Research On Intrusion Detection Method For Industrial Control System Based On Spatiotemporal Correlation Characteristics Of Industrial Field Data

In the era of industrial Internet,industrial production is developing in the direction of more open,intelligent and information technology,and production efficiency has been greatly improved.However,the open industrial production environment gives intruders more opportunities,and ICS is facing increasingly serious security problems.ICS has been widely used in important fields such as finance,transportation,water treatment,manufacturing,power generation and distribution.The safety of ICS is closely related to national security and economic development.A slight mistake may cause major economic losses or even endanger personal safety.In recent years,the security protection of industrial control system is very important,and intrusion detection technology has become one of the hot research directions in the field of industrial control.Due to the lack of consideration of the time-space correlation between different nodes in the industrial control system,the existing methods have poor detection effect on the attacks with hidden time-space interaction characteristics in the complex industrial control system,which makes the industrial control system face severe security threats.Therefore,this paper studies the intrusion detection method of industrial control system based on spatial-temporal correlation features of industrial field data,and designs and implements industrial control attack detection system based on spatial-temporal correlation features and industrial control system anomaly detection system based on spatial-temporal correlation features.The specific research contents are as follows:(1)The industrial control attack detection method based on spatial correlation features is studied.Based on the analysis of spatial correlation between industrial control attacks and multiple links in the production process,the spatial-temporal correlation features of industrial control system attacks are extracted by deep Q network(DQN),and the quantitative evaluation mechanism of industrial control system attack features is constructed.Then the attack detection method of industrial control system based on spatial correlation feature of industrial control attack is proposed.(2)the study of industrial control system based on space-time correlation characteristics of anomaly detection method,based on the analysis of the industrial field data correlation of time and space,build based on short-and long-term memory network(LSTM)industrial field of multidimensional time series data of time-space correlation model,on the basis of establishing industrial field multidimensional time series data model based on spatial and temporal correlation of the assessment mechanism,An anomaly detection method of industrial control system based on spatial-temporal correlation feature is realized by analyzing the deviation effect evaluation method of industrial field data affected by abnormal events.In this paper,a series of experiments are carried out on the open industrial control system data set to evaluate the effectiveness and performance of the intrusion detection method proposed in this paper.Experimental results show that the accuracy of the industrial control attack detection system proposed in this paper is about 98%,and the accuracy of the industrial control anomaly detection system is about 96%,which is 10-15% higher than the relevant algorithms based on DDPG and MLP.