Information Security Protection For Industrial Control System Based On Control Behavior Model

Industrial control systems are widely used in key infrastructure such as petroleum,manufacturing,chemical,transportation,and energy.With the in-depth integration of industrialization and informatization,the interconnectivity and openness of industrial control systems have reached an unprecedented level,resulting in severe information security threats to industrial control systems.Aiming at the problems of information security in industrial control systems,the operating mechanism,system architecture,typical characteristics and vulnerability of the system are fully considered.With reference to the information security protection system for industrial control systems proposed by NIST,a method based on "detection-response" 'S dynamic protection framework,in-depth study of the abnormal detection and intrusion response of industrial control systems,early detection of abnormal behavior of the system,and targeted response measures to reduce the damage caused by the attack to the system and ensure the safety and stability of the industrial control system runAn abnormal detection method based on behavior model is proposed to deal with the problem of abnormal detection in industrial control systems.This method combines the control behavior of the system and divides the control loops of the system according to the process knowledge of the system;then,for each control loop,a normal control behavior model is established based on the neural network;then,the established errors and trends are consistent Two abnormal detection indicators,compare the predicted state of the normal control behavior model with the actual measured state,and analyze whether the control behavior is abnormal.This scheme not only has good detection accuracy,but the proposed model is interpretable.Because it is an analysis of control behavior,it can be detected before the attack behavior has an impact on the physical process,thereby enabling early detection of abnormal behavior.An intrusion response method based on control reconstruction technology is proposed to deal with the response problem of actuator attacks in the dynamic information security protection of industrial control systems.This method uses modern control theory to analyze the controllability of the system to ensure that some actuators meet the controllability conditions after failure;then,using control reconstruction technology,design virtual actuators to ensure that the system's Stable operation;meanwhile,optimize and adjust the control strategy,and restore the system target tracking under the premise of ensuring the stable operation of the system.Considering that the actual attack model and characteristics are often not available in this scenario,this paper adopts the method of directly isolating the attacked actuator signal,reconstructs the controller function based on the control reconstruction technology,and uses the remaining normal actuators to implement the safety control strategy.,To ensure the stability of the system,can effectively solve the problem of traditional methods relying on the attack model.