a prediction model based on the LSTM-SVM structure is established to predict the type of data packet at the next moment; using the prediction model, the anomaly detection problem is converted into an optimization problem of the loss function, the prediction model is trained and optimized, and the parameters of the prediction model are updated;

[0017] (6) Using the model trained in step (5), detect the data packets to be detected in the actual industrial control system to determine whether the data packets are normal or abnormal.

[0018] Furthermore, in step (1), the external device is connected to the internal communication network of the industrial control system, and the communication data of the industrial control system is collected using the packet capture software Wireshark in promiscuous mode, where the data source is actual field data or security test platform data.

[0019] Furthermore, in step (2), the source IP, destination IP, source port, destination port, protocol type, and industrial control protocol function code are categorical quantities, and the length and time interval are numerical quantities, which represent the traffic size and communication frequency information carried during the data packet communication process, wherein the time interval carries certain industrial control equipment fingerprint information; the protocol type focuses on the type of industrial control private protocol used; and the industrial control protocol function code is a feature unique to the industrial control field that characterizes the operator's intention.

[0020] Furthermore, in the step (2), the data segment portion of the industrial control protocol is a unique portion of the industrial control system communication data packet, which includes the host computer's operation on the controller, the controller's real-time status or the controller's memory data. Its length and format have special definitions and are correlated with the industrial control protocol function code. By identifying the length of the industrial control protocol data segment and comparing it with the industrial control protocol function code, the legitimacy of the data packet can be verified, the purpose of the data packet can be analyzed, and the data packet can be detected simply and quickly.

[0021] Furthermore, in the step (3), the method for constructing the five-tuple whitelist is as follows: extracting source IP, destination IP, source port, destination port, and protocol type features from the data packets collected in the step (1) under long-term normal operation state, and storing them in a hash table to form a five-tuple whitelist;

[0022] The method for constructing the industrial control protocol function code whitelist is as follows: extracting the industrial control protocol function code from the data packets collected in step (1) under a long-term normal operation state to form a function code whitelist;

[0023] The method for constructing the industrial control protocol data segment length whitelist is as follows: the industrial control protocol data segment length is correlated with the industrial control protocol function code, the data segment length of the same industrial control protocol function code is limited to a certain length range or a fixed length, and the data segment length range is set according to expert experience to form the industrial control protocol data segment length whitelist.

[0024] Furthermore, in step (4), the preprocessing method of the time interval feature is specifically as follows:

[0025] (a) Calculate the time interval between the current data packet reception time and the previous data packet reception time. The calculation formula is as follows:

[0026]

[0027] Where i represents the current data packet number, Δt i Represents the time interval characteristics of the i-th data packet, t i represents the receiving time of data packet i; the time interval c of the first captured data packet is estimated by the least square method using the data of the 2nd to 4th time intervals;

[0028] (b) After taking the logarithm of 10 for the time interval feature, a maximum and minimum normalization process is performed, and the normalized time interval feature is divided into several distribution intervals using a clustering algorithm, and the distribution interval number is updated to the original corresponding data packet.

[0029] Furthermore, in the step (4), the preprocessing method for the data packet length feature is specifically as follows: for data packets with a length in the range of 0-150 bytes, the length feature is uniformly compressed to 0-9 in proportion; for data packets with a length in the range of 150-999 bytes, the length feature is uniformly compressed to 9-20 in proportion; the length feature value after segmentation compression is between 0 and 20, and the compressed length feature value is normalized to the maximum and minimum and used as the data packet length feature.

[0030] Furthermore, in step (5), the prediction model includes an Embedding layer, an LSTM hidden layer 1, a Dropout layer, an LSTM hidden layer 2, and an SVM layer connected in sequence; the Embedding layer converts the input one-hot vector into a word vector of length N; the two LSTM hidden layers receive sample features for training; the Dropout layer is used to avoid overfitting of the model; the SVM layer serves as an output layer, takes the hidden layer sparse feature data output by the LSTM hidden layer 2 as input, and outputs the data packet type; the classification decision function f of the SVM layer is as follows:

[0031]

[0032] in is a Lagrange multiplier and y (n) is the category label, y∈{+1,-1}, sgn(·) is the sign function, when b * is the bias, k(·,·) is the radial basis kernel function, x (n) is the nth sample in the training set, and x is the independent variable.

