An intrusion detection method and system based on industrial control equipment communication
By constructing a communication intrusion detection model of industrial control equipment based on benign network flow feature vectors, the problem of single considerations and insufficient training of detection models in the existing technology is solved, and more accurate and efficient network intrusion detection is achieved.
Patent Information
- Application Number
- CN202411969295.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-30
- Publication Date
- 2025-04-01
Smart Images
Figure CN119743324A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of network intrusion detection, and in particular relates to an intrusion detection method and system based on industrial control equipment communication. Background Art
[0002] With the rapid development of the global digital economy and the advent of the era of the Internet of Everything, the number of smart devices and network applications connected to the Internet has increased dramatically, and the resulting network security issues have become the focus of attention in all walks of life. Cybercrime is becoming increasingly rampant, and cyber attacks are becoming increasingly automated, intelligent, and organized, bringing unprecedented challenges to my country's network security protection work. In particular, with the vigorous development of new network application scenarios such as the Internet of Things, Industrial Internet, Blockchain, and 5G, cyber attacks are extending from traditional digital space to physical space, and industrial control systems represented by smart grids, smart transportation, water supply systems, and Internet of Vehicles have also become targets for infiltration and attacks by hacker organizations. The existing intrusion detection methods for industrial control equipment communications consider relatively single factors, and there are deficiencies in the training of detection models. Summary of the invention
[0003] In order to solve the above problems existing in the prior art, the present invention provides an intrusion detection method and system based on industrial control equipment communication.
[0004] The purpose of the present invention can be achieved through the following technical solutions: An intrusion detection method based on industrial control equipment communication, the implementation of the intrusion detection method comprises the following steps: Acquire a benign network flow during industrial control equipment communication and a benign network flow feature vector of the benign network flow, wherein the benign network flow feature vector is composed of a benign frequency domain feature vector, a benign statistical feature vector and original bytes of a benign data packet; Training an industrial control equipment communication intrusion detection model based on the benign network flow feature vector; When abnormal network traffic is detected in the industrial control equipment communication, an intrusion detection instruction is triggered and a current network flow and a current network flow feature vector of the current network flow are collected, wherein the current network flow feature vector is composed of a current frequency domain feature vector, a current statistical feature vector and original bytes of a current data packet; The terminal receives the intrusion detection instruction and outputs intrusion detection information based on the industrial control equipment communication intrusion detection model, wherein the intrusion detection information includes benign access information and malignant intrusion information.
[0005] Preferably, the step of obtaining the benign network flow during industrial control equipment communication and the benign network flow feature vector of the benign network flow includes: Obtaining the benign frequency domain feature vector by Fourier transform; Obtaining the benign statistical feature vector through a statistical function; The benign frequency domain feature vector, the benign statistical feature vector and the original bytes of the benign data packet are combined to obtain the benign network flow feature vector.
[0006] Preferably, the step of obtaining the benign frequency domain feature vector by Fourier transform includes: The benign network flow is divided into benign network flow segments by a sliding window. The mathematical description of the benign network flow segment is: , where S is a benign network flow segment, p i is the i-th traffic data packet, i=1,2,…,N, N is the number of traffic data packets, is the size attribute of the i-th traffic data packet, is the time interval attribute of the ith traffic data packet, is the protocol type of the i-th traffic data packet; The benign network flow segment is subjected to discrete Fourier transform to obtain a benign frequency component, and the mathematical description of the benign frequency component is: ,in, f m is the benign frequency component at the frequency 2π(m-1) / M, j is the imaginary part, and M is the sliding window step size; The benign frequency component is converted into a real number form to obtain a benign real part value and a benign imaginary part value of the benign frequency component. The expression of the benign real part value is: , where a m is a benign real value, and the expression of the benign imaginary value is , where b m is the benign imaginary part value; The initial real value of the benign frequency domain feature is calculated based on the benign real part value and the benign imaginary part value. The calculation formula is: , where h m is the initial real value of the benign frequency domain feature, and h m =h M-m ; Based on the initial real value of the benign frequency domain feature, an initial vector of the benign frequency domain feature is obtained. The expression of the initial vector of the benign frequency domain feature is H=[h 1 ,h 2 ,…,h (M / 2)+1 ]; The benign frequency domain feature vector is obtained by logarithmic transformation of the benign frequency domain feature initial vector, and the expression is: ,in, is the benign frequency domain feature vector, H is the benign frequency domain feature initial vector, and C is a constant.
