Industrial control flow anomaly detection method and system based on convolution time sequence network

Abstract

The invention discloses an industrial control flow anomaly detection method and system based on a convolution time sequence network, and the method comprises the steps: taking industrial control protocol flow as an input, splitting the industrial control protocol flow according to a read-write function, combining, normalizing and grouping split data packets according to a unit time window, and enabling the data packets to be used for a prediction model for learning; forming a data set by taking the flow data as input, and obtaining a flow data prediction model capable of predicting next window data by utilizing the current window data by utilizing a neural network model with a ConvLSTM layer and an encoding and decoding architecture; predicting the flow data packet to be detected by using the obtained prediction model to obtain a distance difference between prediction data and real data; calculating a normalized score of the intra-group difference information to obtain distribution of the window and the score; fusing score distribution of the read-write model by using a weighting mode, and detecting abnormal data traffic by using distribution information. According to the method, a deep learning model for prediction of a decoding and coding structure is adopted, a ConvLSTM module is introduced, and time and space features of industrial control flow are effectively learned.

Description

technical field [0001] The invention belongs to the technical field of network information security, and relates to the technical field of attack detection, in particular to abnormal detection under industrial control systems. Background technique [0002] With the popularization of the industrial Internet, the degree of industrial informatization has been continuously strengthened. More and more node devices in the network are connected to the Internet communication, and the communication data (traffic) with different protocols is used to realize the interaction between multiple devices. With the continuous deepening of this interaction, risks also follow. The more nodes are opened, the lower industrial control system is more and more vulnerable to attacks by attackers; attackers often use pre-order attacks to achieve control of PLC control equipment. As a result, the stop of factory operations or even the damage of equipment will have a huge impact on the enterprise. Ho...

AI Technical Summary

Problems solved by technology

[0005] The technical problem to be solved by the present invention is to provide a method and system for abnormal detection of industrial control traffic based on a convolutional time series network, which is used to solve the data information lost by using machine learning or deep learning to extract feature learning methods under industrial control systems, and cannot fully Consider the problem of data relationship before and after

Images