基于网络流量分析的工控行为建模与自主的异常检测方法研究

Effectively detecting and analyzing unknown malicious behaviors of Industrial Control Systems (ICSs) is an important method for ensuring the security of national infrastructure. However, current methods for anomaly detection and for modeling behaviors of ICSs are confronted with two challenges. First, it is difficult to profile and identify malicious behaviors of ICSs, as attacks on ICSs have become increasingly sophisticated and concealed. Second, it is challenging to model and analyze the ever-evolving behaviors of ICSs. To address these two challenges, in this proposal, we depict the normal behaviors of ICSs and reveal their inherent laws by mining fine-grained and multi-dimensional patent and latent features from network traffic generated from ICSs. We also propose a novel autonomic method for building behaviors of ICSs and for anomaly detection. In this method, the ensemble learning scheme with several anomaly detection algorithms is able to label the network data in an efficient and reliable manner. The novel dynamical clustering methods and several change detection algorithms on network traffic generated from ICSs are able to update the detection model autonomously, to rebuild the model autonomously, and to tune its parameters based on the detection performance and the change of environments. The proposed methods and models will be evaluated and tested on both simulated and practical platform of ICSs.

有效检测和分析工控系统未知恶意行为是保障国家基础设施安全的一个重要手段。但现有的工控行为建模与异常检测方法普遍存在如下两个问题。首先，针对工控系统的攻击方式日益复杂化和隐蔽化，使得工控正常与恶意行为难以精确描述和识别；其次，工控行为不断变化难以分析与建模。针对以上两个问题，本项目拟研究基于网络流量分析的工控行为刻画和内在规律挖掘，提出了多维、细粒度的网络流量显性和隐性特征挖掘方法；在此基础上提出了自主的工控行为建模与异常检测方法。该方法中异常检测算法的集成学习机制可实现实时可靠的数据标定，工控网络数据流的动态聚类与状态检测算法可实现模型自主更新和自主重建，并可根据检测性能和环境的变化动态调整检测模型的参数。本项目拟分别在模拟和真实的工控环境下建模、测试并评价所提出的方法。

有效检测和分析工控系统未知恶意行为是保障国家基础设施安全的一个重要手段。但现有的工控行为建模与异常检测方法普遍存在如下两个问题。首先，针对工控系统的攻击方式日益复杂化和隐蔽化，使得工控正常与恶意行为难以精确描述和识别; 其次，工控行为不断变化难以分析与建模。针对以上两个问题，本项目研究基于网络流量分析的工控行为刻画和内在规律挖掘，提出了多维、细粒度的网络流量显性和隐性特征挖掘方法; 在此基础上提出了基于Transformer的encoder结构，提取流量间复杂序列性特征以提升检测率。项目在智能发电分布式控制系统和智能变电系统平台上收集并形成了用于异常行为检测的大型数据集。基于CNN-sVGG的检测率达到98.9%，明显优于其它传统检测方法。基于项目提出的方法，还开发了一个实际的原型系统，用于检测基于网络流量行为分析的工控异常行为。