[0007] Preferably, the obtaining the benign statistical feature vector by using a statistical function comprises: Based on the size attribute and the time interval attribute of the data traffic packet, the benign statistical features of the benign network flow fragment are extracted through the statistical function and the benign statistical feature vector is obtained. The statistical function includes a sum statistical function, a minimum statistical function, a maximum statistical function, and an average statistical function. The benign statistical feature vector is a collection of the benign statistical features.
[0008] Preferably, the training of the industrial control equipment communication intrusion detection model based on the benign network flow feature vector includes: The industrial control equipment communication intrusion detection model is constructed and trained by the OCSVM algorithm. The principle of the OCSVM algorithm is to map the benign network flow feature vector to a high-dimensional feature space, and construct a hyperplane between the benign network flow feature vector and the origin, maximize the distance from the hyperplane to the origin, so that all data points corresponding to the benign network flow feature vector are distributed on the same side of the hyperplane, which is defined as the benign access side, and the other side corresponding to the benign access side is defined as the malignant intrusion side.
[0009] Preferably, the OCSVM algorithm is equivalent to solving a quadratic programming problem, the mathematical description of which is: , where ω is the hyperplane parameter, ρ is the minimum distance from the origin to the hyperplane, Q is the number of good network flow feature vectors used to train the model, and v is the regularization parameter. is the slack variable of the qth benign network flow feature vector.
[0010] Preferably, the outputting of intrusion detection information based on the industrial control equipment communication intrusion detection model includes: The current network flow feature vector is input into the industrial control equipment communication intrusion detection model. When the data point corresponding to the current network flow feature vector falls on the benign access side, the benign access information is output; when the data point corresponding to the current network flow feature vector falls on the malignant intrusion side, the malignant intrusion information is output.
[0011] An intrusion detection system based on industrial control equipment communication, used to execute the above-mentioned intrusion detection method, including a model training module, an instruction triggering module, and an intrusion detection module; The model training module is used to obtain the benign network flow during the communication of the industrial control equipment and the benign network flow feature vector of the benign network flow, wherein the benign network flow feature vector is composed of a benign frequency domain feature vector, a benign statistical feature vector and the original bytes of the benign data packet; and train the industrial control equipment communication intrusion detection model based on the benign network flow feature vector; The instruction trigger module is used to trigger the intrusion detection instruction and collect the current network flow and the current network flow feature vector of the current network flow when abnormal network traffic is detected in the communication of the industrial control equipment. The current network flow feature vector is composed of the current frequency domain feature vector, the current statistical feature vector and the original bytes of the current data packet; The intrusion detection module is used for the terminal to receive the intrusion detection instruction and output intrusion detection information based on the industrial control equipment communication intrusion detection model, and the intrusion detection information includes benign access information and malignant intrusion information.
[0012] An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned intrusion detection method when executing the program.
[0013] A storage medium containing computer executable instructions, wherein the computer executable instructions are used to execute the above-mentioned intrusion detection method when executed by a computer processor.
