Research And Application Of Industrial Control Network Situation Awareness Technology Based On Big Data

With the rapid advancement of national strategies such as "Internet +" and "Made in China 2025",industrial control systems have been widely used in various industries such as energy,municipal administration,transportation,water conservancy and aerospace,and industrial control network information security always affects the lifeline of the national economy,but most industrial control networks use specialized software and hardware equipment and communication protocols,which are very different from traditional information networks.The security loopholes of industrial control systems are difficult to be discovered by people.Therefore,the security of industrial control networks has not been paid enough attention,leading to the frequent occurrence of industrial control network security incidents,these have made us realize the importance of building an industrial control network situational awareness system that integrates evaluation and prediction.This article is based on big data research on industrial control network situation awareness technology,and integrates situation extraction as the premise,situation assessment as the core,and situation prediction as the goal to comprehensively perceive the situation of industrial control network system.First,situation extraction,This article uses two methods to collect industrial control network data.One is to use traffic mirroring to bypass the sensor sensing terminal to collect network traffic data without affecting the original production business;The second is to use Wire Shark tools to collect industrial control network traffic data packets,count the traffic data packets per second,analyze the current network status,build a Hadoop big data platform to implement offline data preprocessing and feature extraction,and build a Flink+Tensor Flow model to train the graph neural network model and complete the prediction;secondly,the situation assessment uses a combination of analytic hierarchy process and correlation analysis to realize the situation assessment,and use the evaluation graph to show the current network security status;The final situation prediction is through offline training graph neural network model uses the Flink real-time calculation engine to read the industrial control network data in real time and input it into the graph neural network model to enhance the feature representation of each node and predict the probability of abnormal occurrence of the industrial control network for a period of time in the future.Finally,the graph neural network model in this article is compared with the traditional neural network and machine learning model,and the accuracy and false alarm rate indicators are used to prove that the model in this article has high accuracy and robustness.