Research On Abnormal Detection Of Industrial Control System Based On Fuzzy Clustering

The safe and reliable operation of industrial control system has great significance for national security,and people's livelihood,and social economy.However,the industrial control system is not only facing the traditional information security threat brought by the deep integration of informatization and industrialization,but also facing the abnormal situation caused by internal vulnerability.Once an abnormality occurs,it may cause serious consequences such as the loss of the product quality,downtime and even explosion.Therefore,it is important to study abnormal detection technology for industrial control system.This paper is oriented to the physical space of industrial control system,specifically studies the following aspects:(1)Taken as a typical industrial control system,the abnormal situation of Tennessee Eastman process(TE)is analyzed.Firstly,the process flow,control strategy and related process variables of TE process are reviewed.Then,the mechanism model of TE process is established to provide model support for subsequent analysis.Finally,the possible security scenarios of TE process are analyzed based on the stability and security of TE process production.(2)Considering the characteristics of industrial control system,such as large data volume,difficulty in marking,and including multiple security scenarios,an anomaly detection technology of industrial control system based on Fuzzy C-means clustering algorithm(FCM)is proposed.First,FCM algorithm is used to cluster the historical data of TE process to obtain the clustering center of each security scenario.Then,the clustering results are labeled by the definition of the scenarios.During the online detection,the values of the detection point belonging to each scenario are calculated,based on which the detection point is classified as the scenario with the largest membership value.This abnormal detection scheme can not only detect the current security scenario of the system and take corresponding measures,but also avoid unnecessary abnormal alarm.(3)Considering the poor detection performance of the anomaly detection technology based on FCM algorithm,an anomaly detection technology based on feature-weighted FCM algorithm is proposed.Firstly,the ReliefF algorithm is used to calculate the weight of each feature.Then the weight vector is used to optimize the similarity calculation of FCM algorithm to enhance the contribution of correlation features to clustering.Finally,FCM algorithm is used to build a security scenario model and realize abnormal detection based on security scenario decision.The optimized abnormal detection scheme can improve the detection performance by considering the different contributions of each feature to clustering.(4)Considering that each process unit of TE process is tightly coupled and the propagation of anomalies can easily span multiple units,a hierarchical anomaly detection scheme based on production process coupling is proposed.Firstly,a set of anomaly detection system is established for different process units,and then parallel detection is carried out for detection points.Then,a comprehensive decision is made according to the detection results of each system,and the most dangerous scenario is selected as the final detection result.Finally,corresponding treatment measures are taken.The hierarchical anomaly detection scheme considers each important process unit of TE process and avoids accidents caused by the failure to detect other process unit anomalies.