[0014] The beneficial effects of the present invention are: (1) The industrial control equipment communication intrusion detection model is constructed and trained by using a benign network flow feature vector composed of benign frequency domain feature vectors, benign statistical feature vectors, and benign data packet raw bytes. Taking multiple factors into consideration at the same time, the construction and training of the model are more comprehensive and accurate, which is conducive to the accurate detection of network intrusion in the later stage. (2) When abnormal network traffic is detected in the communication of industrial control equipment, the intrusion detection instruction is triggered and the current network flow and the current network flow feature vector of the current network flow are collected, instead of directly collecting the current network flow feature vector and inputting it into the model under all conditions. In this way, the amount of data processing can be reduced and the network burden can be alleviated when abnormal network traffic is not detected; (3) The benign network flow is divided into benign network flow segments through a sliding window. The size attribute, time interval attribute and protocol type of the traffic data packet are considered in the process. The basic characteristic attributes of these traffic data packets are very easy to obtain in the network and the characteristic value loss is not likely to occur, which is conducive to improving the accuracy of the later model training. (4) By performing a logarithmic transformation on the initial vector of the benign frequency domain feature, a benign frequency domain feature vector is obtained so that the value range will not be too large, thus avoiding the situation where some network attacks will cause the basic characteristic values of the data packet to fluctuate greatly within a period of time, resulting in numerical instability. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.
[0016] Figure 1The present invention is a flowchart of the steps of an intrusion detection method based on industrial control equipment communication. DETAILED DESCRIPTION
[0017] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects of the present invention are described in detail below in conjunction with the accompanying drawings and preferred embodiments.
[0018] The working principle and use process of the present invention: See also Figure 1 , an intrusion detection method based on industrial control equipment communication, comprising: S1: obtaining a benign network flow during industrial control equipment communication and a benign network flow feature vector of the benign network flow, wherein the benign network flow feature vector is composed of a benign frequency domain feature vector, a benign statistical feature vector and original bytes of a benign data packet, and the benign network flow is a normal, legal data flow that is harmless to network operation; S2: training an industrial control equipment communication intrusion detection model based on the benign network flow feature vector; S3: When abnormal network traffic is detected in the communication of the industrial control equipment, an intrusion detection instruction is triggered and the current network flow and the current network flow feature vector of the current network flow are collected, wherein the current network flow feature vector is composed of the current frequency domain feature vector, the current statistical feature vector and the original bytes of the current data packet. The abnormal network traffic includes but is not limited to a large number of request connections, abnormally high bandwidth occupancy, and a large number of abnormal traffic packets; S4: The terminal receives the intrusion detection instruction and outputs intrusion detection information based on the industrial control equipment communication intrusion detection model, where the intrusion detection information includes benign access information and malignant intrusion information.
[0019] In this embodiment, obtaining the benign network flow during the communication of the industrial control device and the benign network flow feature vector of the benign network flow can be specifically implemented by the following steps: S101: Obtain the benign frequency domain feature vector by Fourier transform; S102: Obtaining the benign statistical feature vector through a statistical function; S103: The expression of the original bytes of the benign data packet is U=[U 1 ,U 2 ,…,U N ], where U is the original byte of the benign data packet, U i is the i-th traffic data packet stripped of the data link layer, i=1,2,…,N, N is the number of traffic data packets; S104: Collect the benign frequency domain feature vector, the benign statistical feature vector and the original bytes of the benign data packet to obtain the benign network flow feature vector.
[0020] In this embodiment, the benign frequency domain feature vector is obtained by Fourier transform, which can be implemented by the following steps: S101-1: Divide the benign network flow by a sliding window to obtain benign network flow segments, wherein the mathematical description of the benign network flow segments is: , where S is a benign network flow segment, p i is the i-th traffic data packet, i=1,2,…,N, N is the number of traffic data packets, is the size attribute of the i-th traffic data packet, is the time interval attribute of the ith traffic data packet, is the protocol type of the ith traffic data packet. The basic characteristic attributes of these traffic data packets are very easy to obtain in the network and are not prone to feature value loss, which is conducive to improving the accuracy of later model training; S101-2: Performing discrete Fourier transform on the benign network flow segment to obtain a benign frequency component, the mathematical description of the benign frequency component is: ,in, f m is the benign frequency component at the frequency 2π(m-1) / M, j is the imaginary part, and M is the sliding window step size; S101-3: Convert the benign frequency component into a real number form to obtain a benign real part value and a benign imaginary part value of the benign frequency component. The expression of the benign real part value is: , where a m is a benign real value, and the expression of the benign imaginary value is , where b m is the benign imaginary part value; S101-4: Calculate an initial real value of a benign frequency domain feature based on the benign real value and the benign imaginary value, and the calculation formula is: , where h m is the initial real value of the benign frequency domain feature, and h m =h M-m ; S101-5: Obtaining an initial vector of benign frequency domain features based on the initial real value of the benign frequency domain features, wherein the expression of the initial vector of benign frequency domain features is H=[h 1 ,h 2 ,…,h (M / 2)+1 ]; S101-6: Performing logarithmic transformation on the initial vector of the benign frequency domain feature to obtain the benign frequency domain feature vector so that the value range is not too large, so as to avoid the situation where some network attacks will cause the basic characteristic value of the data packet to fluctuate greatly within a period of time, resulting in the instability of the value. The expression of the benign frequency domain feature vector is: ,in, is the benign frequency domain feature vector, H is the benign frequency domain feature initial vector, and C is a constant.
