The application discloses a data-driven
replay attack detection method based on an equivalent space
industrial control system, which comprises the following steps: acquiring input and output data of multiple time points from an
industrial control system; constructing a historical
data matrix and calculating a
zero matrix, solving an
optimal weight matrix, calculating an equivalent matrix, generating a
system residual, designing a chi-square test and a
generalized likelihood ratio test, and designing corresponding thresholds; introducing part of model information to enhance the detection capability of the original
system; deploying the obtained detection
system, acquiring the input and output of the system online, generating a residual, and using the chi-square test and the
generalized likelihood ratio test to judge the system operation; when the test value is greater than the residual threshold, it is judged that the system is subjected to a
replay attack, and an alarm is issued. The application can detect the
replay attack based on the historical data of the equipment operation of the industrial
control network through the input and output of the system without depending on the
model parameters of the system, meanwhile, the application is easy to deploy and does not sacrifice the control performance of the system.