[0033] Furthermore, in step (5), the loss function L is as follows:

[0034] L=max(0,1-y (n) w T x (n) )

[0035] Where w is the weight vector obtained through training, and T represents transposition. The Adam optimization algorithm is used to update the weight vector during training.

[0036] According to the second aspect of this specification, there is provided an industrial control network traffic anomaly detection device based on sequence prediction, comprising a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement the industrial control network traffic anomaly detection method based on sequence prediction as described in the first aspect.

[0037] The beneficial effects of the present invention are as follows: the method and device for detecting abnormal flow of industrial control networks based on sequence prediction proposed by the present invention increase the recall rate and detection accuracy of abnormal flow detection of industrial control systems. The present invention targets the flow packet characteristics of industrial control systems, and on the basis of considering the five-tuple information, considers the unique function codes of industrial control protocols, the time characteristics of data packets caused by the long-term stable operation of industrial control systems, and the coupling characteristics of function codes and data packet lengths, etc., uses a multi-level whitelist to preliminarily screen the messages, improves the detection efficiency, and reduces the impact of abnormal data on model performance; uses the LSTM-SVM model structure, uses a neural network that considers timing information to extract the hidden logical relationship between data packets, and uses SVM to output the classification results, thereby improving the detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a flow chart of an industrial control network traffic anomaly detection method based on sequence prediction provided by an exemplary embodiment.

[0039] Figure 2 It is a schematic diagram of a whitelist structure provided by an exemplary embodiment.

[0040] Figure 3 It is a schematic diagram of the LSTM-SVM prediction model structure provided by an exemplary embodiment.

[0041] Figure 4It is a structural block diagram of an industrial control network traffic anomaly detection device based on sequence prediction provided by an exemplary embodiment. DETAILED DESCRIPTION

[0042] The technical scheme in the present embodiment will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0043] The embodiment of the present invention provides a method for detecting anomaly of industrial control network traffic based on sequence prediction, comprising the following steps:

[0044] (1) Connect the external device to the internal communication network of the industrial control system, and use the packet capture software in promiscuous mode to collect the communication data of the industrial control system, including data packets in long-term normal operation and data packets in abnormal state, remove the normal communication behavior of the internal network host automatically querying the default gateway, and mark each data packet in the communication data with a category label, including normal and abnormal, to construct a training set and a test set. The data source can be actual field data or security test platform data. The packet capture software can be Wireshark.

[0045] (2) Focus on the communication process, perform protocol analysis on each data packet of the industrial control system, identify and extract effective features, including: source IP (IPsrc), destination IP (IPdst), source port (PORTsrc), destination port (PORTdst), protocol type (Protocol), industrial control protocol function code (FunCode), data packet length (Length), time interval between two data packets (Δt), industrial control protocol data segment length (P_Length). The first six categories are category quantities, that is, each identifier is only a type, while the length and time interval are numerical quantities, indicating the traffic size and communication frequency information carried by the data packet during the communication process, and the time interval carries certain industrial control equipment fingerprint information. The protocol type is different from the traditional classification and focuses on the type of industrial control private protocol used. The industrial control protocol function code is a feature unique to the industrial control field that represents the operator's intention. The data segment of the industrial control protocol is a unique part of the industrial control system communication data packet. It contains the host computer's operation on the controller, the controller's real-time status or the controller's memory data. Its length and format have special definitions and are correlated with the industrial control protocol function code. By identifying the length of the industrial control protocol data segment and comparing it with the industrial control protocol function code, it is possible to verify the legitimacy of the data packet, parse the purpose of the data packet, and quickly and easily detect the data packet.

[0046] (3) Create a whitelist and use it for preliminary screening.

[0047] The whitelist consists of three parts arranged in sequence: a five-tuple whitelist, an industrial control protocol function code whitelist, and an industrial control protocol data segment length whitelist. Only data packets within the whitelist range can pass the screening.

[0048] The method for constructing the five-tuple whitelist is as follows: extracting source IP, destination IP, source port, destination port, and protocol type features from the data packets collected in step (1) under long-term normal operation, storing them in a hash table to form a five-tuple whitelist;

[0049] The method for constructing the industrial control protocol function code whitelist is as follows: extracting the industrial control protocol function code from the data packets collected in step (1) under a long-term normal operation state to form a function code whitelist;

[0050] The method for constructing the industrial control protocol data segment length whitelist is as follows: the industrial control protocol data segment length is correlated with the industrial control protocol function code, the data segment length of the same industrial control protocol function code is limited to a certain length range or a fixed length, and the data segment length range is set according to expert experience to form the industrial control protocol data segment length whitelist;

[0051] The data packets to be detected are screened using the five-tuple whitelist, the industrial control protocol function code whitelist, and the industrial control protocol data segment length whitelist in turn, and the data packets that pass the screening are obtained, and the screened data packets are marked as abnormal data packets.

