工业控制系统入侵检测技术研究

发布时间：2018-03-17 04:08

本文选题：工业控制系统　切入点：入侵检测　出处：《电子科技大学》2017年硕士论文　论文类型：学位论文

【摘要】：近年来,随着物联网和工业4.0的快速推进,大量工业控制通信网络与外界网络连接起来,使得工业控制系统通信网络的缺陷暴露在外,容易遭受各种攻击。鉴于此,为了实现对工业控制系统通信网络的防护,构建了入侵检测系统。本文主要工作为:1、构建入侵检测系统总体框架,包括白名单自学习与检测模块、深度包解析模块、基于流量特征的入侵检测模块和基于神经网络的多协议入侵检测模块。2、设计并实现白名单自学习与检测模块和基于流量特征的入侵检测模块。将自动白名单应用到工业控制系统中,实现了白名单的自动建立和对通信数据包的异常检测;将数据包数量和时间的对应关系作为检测特征,提高了检测的准确率,实现基于流量特征的入侵检测模块的设计。3、设计并实现基于神经网络的多协议入侵检测模块,主要包括基于Modbus/TCP、OPC、DNP3协议的入侵检测模块,并利用神经网络完成对模型的训练和异常检测。最后,在搭建的实验平台进行测试,测试结果验证了以双向功能码为检测特征的入侵检测模块实现了对合法功能码集的非法功能码的异常检测,入侵检测系统提高了工业控制系统通信网络的安全性。
[Abstract]:In recent years, with the rapid development of the Internet of things and industry 4.0, a large number of industrial control communication networks are connected to external networks, which expose the defects of the communication networks of industrial control systems and are vulnerable to various attacks. In order to protect the communication network of the industrial control system, an intrusion detection system (IDS) is constructed. The main work of this paper is to construct the general framework of the intrusion detection system (IDS), including the whitelist self-learning and detection module, the depth packet analysis module. An intrusion detection module based on traffic features and a multiprotocol intrusion detection module based on neural network are designed and implemented. The whitelist self-learning and detection module and the intrusion detection module based on traffic characteristics are designed and implemented. The automatic whitelist is applied to the system. Into the industrial control system, The white list is established automatically and the abnormal detection of the communication data packet is realized. The corresponding relation between the number of packets and the time is taken as the detection feature, and the accuracy of detection is improved. The design of intrusion detection module based on traffic characteristics. 3. The design and implementation of multi-protocol intrusion detection module based on neural network, mainly including the intrusion detection module based on Modbus / TCPPC OPC DNP3 protocol. The neural network is used to complete the training and anomaly detection of the model. Finally, the test is carried out on the experimental platform. The test results show that the intrusion detection module with bidirectional function code as the detection feature realizes the abnormal detection of the illegal function code of the legal functional code set, and the intrusion detection system improves the security of the communication network of the industrial control system.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP273;TP393.08

【参考文献】