[0021] In this embodiment, the industrial control equipment communication intrusion detection model is trained based on the benign network flow feature vector, which can be implemented by the following steps: Based on the size attribute and the time interval attribute of the data traffic packet, the benign statistical features of the benign network flow segment are extracted through the statistical function and the benign statistical feature vector is obtained. The statistical function includes but is not limited to a sum statistical function, a minimum statistical function, a maximum statistical function, and an average statistical function. The benign statistical feature vector is a collection of the benign statistical features.
[0022] In this embodiment, the industrial control equipment communication intrusion detection model is constructed and trained by the OCSVM algorithm. The principle of the OCSVM algorithm is to map the benign network flow feature vector to a high-dimensional feature space, and to construct a hyperplane between the benign network flow feature vector and the origin, and to maximize the distance from the hyperplane to the origin, so that all data points corresponding to the benign network flow feature vector are distributed on the same side of the hyperplane, which is defined as the benign access side, and the other side corresponding to the benign access side is defined as the malignant intrusion side. The OCSVM algorithm is equivalent to solving a quadratic programming problem, and the mathematical description of the quadratic programming problem is: , where ω is the hyperplane parameter, ρ is the minimum distance from the origin to the hyperplane, Q is the number of good network flow feature vectors used to train the model, and v is the regularization parameter. is the slack variable of the qth benign network flow feature vector.
[0023] In this embodiment, collecting the current network flow and the current network flow feature vector of the current network flow can be specifically implemented by the following steps: S301: Obtain the current frequency domain feature vector through Fourier transform; S302: Obtaining the current statistical feature vector through a statistical function; Based on the size attribute and the time interval attribute of the data flow packet of the current network flow, extract the current statistical feature of the current network flow segment through the statistical function and obtain the current statistical feature vector; S303: Obtaining the original bytes of the current data packet; S304: The current frequency domain feature vector, the current statistical feature vector and the original bytes of the current data packet are combined to obtain the current network flow feature vector.
[0024] In this embodiment, the current frequency domain feature vector is obtained by Fourier transform, which can be implemented by the following steps: S301-1: Divide the current network flow by sliding windows to obtain current network flow segments; S301-2: Performing discrete Fourier transform on the current network flow segment to obtain a current frequency component; S301-3: Convert the current frequency component into a real number form to obtain a current real part value and a current imaginary part value of the current frequency component; S301-4: Calculate the initial real value of the current frequency domain feature based on the current real part value and the current imaginary part value; S301-5: Obtaining a current frequency domain feature initial vector based on the current frequency domain feature initial real value; S301-6: Perform logarithmic transformation on the current frequency domain feature initial vector to obtain the current frequency domain feature vector.
[0025] In this embodiment, the terminal receives the intrusion detection instruction and outputs the intrusion detection information based on the industrial control equipment communication intrusion detection model, which can be specifically implemented by the following steps: The current network flow feature vector is input into the industrial control equipment communication intrusion detection model. When the data point corresponding to the current network flow feature vector falls on the benign access side, the benign access information is output; when the data point corresponding to the current network flow feature vector falls on the malignant intrusion side, the malignant intrusion information is output.
