Anomaly Classification Method of Communication Network Based on Statistical Learning and Deep Learning

Abstract

The invention discloses a method for classifying anomalies in industrial control system (ICS) communication networks based on statistical learning and deep learning. This method is based on the traffic of the industrial control system communication network with a large amount of data during normal operation, and the LSTM deep learning structural parameters are designed and modeled and analyzed. By analyzing and combining the threshold value of real-time communication traffic data generated based on the SARIMA online statistical learning model in the early stage, an association algorithm is designed to analyze the numerical relationship between background traffic and real-time traffic. According to the ICS network abnormal event classification algorithm, the ICS communication network anomalies are specifically classified. In the present invention, an experimental analysis is carried out on a shooting range test platform combining virtual reality with industrial control safety in Zhejiang Province. At the same time, a physical simulation platform is built in a laboratory environment for verification experiments, and detailed examples are given to verify the reliability and accuracy of the algorithm.

Description

technical field [0001] The invention relates to anomaly detection of an industrial control system network, in particular to a communication traffic anomaly classification method based on statistical learning and deep learning, belonging to the field of industrial information security detection. Background technique [0002] Key infrastructure such as energy, refining and transportation is the nerve center for the stable operation of the country, and it is the top priority of my country's network security. With the advancement of automation, interconnection, and intelligent construction of large-scale national infrastructure (smart substations, intelligent chemical process industrial systems, and industrial distributed control systems), the issue of cyberspace security has become increasingly prominent. In recent years, a series of cyber-attacks against the country's critical infrastructure have caused enormous national economic losses and irreversible damage to society. The...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to solve the problem of dynamic modeling and abnormal classification detection of ICS communication traffic collected in real time without prior knowledge, because the existing ICS abnormal event classification detection algorithm is too dependent on prior knowledge, and the classification accuracy is not high. A comprehensive analysis method was proposed due to the high complexity of the algorithm and the impossibility of actual deployment; the designed ICS network anomaly event classification algorithm model based on statistical learning and deep learning has guidance for the network security protection and anomaly detection of major national industrial infrastructures significance

Images