A Data Graph Detection Method for Malicious Data Attacks in Industrial Control Systems

Abstract

The present invention is a data graph detection method for malicious data attacks in industrial control systems. The method first needs to be trained in a certain normal industrial control system to generate the relationship graph of the data in the industrial system and the status graph G at running time. The method is to generate a runtime state graph G' for the detected industrial control system of the same type. If the nodes or directed edges of the state graph G' do not exist in the state graph G, it can be judged when there is a malicious data attack. Compared with the existing intrusion detection technology, this invention does not belong to feature and behavior detection, does not need to establish feature codes, and does not need to filter data packets. It can judge the moment when malicious data attacks occur only by relying on the data relationship in the monitoring room. It has the advantage of not affecting the real-time performance of the industrial control system.

Description

technical field [0001] The invention discloses a malicious data injection attack inspection method of an industrial control system, which belongs to the technical field of industrial control system security and intrusion detection. Background technique [0002] The tampering of the data collected in the industrial control system will lead to serious security incidents. The current intrusion detection methods mainly include feature detection and behavior detection, but they cannot detect such data attacks. The present invention differs from signature and behavior detection, but is able to detect when malicious data attacks an industrial control system. [0003] The information security problems faced by industrial control systems usually originate from malicious threats that attempt to destroy the operation of the control system. Therefore, industrial control systems, especially power SCADA systems, need to detect and prevent false data injection attacks in real time, so as ...

AI Technical Summary

Problems solved by technology

[0005] Existing typical intrusion detection systems, such as detection schemes based on state estimators, can detect abnormal phenomena reflected by input quantities that are vulnerable to network attacks. The core idea is to use principal component analysis to separate power flow changes into conventional and unconventional Subspace, by analyzing the unconventional subspace to determine whether the data of the power SCADA system is under attack, but the model is relatively complex; the model based on the Bloom filter is suitable for the field equipment of the SCADA system with resource constraints in the smart grid, and adopts The data structure can effectively save memory, and the misjudgment rate depends on the selected hash function and other Bloom filter parameters, but it is powerless when attacking a certain type of special control component by malware, and cannot meet the detection requirements such as "Stuxnet" virus injection attack

Images