[0026] An intrusion detection system based on industrial control equipment communication includes a model training module, a command triggering module, and an intrusion detection module; The model training module is used to obtain the benign network flow during the communication of the industrial control equipment and the benign network flow feature vector of the benign network flow, wherein the benign network flow feature vector is composed of a benign frequency domain feature vector, a benign statistical feature vector and the original bytes of the benign data packet, and the benign network flow is a normal, legal and harmless data flow to the network operation; based on the benign network flow feature vector, the industrial control equipment communication intrusion detection model is trained; The instruction trigger module is used to trigger the intrusion detection instruction and collect the current network flow and the current network flow feature vector of the current network flow when abnormal network flow is detected in the communication of the industrial control equipment. The current network flow feature vector is composed of the current frequency domain feature vector, the current statistical feature vector and the original bytes of the current data packet. The abnormal network flow includes but is not limited to a large number of request connections, abnormally high bandwidth occupancy, and a large number of abnormal flow packets; The intrusion detection module is used for the terminal to receive the intrusion detection instruction and output intrusion detection information based on the industrial control equipment communication intrusion detection model, and the intrusion detection information includes benign access information and malignant intrusion information.
[0027] The computer storage medium of the embodiment of the present invention may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device.
[0028] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.
[0029] The program code included on the computer readable medium can be transmitted with any appropriate medium, including but not limited to wireless, electric wire, optical cable, RF, etc., or any suitable combination of the above. The computer program code for performing the operation of the present invention can be written in one or more programming languages or their combinations, and the programming language includes object-oriented programming languages-such as Java, Smalltalk, C++, and also includes conventional procedural programming languages-such as "C" language or similar programming languages. The program code can be executed completely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).
[0030] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technical personnel in this field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent change and modification made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention still fall within the scope of the technical solution of the present invention.
Claims
1. An intrusion detection method based on industrial control equipment communication, characterized in that: The implementation of the intrusion detection method comprises the following steps: Acquire a benign network flow during industrial control equipment communication and a benign network flow feature vector of the benign network flow, wherein the benign network flow feature vector is composed of a benign frequency domain feature vector, a benign statistical feature vector, and original bytes of a benign data packet; Training an industrial control equipment communication intrusion detection model based on the benign network flow feature vector; When abnormal network traffic is detected in industrial control equipment communication, an intrusion detection instruction is triggered and a current network flow and a current network flow feature vector of the current network flow are collected, wherein the current network flow feature vector is composed of a current frequency domain feature vector, a current statistical feature vector and original bytes of a current data packet; The terminal receives the intrusion detection instruction and outputs intrusion detection information based on the industrial control equipment communication intrusion detection model, wherein the intrusion detection information includes benign access information and malignant intrusion information.
2. The intrusion detection method according to claim 1, characterized in that: The method of obtaining the benign network flow during the communication of the industrial control device and the benign network flow feature vector of the benign network flow includes: Obtaining the benign frequency domain feature vector by Fourier transform; Obtaining the benign statistical feature vector through a statistical function; The benign frequency domain feature vector, the benign statistical feature vector and the original bytes of the benign data packet are combined to obtain the benign network flow feature vector.
3. The intrusion detection method according to claim 2, characterized in that: The method of obtaining the benign frequency domain feature vector by Fourier transform includes: The benign network flow is divided into benign network flow segments by a sliding window. The mathematical description of the benign network flow segment is: , where S is a benign network flow segment, p i is the i-th traffic data packet, i=1,2,…,N, N is the number of traffic data packets, is the size attribute of the i-th traffic data packet, is the time interval attribute of the ith traffic data packet, is the protocol type of the i-th traffic data packet; The benign network flow segment is subjected to discrete Fourier transform to obtain a benign frequency component, and the mathematical description of the benign frequency component is: ,in, f m is the benign frequency component at the frequency 2π(m-1) / M, j is the imaginary part, and M is the sliding window step size; The benign frequency component is converted into a real number form to obtain a benign real part value and a benign imaginary part value of the benign frequency component. The expression of the benign real part value is: , where a m is a benign real value, and the expression of the benign imaginary value is , where b m is the benign imaginary part value; The initial real value of the benign frequency domain feature is calculated based on the benign real part value and the benign imaginary part value. The calculation formula is: , where h m is the initial real value of the benign frequency domain feature, and h m =h M-m ; Based on the initial real value of the benign frequency domain feature, an initial vector of the benign frequency domain feature is obtained. The expression of the initial vector of the benign frequency domain feature is H=[h1,h2,…,h (M / 2)+1 ]; The benign frequency domain feature vector is obtained by logarithmic transformation of the benign frequency domain feature initial vector, and the expression is: ,in, is the benign frequency domain feature vector, H is the benign frequency domain feature initial vector, and C is a constant.
