Data diagram detection method for industrial control system malicious data attack

Abstract

The present invention is a data diagram detection method for industrial control system malicious data attack. The method comprises the steps: first training in a certain normal industrial control system to generate a relation diagram of data in the industrial system and an operating time state transition diagram G, then utilizing the same method to generate an operating time state transition diagram G' for a detected same type industrial control system, and if the nodes or the directed edges of the state transition diagram G' do not exist in the state transition diagram G, judging that the time of malicious data attack exists. Compared with the existing intrusion detection technology, the data diagram detection method provided by the invention does not belong to characteristic and behavior detection, does not require characteristic code establishment and data packet filtration, can rely merely on the data relation in a monitor room to judge whether the time of the malicious data attack exists, and has the advantage that the real-time performance of the industrial control system is not influenced.

Description

technical field [0001] The invention discloses a malicious data injection attack inspection method of an industrial control system, which belongs to the technical field of industrial control system security and intrusion detection. Background technique [0002] The tampering of the data collected in the industrial control system will lead to serious security incidents. The current intrusion detection methods mainly include feature detection and behavior detection, but they cannot detect such data attacks. The present invention differs from signature and behavior detection, but is able to detect when malicious data attacks an industrial control system. [0003] The information security problems faced by industrial control systems usually originate from malicious threats that attempt to destroy the operation of the control system. Therefore, industrial control systems, especially power SCADA systems, need to detect and prevent false data injection attacks in real time, so as ...

AI Technical Summary

Problems solved by technology

[0005] Existing typical intrusion detection systems, such as detection schemes based on state estimators, can detect abnormal phenomena reflected by input quantities that are vulnerable to network attacks. The core idea is to use principal component analysis to separate power flow changes into conventional and unconventional Subspace, by analyzing the unconventional subspace to determine whether the data of the power SCADA system is under attack, but the model is relatively complex; the model based on the Bloom filter is suitable for the field equipment of the SCADA system with resource constraints in the smart grid, and adopts The data structure can effectively save memory, and the misjudgment rate depends on the selected hash function and other Bloom filter parameters, but it is powerless when attacking a certain type of special control component by malware, and cannot meet the detection requirements such as "Stuxnet" virus injection attack

Images