Identification Of Industrial Control Terminal And Modeling Of Safety Baseline Based On Traffic Characteristics

In recent years,with the rise of the industrial Internet of things,a large number of industrial control terminals are connected to the Internet to realize interconnection.The boundary between the traditional industrial control network and the Internet has been broken.Due to the traditional industrial control terminal design did not consider the security issues after access to the Internet,leading to modern industrial control terminals more vulnerable to malicious attacks from the Internet,resulting in serious loss of life and property.In order to avoid illegal terminal intrusion into the system,the terminal must be accurately identified.Aiming at the problem that the recognition accuracy of existing terminal recognition schemes is not high,this paper proposes a feature extraction and recognition method for industrial control terminals based on MGA-SVM(support vector machine embedded in multi parent genetic)dimension reduction and random forest classification.This paper proposes a new method based on the combination of genetic algorithm and genetic algorithm.After the accurate identification of the terminal,in order to prevent the terminal from being used illegally and causing damage to the whole industrial control system,this paper proposes a security baseline behavior modeling method based on terminal traffic characteristics.By analyzing the communication flow between the terminal and the upper server,the most effective feature is extracted,and the terminal security baseline model is established by convolutional neural network CNN.In order to verify the effectiveness of the proposed industrial control terminal identification and safety baseline modeling method,a lot of work has been done in the two stages of terminal identification and safety baseline modeling.In the terminal identification stage,the flow information of nearly 50000 industrial intelligent terminals is collected and screened and manually calibrated to form the original data set for test experiment.In the phase of safety baseline modeling,this paper uses KDD99 data set for experimental verification.MGA-SVM algorithm is used to reduce the dimension of the features in the data set.The terminal recognition model is modeled by the famous ensemble learning algorithm random forest method,and the terminal security baseline model is modeled by convolutional neural network in deep learning.Among them,MGASVM algorithm improves the initialization method,fitness function and cross mutation method in genetic algorithm,which makes feature selection faster and better;the modeling method based on ensemble learning and convolution neural network can obtain higher accuracy.The experimental results show that the industrial control terminal identification and security baseline model established by the above algorithm can effectively identify the brand type of terminal equipment.In addition,the security baseline model can detect abnormal data flow,so as to build a safe industrial control Internet of things environment.