Method and system for detecting S7 protocol abnormal communication behaviors based on PSO-SVM

Abstract

The invention discloses a method for detecting S7 protocol abnormal communication behaviors based on PSO-SVM. The method comprises the steps of obtaining connection from an industrial control network,the connection comprising a plurality of S7 protocol communication data packets; analyzing each S7 protocol communication data packet to obtain a function code or a sub-function code corresponding tothe S7 protocol communication data packet; and forming a function code sequence corresponding to each connection by a plurality of function codes and sub-function codes corresponding to all S7 protocol communication data packets included in each connection, and inputting the function code sequence corresponding to the connection into the trained S7 protocol anomaly detection model to obtain a detection result of the connection. According to the method, the technical problems that in an existing abnormal communication behavior recognition method, the S7 protocol abnormal communication behaviorin the industrial control network cannot be detected, and the recognition rate is low due to the fact that the relevance among the multiple data packets in the same connection is not considered can be solved.

Description

technical field [0001] The invention belongs to the field of industrial control network information security, and more specifically relates to a method and system for detecting abnormal communication behaviors of S7 protocol based on PSO-SVM. Background technique [0002] Industrial control networks usually use proprietary protocols for communication. These protocols often only consider functional requirements at the beginning of design, and security is guaranteed through physical isolation. However, with the rapid advancement of industrial informatization, the closed nature of industrial control networks has been broken. Inevitably, more and more industrial control networks are connected to public networks such as the Internet, which also makes industrial control networks The security problems of China have become more and more obvious. Since the 21st century, many nuclear power plants and power systems in many countries around the world have suffered from highly destructiv...

AI Technical Summary

Problems solved by technology

[0005] In view of the above defects or improvement needs of the prior art, the present invention provides a method and system for detecting abnormal communication behaviors of the S7 protocol based on PSO-SVM. The detection of abnormal communication behavior of the S7 protocol in the middle, and the technical problem of low recognition rate caused by not considering the correlation between multiple data packets in the same connection (Connection)

Images