Machine learning-based attack detection method for non-analyzable network data feature selection

Abstract

The invention discloses a machine learning-based attack detection method for non-analyzable network data feature selection. The method is composed of three parts of data acquisition preprocessing, feature extraction and construction and attack detection model establishment and detection based on machine learning. The data preprocessing part is used for carrying out numeralization on network data;the feature extraction and construction part completes construction of data features based on data packet period and length information on the basis of deep analysis of industrial control network attacks. The modeling part is used for establishing an industrial control network attack detection model based on a machine learning classification method. According to the invention, attack forms such asre-amplification flow attack and man-in-the-middle attack in the industrial control system network can be accurately detected in real time, and safety accidents and economic losses caused by the safety accidents are reduced.

Description

technical field [0001] The invention relates to an attack detection method of an industrial control network, specifically, a method for detecting specific attacks of an industrial control network by using machine learning and based on characteristic engineering of data packets of the industrial control network, and belongs to the technical field of industrial control network security. Background technique [0002] The Industrial Internet is an industry and application ecology formed by the all-round and deep integration of the Internet and the new generation of information technology with the global industrial system. It is the key comprehensive information infrastructure for the development of industrial intelligence. Large-scale industrial control networks bring intelligent and convenient remote control of equipment, but also make them more vulnerable to cyber attacks. High-tech cyber attack methods are constantly emerging, and viruses are becoming more and more complex. O...

AI Technical Summary

Problems solved by technology

The existing industrial control network attack detection methods are mainly aimed at general analyzable network data, and the attack detection research on encrypted and unanalyzed network data is still lacking. The robustness is poor, and the integrated learning method with high generalization ability can be applied to network attack detection

Images