摘要
针对工业控制网络中常用的Modbus协议,提出了一种工业控制网络的异常检测方法。使用n-gram(n=0.5,1,1.5,2,2.5)算法从Modbus正常报文帧的有效载荷中进行特征提取,确定出5组特征向量,并结合单类支持向量机(OCSVM)算法训练出5个初级学习器,对5个同质的初级学习器采用“学习法”进行集成,最终得出次级学习器,利用上述两层模型,即可完成异常识别。在气体管道网络原始数据集中进行试验,最终误报率为8%,漏报率为6%。
For the Modbus protocol widely used in industrial control networks,an anomaly detection method for industrial control networks is proposed.It uses the n - gram ( n =0.5,1,1.5,2,2.5) algorithm to extract features from the payload of the Modbus normal frames,and obtains five sets of feature vectors. Then five primary learners are trained with a One-Class Support Vector Machine(OCSVM),and five homogeneous primary learner models are combined with “learning method”. Finally,the secondary learner is obtained.Using the above two-layer model,the abnormal recognition can be completed.In intrusion detection experiment of gas pipeline,the final false positive rate was 8%,and the false negative rate was 6%.
作者
邵俊杰
董伟
冯志
Shao Junjie;Dong Wei;Feng Zhi(The 6th Research Institute of China ElectronicsCorporation,Beijing100083,China)
出处
《信息技术与网络安全》
2019年第6期17-20,25,共5页
Information Technology and Network Security
基金
国家重点研发计划网络空间安全专项经费资助(工控系统安全主动防护关键技术和产品研发)(2018YFB0803502)
关键词
N-GRAM
单类支持向量机
集成学习
工业控制网络
异常检测
n -gram
One-Class Support Vector Machine(OCSVM)
ensemblelearning
industrial control network
abnormal data detection
