Design And Implementation Of Industrial Control Network Anomaly Detection System

The rapid development of science and technology not only gives people the convenience of enjoying life,but also promotes the vigorous development of the Internet of Things technology.Especially with the application of a new generation of 5 G communication technology and the advent of the digital twin era,the Industrial Internet has ushered in more disruptive opportunities.In the current global epidemic environment,automated control systems rely on their unique advantages and tenacious vitality.It has accelerated the resumption of work and production of enterprises,thus making outstanding contributions to the prevention and control of the epidemic.At the same time,the security issues of the Industrial Internet are facing severe challenges.The large-scale fall of industrial control networks will affect people's daily lives,and in serious cases,the normal operation of society will be threatened.This paper designs and implements an industrial control network anomaly detection system to provide a guarantee for the safety of the industrial Internet.This article first analyzes and summarizes the structure and characteristics of the industrial control system in the Industrial Internet,points out the security problems faced by the industrial control system,studies the common security protection methods in the industrial control system,and analyzes their advantages and disadvantages.Based on the characteristics of the communication flow of the industrial control system,the industrial control network intrusion detection system is comprehensively analyzed from the whole to the part,and the anomaly detection system of the industrial control network is designed and implemented.The system mainly includes the following modules,the flow collection and analysis module,adopts port mirroring technology,collects the original industrial control flow without affecting production,extracts the characteristic value of the flow within the capture time,and saves the collected characteristic value of the flow To the database.The detection module uses machine learning and deep learning algorithms to detect abnormal traffic.It learns the normal mode of the industrial control system from the flow baseline and operation sequence,and realizes the detection of abnormal traffic in the industrial control system according to the learned normal mode.,Abnormal behavior.The evaluation module evaluates the security of the current industrial control network based on the results of the detection module.The visual interface is used for the visual display of the detection results,which is convenient for users to understand the security of the current industrial control system network.At the same time,it configures the association management relationship between users and roles and permissions,as well as operation log records to further improve the security of the system.