4. The intrusion detection method according to claim 2, characterized in that: The step of obtaining the benign statistical feature vector by using a statistical function includes: Based on the size attribute and the time interval attribute of the data traffic packet, the benign statistical features of the benign network flow fragment are extracted through the statistical function and the benign statistical feature vector is obtained. The statistical function includes a sum statistical function, a minimum statistical function, a maximum statistical function, and an average statistical function. The benign statistical feature vector is a collection of the benign statistical features.
5. The intrusion detection method according to claim 1, characterized in that: The training of the industrial control equipment communication intrusion detection model based on the benign network flow feature vector includes: The industrial control equipment communication intrusion detection model is constructed and trained by the OCSVM algorithm. The principle of the OCSVM algorithm is to map the benign network flow feature vector to a high-dimensional feature space, and construct a hyperplane between the benign network flow feature vector and the origin, maximize the distance from the hyperplane to the origin, so that all data points corresponding to the benign network flow feature vector are distributed on the same side of the hyperplane, which is defined as the benign access side, and the other side corresponding to the benign access side is defined as the malignant intrusion side.
6. The intrusion detection method according to claim 5, characterized in that: The OCSVM algorithm is equivalent to solving a quadratic programming problem, which is mathematically described as , where ω is the hyperplane parameter, ρ is the minimum distance from the origin to the hyperplane, Q is the number of good network flow feature vectors used to train the model, and v is the regularization parameter. is the slack variable of the qth benign network flow feature vector.
7. The intrusion detection method according to claim 1, characterized in that: The outputting of intrusion detection information based on the industrial control equipment communication intrusion detection model includes: The current network flow feature vector is input into the industrial control equipment communication intrusion detection model. When the data point corresponding to the current network flow feature vector falls on the benign access side, the benign access information is output; when the data point corresponding to the current network flow feature vector falls on the malignant intrusion side, the malignant intrusion information is output.
8. An intrusion detection system based on industrial control equipment communication, characterized in that: The system is applied to the intrusion detection method as described in any one of claims 1 to 7, including a model training module, an instruction triggering module, and an intrusion detection module; The model training module is used to obtain the benign network flow during the communication of the industrial control equipment and the benign network flow feature vector of the benign network flow, wherein the benign network flow feature vector is composed of a benign frequency domain feature vector, a benign statistical feature vector and the original bytes of the benign data packet; and train the industrial control equipment communication intrusion detection model based on the benign network flow feature vector; The instruction trigger module is used to trigger the intrusion detection instruction and collect the current network flow and the current network flow feature vector of the current network flow when abnormal network traffic is detected in the communication of the industrial control equipment. The current network flow feature vector is composed of the current frequency domain feature vector, the current statistical feature vector and the original bytes of the current data packet; The intrusion detection module is used for the terminal to receive the intrusion detection instruction and output intrusion detection information based on the industrial control equipment communication intrusion detection model, and the intrusion detection information includes benign access information and malignant intrusion information.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the intrusion detection method as described in any one of claims 1-7 is implemented.
10. A storage medium containing computer executable instructions, characterized in that: The computer executable instructions are used to perform the intrusion detection method as claimed in any one of claims 1 to 7 when executed by a computer processor.