工业以太网中多次变异信息入侵检测仿真  

Simulation of Network Distributed Intrusion Detection with High Density Characteristics

作　　者：肖堃[1] XIAO Kun(School of Computer Science and Engineering,University of Electronic Science and Technology of China, Claengdu Sichuan 611731,China)

机构地区：[1]电子科技大学计算机科学与工程学院,成都611731

出　　处：《计算机仿真》2018年第12期406-410,共5页Computer Simulation

摘　　要：为了切实有效地保证工业以太网信息系统安全,提高网络运行质量,需要进行变异信息入侵检测。但是采用入侵检测方法进行变异信息入侵检测时,无法确定发生变异的网络数据主分量,在实际应用中存在检测率低、误报率高等缺陷,难以满足工业以太网信息系统对网络安全的高端需求。提出基于主成分分析的工业以太网多次变异信息入侵检测方法。采用主成分分析方法对工业以太网数据集进行归一化处理,将处理后的数据集降维以确定发生变异的网络数据主分量,用发生变异的主分量信号均值和方差构建特征矩阵,以特征矩阵在近邻两个时段的近似度来描述连续变异信号的差分变化,将其作为特征信号实现多次变异信息的入侵检测。实验结果表明,所提方法在提高多次变异信息检测率的同时降低了误报率,具有鲁棒性。In order to effectively ensure the security of industrial Ethemet information system and improve the quality of network operation,this paper puts forward a method to detect multiple variation information intrusion in in- dustrial Ethernet based on principal component analysis.Firstly,the method of principal component analysis was used to normalize the data set of industrial Ethernet,and then dimension of data set after the treatment was reduced to determine the main component of network data with variation.Moreover,the mean and variance of principal component signal with variation was used to build feature matrix.Finally,the approximate degree of feature matrix in two adjacent periods was used to describe the differential variation of continuous variation signal.Thus,we achieved intrusion detection of multiple variation information.Simulation results prove that the proposed method reduces the false alarm rate while improving the detection rate of multiple variation information,which has strong bustness.

关 键 词：工业以太网 变异信息 入侵检测 主成分分析 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]