基于仿真建模的工业控制网络异常检测方法研究

发布时间：2018-04-01 09:20

本文选题：仿真　切入点：编译原理　出处：《北京工业大学》2016年硕士论文

【摘要】：随着工业控制网络朝着生产高度数字化、网络化、机器自组织的方向发展。在生产效率提高的同时,越来越多的安全风险和安全漏洞被暴露出来。尤其在工业控制网络层,作为工业控制系统重要的控制执行环节,缺乏有效地入侵检测方法。目前基于工业控制网络的入侵检测方法通过对网络流量建模、数据包特征分析和设备特征分析的方法进行检测。存在协议通用性差、误报率高,无法对未知异常进行检测等问题。有鉴于此,本文从正常行为建模的角度出发设计并提出了一种基于仿真建模的工业控制系统异常检测方法。工业控制系统建模依照工业控制系统上设备的类型进行划分,分为控制器建模以及被控对象建模。控制器建模是为了防止控制程序(包括控制程序在内存中存储的数据)被篡改或者破坏的行为,被控对象建模是为了保证控制器获得的系统输入是可信的。并分别根据两种建模方法的特点提出了相应的异常检测方法。本文主要研究内容如下:首先,论文对相关研究领域进行综述的基础上,本文在详细分析了工业控制系统脆弱性问题。并针对存在的控制器控制逻辑易被篡改、无法保证数据可信性等问题展开研究。根据控制器的工作原理特点提出了仿真建模的研究思路,同时将控制系统中经典的系统辨识分析方法引入到被控对象建模之中。其次,论文在分析PLC的工作原理基础上,提出了仿照PLC工作原理设计的控制器仿真模型,并对仿真模型的系统架构、部署方式进行了讨论。之后,详细的介绍了控制器仿真建模的流程,包括词法分析、语法分析、中间代码生成等。最后,结合控制器建立的模型,提出了相应的异常检测系统,并介绍了异常检测的原理和方法。再次,论文为了解决被控对象建模的问题引入了系统辨识建模的方法。通过数据预处理的方法去除了建模输入数据中的直流分量和高频噪声。通常认为系统辨识的模型输入应该是去除直流分量后的平稳数据,因此在建模过程中首先需要利用直流分量模型,剔除输入数据中的直流分量。之后介绍了系统辨识方法的参数定阶准则、参数辨识过程、模型的选择方法以及模型的验证方法。最后根据系统辨识的残差序列统计特性提出了基于db6小波分解的异常检测方法。并以举例的方法模拟了一次完整的建模过程。最后,本文在已经提出的控制器建模方法和被控对象建模方法的基础上将两者整合成为了工业控制系统建模方法,并仿照工业控制系统中水槽液位控制系统的原理搭建了模拟实验环境。通过分析现有针对工业控制系统的攻击方法和原理,对工业控制系统面临的攻击威胁进行了分类总结。根据分类结果本文模拟实现了三种攻击,并利用本文提出的异常检测方法进行检测。结果表明本文提出的异常检测方法能够发现现有的所有攻击行为,并能够对相同原理的未知攻击行为进行有效的检测。
[Abstract]:With the development of industrial control network in the direction of highly digital production, networking and self-organization of machines, more and more security risks and vulnerabilities have been exposed, especially in the industrial control network layer. As an important part of industrial control system, there is a lack of effective intrusion detection method. The methods of data packet feature analysis and device feature analysis have some problems, such as poor generality of protocol, high false alarm rate, unable to detect unknown anomalies, and so on. In this paper, a method of abnormal detection of industrial control system based on simulation modeling is designed and proposed from the point of view of normal behavior modeling. The modeling of industrial control system is divided according to the type of equipment on the industrial control system. It is divided into controller modeling and controlled object modeling. Controller modeling is designed to prevent the control program (including data stored in memory by the control program) from being tampered with or destroyed. The modeling of the controlled object is to ensure that the system input obtained by the controller is credible. According to the characteristics of the two modeling methods, the corresponding anomaly detection methods are proposed. The main contents of this paper are as follows: first, Based on the review of related research fields, this paper analyzes the vulnerability of industrial control system in detail, and aims at the existence of controller control logic is easily tampered with. Based on the working principle of the controller, this paper puts forward the research idea of simulation modeling, and introduces the classical system identification and analysis method into the modeling of the controlled object. On the basis of analyzing the working principle of PLC, this paper puts forward a controller simulation model, which is designed according to the working principle of PLC, and discusses the system architecture and deployment mode of the simulation model. The flow of simulation modeling of controller is introduced in detail, including lexical analysis, syntax analysis, intermediate code generation and so on. Finally, combined with the model established by the controller, the corresponding anomaly detection system is put forward. And introduced the principle and method of anomaly detection. In order to solve the problem of modeling of controlled object, this paper introduces the method of system identification and modeling. The DC component and high frequency noise in the input data of modeling are removed by the method of data preprocessing. The model of system identification is generally considered as the model of system identification. The input should be the stationary data after the DC component is removed, So in the process of modeling, the DC component model is first used to eliminate the DC component from the input data, and then the parameter order criterion and parameter identification process of the system identification method are introduced. Finally, an anomaly detection method based on db6 wavelet decomposition is proposed according to the statistical characteristics of the residual sequence of system identification. An example method is used to simulate a complete modeling process. On the basis of the controller modeling method and the controlled object modeling method, this paper integrates the two methods into the industrial control system modeling method. Based on the principle of the flume level control system in the industrial control system, a simulated experimental environment is set up, and the existing attack methods and principles for the industrial control system are analyzed. The attack threats faced by industrial control systems are classified and summarized. According to the classification results, three kinds of attacks are simulated and implemented. The results show that the proposed anomaly detection method can detect all the existing attacks and detect the unknown attacks with the same principle.
【学位授予单位】：北京工业大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP273

【相似文献】