[0052] (4) Preprocessing the effective features extracted from each data packet and converting them into a standardized vector data, that is, each data packet corresponds to a standardized vector data;

[0053] (4.1) The preprocessing methods for time interval features include:

[0054] (a) Calculate the time interval between the current data packet reception time and the previous data packet reception time. The calculation formula is as follows:

[0055]

[0056] Where i represents the current data packet number, Δt i Represents the time interval characteristics of the i-th data packet, t i represents the receiving time of data packet i; the time interval c of the first captured data packet is estimated by the least square method using the data of the 2nd to 4th time intervals;

[0057] (b) After taking the logarithm of 10 for the time interval feature, a maximum and minimum normalization process is performed, and the normalized time interval feature is divided into several distribution intervals using a clustering algorithm, and the distribution interval number is updated to the original corresponding data packet.

[0058] (4.2) The preprocessing methods for the data packet length characteristics include:

[0059] For data packets with a length ranging from 0 to 150 bytes, their length characteristics are uniformly compressed to 0-9 in proportion. For data packets with a length ranging from 150 to 999 bytes, their length characteristics are uniformly compressed to 9-20 in proportion. The length characteristic value after segmentation compression is between 0 and 20. The compressed length characteristic value is normalized to the maximum and minimum and used as the data packet length feature.

[0060] (4.3) All the category quantities of each data packet, the distribution interval number processed by step (4.1), and the data packet length feature processed by step (4.2) are concatenated into a hashable string. The data packets are numbered and converted into one-hot vectors using the Dict data structure of the Python language.

[0061] (5) Using the one-hot vector obtained in step (4), a prediction model based on the LSTM-SVM structure is established to predict the type of data packet at the next moment.

[0062] The established prediction model includes the Embedding layer, LSTM hidden layer 1, Dropout layer, LSTM hidden layer 2, and SVM layer connected in sequence. The Embedding layer converts the input one-hot vector into a word vector of length N. The two LSTM hidden layers receive sample features for training. The Dropout layer is used to avoid overfitting of the model. The SVM layer, as the output layer, takes the hidden layer sparse feature data output by LSTM hidden layer 2 as input and outputs the data packet type, that is, judges the data packet as normal or abnormal.

[0063] The implementation of the SVM layer is as follows: the radial basis kernel function is used to implicitly map samples from the original space to the high-dimensional space to solve the linear inseparability problem in the original feature space. The formula of the radial basis kernel function is as follows:

[0064]

[0065] where k(·,·) is the radial basis kernel function, x (n) is the nth sample in the training set, x is the independent variable, σ is an adjustable free parameter, ||x (n) -x|| 2 is the squared Euclidean distance between two eigenvectors.

[0066] The classification decision function f of the SVM layer is as follows:

[0067]

[0068] in is a Lagrange multiplier and y (n) is the category label, y∈{+1,-1}, sgn(x) is the sign function, when x>0, sgn(x)=1; when x=0, sgn(x)=0; when x<0, sgn(x)=-1, b * For bias.

[0069] The prediction model is used to transform the anomaly detection problem into an optimization problem of the loss function. The prediction model is trained and optimized, and the parameters of the prediction model are updated. The formula of the loss function L is as follows:

[0070] L=max(0,1-y (n) w T x (n) )

[0071] Where w is the weight vector obtained through training and T represents transpose.

[0072] (6) Using the model trained in step (5), detect the data packets to be detected in the actual industrial control system to determine whether the data packets are normal or abnormal.

[0073] Figure 1 It is a flow chart of the anomaly detection method of the present invention. After collecting network communication data from the industrial control system, the collected network communication data is processed. For the data packets collected under the normal state, they are marked as normal and used to build a whitelist. For the data packets collected under the abnormal state, they are marked as abnormal, and the training set and the test set are constructed together with the data packets marked as normal to train the LSTM-SVM prediction model. The data packets to be detected are first detected through the whitelist, and the data packets that fail the detection are directly marked as abnormal. After the data packets that pass the detection are preprocessed, the detection results are obtained through the LSTM-SVM prediction model.

