Research On Information Security Situational Awareness Technology Of Industrial Control System

The rapid development of industrial control system information makes industrial control systems not only face many traditional network attacks from the Internet,but also its inherent vulnerabilities are increasingly being discovered,and attacks against specific industrial protocols are increasing,which makes the safety problems faced by industrial control systems increasingly serious.Based on the analysis of the information security problem of industrial control system,this thesis proposes a situational awareness scheme for industrial control system based on Modbus TCP protocol.And through the laboratory's existing industrial control equipment,build a verification platform to perform functional verification and performance analysis on the proposed scheme.The main work of this thesis is as follows:1.Aiming at the information security requirements of industrial control systems,based on the analysis and summary of industrial control system information security,Modbus protocol and situational awareness technology,this thesis proposes a situational awareness scheme including situation assessment and situation prediction.2.Aiming at the problem of long training time,low evaluation accuracy and slow decision-making in the process of security situation assessment,this thesis proposes a multi-class support vector machine situation assessment model based on partial binary tree.Through the pre-extraction and loop extraction process of support vector,the convergence speed and accuracy of the evaluation model can be effectively improved.By combining the support vector machine and the partial binary tree,the use of the sub-classifier can be reduced and fast decision making can be made.When the sample size is 1000,the evaluation accuracy of the scheme is 99.80%.Compared with the improved RBF neural network evaluation model,the evaluation accuracy increased by 11.53%.When the mean square error is less than 0.1,the model training time is shortened by 57.14% compared with the multi-class support vector machine evaluation model based on DDAG algorithm.3.Aiming at the problem of low prediction accuracy in the process of security situation prediction,this thesis proposes a situation prediction model based on hidden Markov algorithm.In the prediction process,the parameters in the situation assessment process are directly used as the input of the hidden Markov model,which greatly simplifies the model establishment process.When the sample size is 1000,the prediction accuracy is 92.1%.Compared with the gray system prediction model,the prediction accuracy is improved by 6.90%.4.This thesis uses Modbus temperature and humidity sensor,Modbus gateway,industrial gateway,Phoenix PLC controller and other hardware equipment to build an industrial control system verification platform,using PC WORX,VISU+ and other software for configuration and process interaction,using ModbusPoll & Slave software to construct industrial control typical attacks to testing and verification the scheme.