Malicious behavior identification method for industrial control honey pot

Abstract

The invention belongs to the technical field of network security, and discloses a malicious behavior identification method for an industrial control honey pot. The method comprises the following steps: capturing the flow of an attacker by using a built high-interaction industrial control honeypot, then carrying out segmentation operation on the network flow to generate a network session flow, inputting the generated network session flow into a one-dimensional convolutional neural network and a GRU network, introducing an attention mechanism to distribute different weights for each byte, and finally, separating the malicious behavior of an unknown type by calculating the Euclidean distance between the probability output by the neural network and the coordinates of each type. The method improves the classification accuracy, achieves the precise recognition of malicious behaviors captured by the industrial control honeypot and the separation of unknown behaviors, and enables a safety manager to more visually understand the attack means and real intention of an attacker.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a malicious behavior identification method for industrial control honeypots. Background technique [0002] With the gradual integration of informatization and industrialization, the degree of informatization of industrial control systems is getting higher and higher. The widespread use of general-purpose hardware and software and network facilities has broken the "isolation" of traditional industrial control systems and information networks, and is continuously promoting industrial control systems. While controlling the development and expansion of the network, it also brings great security threats. [0003] Because the industrial control site has extremely high requirements on the real-time, reliability and continuity of the network, some traditional passive network security products, such as industrial firewalls and intrusion detection systems, cannot be wi...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the problem that existing industrial control honeypots cannot effectively identify malicious behaviors of industrial protocols, the present invention proposes a malicious behavior identification method for industrial control honeypots

Images