[0074] Figure 2 The whitelist structure diagram is shown below. The whitelist consists of three parts arranged in sequence: a five-tuple whitelist, an industrial control protocol function code whitelist, and an industrial control protocol data segment length whitelist; only data packets within the whitelist range can pass the screening.

[0075] Figure 3It is a specific hierarchical structure of the LSTM-SVM prediction model. The prediction model is divided into the Embedding layer, LSTM hidden layer 1, Dropout layer, LSTM hidden layer 2 and SVM layer. The prediction model is trained using the training set, and the Adam optimization algorithm is used to update the weight vector during the training process.

[0076] Corresponding to the above-mentioned embodiment of the method for detecting anomaly of industrial control network traffic based on sequence prediction, the present invention also provides an embodiment of the device for detecting anomaly of industrial control network traffic based on sequence prediction.

[0077] See also Figure 4 An embodiment of the present invention provides an industrial control network traffic anomaly detection device based on sequence prediction, including a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement the industrial control network traffic anomaly detection method based on sequence prediction in the above embodiment.

[0078] The embodiments of the industrial control network traffic anomaly detection device based on sequence prediction of the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the internal memory for execution. From the hardware level, if Figure 4 As shown, it is a hardware structure diagram of any device with data processing capability where the industrial control network traffic anomaly detection device based on sequence prediction of the present invention is located, except Figure 4 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0079] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0080] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0081] An embodiment of the present invention further provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, the method for detecting anomaly of industrial control network traffic based on sequence prediction in the above embodiment is implemented.

[0082] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0083] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0084] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0085] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0086] It should be understood that although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0087] The above description is merely a preferred embodiment of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present specification shall be included in the scope of protection of one or more embodiments of the present specification.

Claims

1. A method for detecting abnormal traffic in industrial control networks based on sequence prediction, characterized in that: The steps include: (1) The communication data of the industrial control system is collected using packet capture software in promiscuous mode, including data packets in long-term normal operation and data packets in abnormal state. The normal communication behavior of the intranet host automatically querying the default gateway is removed, and each data packet in the communication data is marked with a category label to construct a training set. (2) Perform protocol parsing on each data packet of the industrial control system to identify and extract effective features, including: source IP, destination IP, source port, destination port, protocol type, industrial control protocol function code, data packet length, time interval between two data packets, and industrial control protocol data segment length; among them, source IP, destination IP, source port, destination port, protocol type, and industrial control protocol function code are category quantities; (3) Creating a whitelist and using it for preliminary screening; the whitelist includes three parts arranged in sequence: a five-tuple whitelist, an industrial control protocol function code whitelist, and an industrial control protocol data segment length whitelist. Only data packets within the whitelist range can pass the screening, and the screened data packets are marked as abnormal data packets; (4) Preprocess the effective features extracted from each data packet and convert them into a standardized vector data; (4.1) The preprocessing method of the time interval feature includes: calculating the time interval between the reception time of the current data packet and the reception time of the previous data packet; taking the logarithm of 10 for the time interval feature and performing maximum and minimum normalization processing, dividing the normalized time interval feature into a number of distribution intervals using a clustering algorithm, and updating the distribution interval number to the original corresponding data packet; (4.2) The preprocessing method of the data packet length feature includes: for data packets of different lengths, the length features are uniformly compressed into different digital intervals in proportion, and the compressed length feature values ​​are normalized to the maximum and minimum values ​​and then used as the data packet length feature; (4.3) Connect all the categories of each data packet, the distribution interval number processed by step (4.1), and the data packet length feature processed by step (4.2) into a hashable string, number the data packets, and convert them into one-hot vectors; (5) Using the one-hot vector obtained in step (4), a prediction model based on the LSTM-SVM structure is established to predict the type of data packet at the next moment; using the prediction model, the anomaly detection problem is converted into an optimization problem of the loss function, the prediction model is trained and optimized, and the parameters of the prediction model are updated; The prediction model includes an Embedding layer, an LSTM hidden layer 1, a Dropout layer, an LSTM hidden layer 2, and an SVM layer connected in sequence; the Embedding layer converts the input one-hot vector into a word vector of length N; the two LSTM hidden layers receive sample features for training; the Dropout layer is used to avoid overfitting of the model; the SVM layer serves as an output layer, takes the hidden layer sparse feature data output by the LSTM hidden layer 2 as input, and outputs the data packet type; the classification decision function f of the SVM layer is as follows: in is a Lagrange multiplier and y (n) is the category label, y∈{+1,-1}, sgn(·) is the sign function, b * is the bias, k(·,·) is the radial basis kernel function, x (n) is the nth sample in the training set, and x is the independent variable; (6) Using the model trained in step (5), the data packets to be detected in the actual industrial control system are detected. The data packets to be detected are first detected through the whitelist, and the data packets that fail the detection are directly marked as abnormal; after preprocessing the data packets that pass the detection, the detection results are obtained through the prediction model based on the LSTM-SVM structure.

