如何有效检测工业病毒对应用层协议的攻击是工业控制系统入侵检测的难点问题。将Modbus TCP协议作为研究对象,结合OCSVM(one class support vector machine,OCSVM)算法,提出一种基于PCA-OCSVM异常检测方法,采用微粒子群优化(particle swarm optimization,PSO)算法对入侵检测模型进行优化。仿真对比分析结果表明,该方法可以高效准确识别攻击或异常行为,实现对工业控制系统的安全防护。
To detect industry virus attacks to application layer protocol data is a difficult issue in intrusion detection for industrial control systems.PCA-OCSVM intrusion detection method was put forward in which Modbus TCP protocol was taken as research objective and one class support vector(OCSVM)algorithm was combined.Swarm optimization particle(PSO)algorithm was used to optimize the intrusion detection model.Results of simulation show that the proposed method can efficiently and accurately identify the attacks and abnormal behaviors,realizing the security performances of the industrial control system.