基于仿真建模的工业控制网络入侵检测方法研究  

Research on industrial control system intrusion detection method based on simulation modelling

作　　者：高一为[1] 周睿康 赖英旭[1] 范科峰[2] 姚相振[2] 李琳[2] GAO Yi-wei;ZHOU Rui-kang;LAI Ying-xu;FAN Ke-feng;YAO Xiang-zhen;LI Lin(College of Computer, Faculty of Information Technology, Beijing University of Technology, Beijing 100124, China;China Electronics Standardization Institute, Beijing 100007, China)

机构地区：[1]北京工业大学信息学部计算机学院,北京100124 [2]中国电子技术标准化研究院,北京100007

出　　处：《通信学报》2017年第7期186-198,共13页Journal on Communications

基　　金：国家智能制造专项基金资助项目(No.[2015]1170);青海省自然科学基金资助项目(No.2017-ZJ-912)~~

摘　　要：目前工业控制网络的入侵检测方法存在协议通用性差、误报率高和无法对未知入侵进行检测等问题。提出一种基于现场总线设备建模的入侵检测方法,利用仿真建模模拟控制器的真实功能,对控制器进行保护;并通过系统辨识建模的方法建立被控对象模型,保证控制器获得的被控对象数据真实准确,从而实现对工业控制网络的入侵检测。经实验验证,所提入侵检测方法检测效果较好。At present,intrusion detection system over fieldbus network layer was a basic protection method in industrial control system.However,it has some weakness,such as poor generality,high false-positive rate,and unable to detect unknown anomaly.An industrial control system intrusion detection method based on fieldbus network equipment simulation was proposed.The method prevented control program from being tampered or destroyed based on controller simulation modelling.Controlled object simulation modelling was designed for ensuring that the system input was credible.Thus the intrusion detection of industrial control network was realized.At last,the results indicate that the proposed intrusion detecting method is available.

关 键 词：仿真 编译原理 系统辨识 入侵检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]