Industrial control situation awareness system and method based on machine learning

Abstract

The invention provides an industrial control situation awareness method and system based on machine learning. The awareness method comprises the steps: collecting the alarm data sets of different network security devices; normalizing the collected alarm data set, and constructing an original alarm database by adopting a regular expression and attribute information extracted from an alarm log in acharacter string matching manner; adopting a classical association rule mining algorithm Apriori to realize alarm aggregation, dividing the global attack sequence into a plurality of candidate sequence sets according to the size of a window, and finally mining a maximum attack mode through an improved Prefix Span algorithm. Compared with a Prefix Span algorithm, the method has the advantages thatthe accuracy and effectiveness are greatly improved, and the overhead is reduced.

Description

technical field [0001] The invention relates to the field of industrial control security, specifically to solve the problem that complex attacks contained in multi-source alarms are difficult to detect, and proposes an industrial control situation awareness system and method based on machine learning. Background technique [0002] With the popularization and rapid development of the Internet, while the computer network is benefiting human production and life, it has also caused network security problems to escalate and deteriorate. The security of network information systems is facing severe challenges. Using a single security device to protect the network has been far away. Security requirements cannot be met. In order to deal with potential security threats and covert attacks in the enterprise intranet and the Internet, more and more security devices such as firewalls, intrusion detection systems (IntrusionDetection Systems, IDS), intrusion trapping systems (referred to as...

AI Technical Summary

Problems solved by technology

[0004] The technical problem to be solved by the present invention is to provide an industrial control situational awareness system and method based on machine learning, which can solve the problem that complex attacks contained in multi-source alarms are difficult to detect

Images