Research On The Method Of Situation Assessment And Prediction Of Industrial Control System

The attack types of industrial control system are various and the intensity is different.It is particularly important to know the security status of industrial control system in time and makes timely security defense strategy.The situation assessment technology of industrial control network is an important technology to improve the monitoring and scheduling ability of the network.The focus of situation assessment is to timely monitor local potential or existing anomalies in the system,fuse the multiple data generated by the system,and reflect it in the description of the system security state.The prediction technology of industrial control network is to realize the non-linear mapping from input state to output state according to the known historical security state,and to predict the development trend of system threat and the overall security state of the system.However,when the system is attacked,a single model tends to show different emplacements which is easy to cause the problem of low prediction accuracy in the actual prediction process.In view of the above problems,the paper mainly carries out the following work:(1)firstly,the research background and significance of the subject were discussed on the whole,and the research status of situation assessment technology and situation prediction technology of industrial control network security at home and abroad were introduced.The rectification tower stripping process in chemical industry as the example to verify this topic proposed method of situation assessment and prediction of industrial control system.Next,the situational awareness model framework suitable for industrial control systems based on the evaluation and prediction technology is introduced.(2)build an evaluation model.Network security situational awareness is described in terms of multi-source information fusion,weight trajectory reconstruction,and establishment of assessment indicators.This paper presents an attack trajectory reconstruction method based on known attack correlation and heterogeneity,describes the development of system threat and the change of overall security state,and solves the problem of high complexity and easy combination explosion in the process of trajectory reconstruction.(3)construct the composite prediction model.The combined prediction model combines the prediction results of a variety of single models to improve the accuracy of the results.The weight setting of it is the focus of combinatorial model.In this paper,the fusion weight is determined according to the mean square error(MSE)of each single prediction model.Firstly,the absolute value logarithmic function property is used to amplify the prediction effect of each model,and then the reciprocal value of the MSE is used as the weight of the better model to increase the importance of the dominant model.Through comparative analysis of simulation,it can be seen that the evaluation method in this paper can obtain reasonable understanding values in line with the current situation,and the proposed combined prediction method and weighting method can obtain better accuracy,which can provide more accurate defense opinions for network security administrators.