基于前缀树的工控入侵检测算法  

Intrusion Detection Algorithm Based on Trie for Industry Control System

作　　者：林幼玲 朱林全 李扬 邢镔 陈彦如 LIN You-ling;ZHU Lin-quan;LI Yang;XING Bin;CHEN Yan-ru(College of Computer Science,Sichuan University,Chengdu 610065;Chongqing Industrial Big Data Innovation Center Co.,Ltd.,Chongqing 400707;Science and Technology on Security Communication Laboratory,Institute of Southwestern Communication,Chengdu 610041;National Engineering Laboratory of Industrial Big Data Application Technology,Beijing 100043)

机构地区：[1]四川大学计算机学院,成都610065 [2]重庆工业大数据创新中心有限公司,重庆400707 [3]西南通信研究所保密通信重点实验室,成都610041 [4]工业大数据应用技术国家工程实验室,北京100043

出　　处：《现代计算机》2021年第8期14-17,共4页Modern Computer

基　　金：四川省科学技术厅省重点科技专项(No.2019YFG0184);保密通信国防科技重点实验室(No.6142103190415);四川省通信管理局,2020年工业互联网标识解析(电子信息)二级节点建设项目。

摘　　要：随着信息技术的发展,工业和互联网紧密结合,因此,保证工业网络的安全是十分有必要的。然而,在实际的工控系统中,由于工控节点的资源受限,传统的入侵检测系统无法直接部署使用。为此,提出基于前缀树的入侵检测系统。基于前缀树的入侵检测系统中,入侵签名库虽需消耗一定存储空间,但入侵的检测效率却得到提高,可运用于工控节点上。With the development of information technology,industry and Internet are closely integrated.Therefore,it is necessary to ensure the securi⁃ty of industrial network.However,in practical industrial control system,as a result of the industrial control nodes resource-constrained,tra⁃ditional intrusion detection system cannot be directly deployed to use.For this reason,an intrusion detection system based on Trie is pro⁃posed.Although the intrusion signature library occupies a certain amount of memory and has high detection efficiency in the intrusion de⁃tection system based on Trie,so it can be used in the industrial control node.

关 键 词：前缀树 入侵检测 工业控制系统 入侵签名 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]