过程控制系统错误数据注入攻击检测系统研究

发布时间：2018-03-27 11:11

本文选题：PCSs　切入点：错误数据注入攻击　出处：《北方工业大学》2017年硕士论文

【摘要】：过程控制系统(PCSs,Process Control Systems)是现代工业自动化的一个重要领域,互联网等现代网络技术的引入,使得原本物理隔绝的PCSs失去了免遭网络攻击的"天然屏障",同时又缺乏对数据信息完整性,机密性的保护,导致PCSs的信息安全事件频繁发生。错误数据注入(FDI,False Data Injection)攻击是近几年针对过程控制系统的新型攻击,也是目前黑客攻击的主流手段之一。从某种程度来说,其威胁级别高于其他各类攻击手段,且一般的防御措施不能对这类错误数据注入攻击进行有效的防御。因此,对于过程控制系统FDI攻击的检测系统研究具有十分重要的意义。本文设计了基于多元统计法的入侵检测系统(IDS,Intrusion Detection System)用来检测针对过程控制系统的FDI攻击。首先,本文分析了过程控制系统信息安全的研究现状,并建立了以田纳西伊斯曼(Tennessee-Eastman,TE)过程为作用对象的FDI攻击模型。其次,将FDI攻击模型应用到TE过程控制系统,验证攻击模型的有效性,设计了一种基于主元分析(PCA,Principle Component Analysis)法的入侵检测系统对系统数据进行监测,再利用贡献率图的方法确定攻击源的位置。PCA是目前广泛应用于过程监控的数据驱动方法,其优势是该方法不依赖于系统模型。为了提高数据检测的准确性及系统的响应速度,提出了核主元分析(KPCA)法的入侵检测系统。最后,由于小波分析法能够很好的描述信号的非平稳性,能够从信号中提取有效信息,为了降低IDS的漏报率与误报率,采用小波分析法对系统信号进行去除噪声处理,再结合基于KPCA法的入侵检测系统对系统进行实时监测,保障系统安全运行。
[Abstract]:Process control system (PCS) is an important field of modern industrial automation, such as the introduction of modern network technology, such as the Internet. PCSs, which is physically isolated, has lost its "natural barrier" against cyber attacks and lacks protection against the integrity and confidentiality of data and information. Error data injection / false Data injection attack is a new type of attack against process control system in recent years, and it is also one of the main methods of hacker attack at present. Its threat level is higher than other kinds of attack means, and general defense measures can not effectively defend against this kind of false data injection attack. It is very important to study the detection system of FDI attack in process control system. In this paper, an intrusion Detection system based on multivariate statistics is designed to detect the FDI attack against process control system. In this paper, the research status of information security in process control system is analyzed, and a FDI attack model based on Tennessee Tennessee-Eastman te process is established. Secondly, the FDI attack model is applied to te process control system. To verify the effectiveness of the attack model, an intrusion detection system based on principal component analysis (PCA) principle Component analysis is designed to monitor the system data. Then using the contribution graph to determine the location of the attack source. PCA is a data-driven method which is widely used in process monitoring at present. Its advantage is that the method does not depend on the system model, in order to improve the accuracy of data detection and the response speed of the system. An intrusion detection system based on kernel principal component analysis (KPCA) method is proposed. Finally, because wavelet analysis can describe the nonstationarity of the signal well, it can extract effective information from the signal, in order to reduce the false alarm rate and false alarm rate of IDS. The wavelet analysis method is used to remove the noise of the system signal and the intrusion detection system based on KPCA method is used to monitor the system in real time to ensure the safe operation of the system.
【学位授予单位】：北方工业大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08;TP273

【参考文献】