2. The method for detecting anomaly of industrial control network traffic based on sequence prediction according to claim 1 is characterized in that: In the step (1), the external device is connected to the internal communication network of the industrial control system, and the communication data of the industrial control system is collected using the packet capture software Wireshark in a promiscuous mode, where the data source is actual field data or security test platform data.

3. The method for detecting anomaly of industrial control network traffic based on sequence prediction according to claim 1 is characterized in that: In the step (2), the length and time interval are numerical quantities, which represent the traffic size and communication frequency information carried during the data packet communication process, wherein the time interval carries certain industrial control equipment fingerprint information; the protocol type focuses on the type of industrial control private protocol used; the industrial control protocol function code is a feature unique to the industrial control field that represents the operator's intention.

4. The method for detecting anomaly of industrial control network traffic based on sequence prediction according to claim 1 is characterized in that: In the step (2), the data segment portion of the industrial control protocol is a unique portion of the industrial control system communication data packet, which includes the host computer's operation on the controller, the controller's real-time status or the controller's memory data. Its length and format have special definitions and are correlated with the industrial control protocol function code. By identifying the length of the industrial control protocol data segment and comparing it with the industrial control protocol function code, the legitimacy of the data packet can be verified, the purpose of the data packet can be analyzed, and the data packet can be detected simply and quickly.

5. The method for detecting anomaly of industrial control network traffic based on sequence prediction according to claim 1 is characterized in that: In the step (3), the method for constructing the five-tuple whitelist is as follows: extracting source IP, destination IP, source port, destination port, and protocol type features from the data packets collected in the step (1) under a long-term normal operation state, and storing them in a hash table to form a five-tuple whitelist; The method for constructing the industrial control protocol function code whitelist is as follows: extracting the industrial control protocol function code from the data packets collected in step (1) under a long-term normal operation state to form a function code whitelist; The method for constructing the industrial control protocol data segment length whitelist is as follows: the industrial control protocol data segment length is correlated with the industrial control protocol function code, the data segment length of the same industrial control protocol function code is limited to a certain length range or a fixed length, and the data segment length range is set according to expert experience to form the industrial control protocol data segment length whitelist.

6. The method for detecting anomaly of industrial control network traffic based on sequence prediction according to claim 1 is characterized in that: In step (4), the preprocessing method of the time interval feature is specifically as follows: (a) Calculate the time interval between the current data packet reception time and the previous data packet reception time. The calculation formula is as follows: Where i represents the current data packet number, Δt i Represents the time interval characteristics of the i-th data packet, t i represents the receiving time of data packet i; the time interval c of the first captured data packet is estimated by the least square method using the data of the 2nd to 4th time intervals; (b) After taking the logarithm of 10 for the time interval feature, a maximum and minimum normalization process is performed, and the normalized time interval feature is divided into several distribution intervals using a clustering algorithm, and the distribution interval number is updated to the original corresponding data packet.

7. The method for detecting anomaly of industrial control network traffic based on sequence prediction according to claim 1 is characterized in that: In the step (4), the preprocessing method for the data packet length feature is specifically as follows: for data packets with a length in the range of 0-150 bytes, the length feature is uniformly compressed to 0-9 in proportion; for data packets with a length in the range of 150-999 bytes, the length feature is uniformly compressed to 9-20 in proportion. The length feature value after segmentation compression is between 0 and 20. The compressed length feature value is normalized to the maximum and minimum and used as the data packet length feature.

8. The method for detecting anomaly of industrial control network traffic based on sequence prediction according to claim 1 is characterized in that: In step (5), the loss function L is as follows: L=max(0,1-y (n) w T x (n) ) Where w is the weight vector obtained through training, and T represents transposition; The Adam optimization algorithm is used to update the weight vector during training.

9. An industrial control network traffic anomaly detection device based on sequence prediction, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the processor executes the executable code, it is used to implement the industrial control network traffic anomaly detection method based on sequence prediction as described in any one of claims 1-8.

Images