Industrial control system flow anomaly detection method and system based on OCSVM and K-means algorithm

Abstract

The invention discloses an industrial control system traffic anomaly detection method based on an OCSVM and a K-means algorithm, and the method comprises the steps: obtaining a normal traffic data set from an industrial control system through a traffic obtaining tool, carrying out the protocol analysis of the traffic data for each piece of traffic data in the traffic data set, so as to obtain the attribute of the traffic data and the attribute value, wherein all attribute values corresponding to the traffic data form attribute value vectors, the attribute value vectors corresponding to all the traffic data form a to-be-detected data matrix with the size of m * n, and dimension reduction processing is performed on the to-be-detected data matrix by using a principal component analysis (PCA) method to obtain a matrix after dimension reduction processing; and inputting each row in the matrix after dimension reduction processing into the trained single-class support vector machine OCSVM detection model to obtain a label value corresponding to the row, wherein the label values corresponding to all rows in the matrix form a label value column vector. According to the invention, the technical problem that the abnormal traffic is less or difficult to obtain in the existing traffic anomaly detection method of the industrial control system can be solved.

Description

technical field [0001] The invention belongs to the technical field of intrusion detection of industrial control systems, and more particularly relates to a method and system for detecting traffic anomalies in industrial control systems based on OCSVM and K-means algorithms. Background technique [0002] Industrial control system is a general term for systems such as monitoring and data acquisition systems, distributed control systems, and energy management systems. Industrial control systems are widely used in important national basic industries such as electric power, oil, natural gas, and water conservancy. Once attacked, it will cause inestimable losses and hidden dangers to the entire country and society. In recent years, attacks on industrial control systems have emerged in an endless stream: in 2010, the first worm virus targeting industrial control systems attacked a nuclear facility in Natanz, Iran; in 2015, a virus named "BlackEnergy" attacked Ukrainian power grid...

AI Technical Summary

Problems solved by technology

Its purpose is to solve the technical problems of the existing industrial control system traffic anomaly detection method that the abnormal traffic is small or difficult to obtain, as well as the technical problem that only known attack types can be detected, and the detection ability of unknown attack types is low, and its existence Technical Issues with Higher False Positive Rates

Images