Research On Network Security Situation Awareness For Industrial Control Network

With the continuous integration of industrialization and informatization,the traditional industrial system is developing towards multi-dimensional control of the Internet.As a new active security protection technology,network security situational awareness(NSSA)has been widely used in industrial control network(ICN).Faced with the rapid development of industrial control network technology and applications,as well as the continuous evolution of industrial control network attack complexity and attack methods,the existing network security situation awareness methods based on industrial control networks have problems such as low perception accuracy,poor realtime performance,and complex processes.Therefore,it is particularly important to construct an accurate,fast and efficient network security situational awareness method to deal with the complex big data industrial control network environment.Aiming at the above problems,this thesis mainly uses the text SimHash algorithm,grey Verhulst model and Gated Recurrent Unit(GRU)network methods to carry out research on the network security situational awareness methods of industrial control networks.The specific research work is as follows:1.In view of the problems of the existing network security situation assessment methods,such as lack of accuracy,complex evaluation process,and difficulty in adapting to the big data industrial network environment,a security situation assessment algorithm for ICN nodes based on improved text SimHash was proposed.Firstly,the algorithm constructs the generated pre-attack and post-attack text according to the industrial control network security data obtained by node attack detection.Secondly,the improved SimHash algorithm is used to calculate the similarity of the constructed text.Finally,the text similarity is used to quantify the security situation value of industrial control network nodes.The experimental results show that the proposed method improves the ability to deal with the means and types of complex network attacks compared with the existing methods,and can effectively adapt to the big data industrial network environment.2.In light of the problems of existing industrial control network security situation prediction methods that the prediction accuracy is insufficient,the model is difficult to construct,and require a large amount of training data,an ICN security situation prediction method based on adaptive grey Verhulst model and gated recurrent unit(GRU)network was proposed.Firstly,the historical and current network security situation value sequence is input into the improved grey Verhulst model to obtain the preliminary prediction values and residual sequence of network security situation.Secondly,the predicted value sequence is taken as the input and the residual sequence as the output to train the GRU network.Finally,the trained GRU network is used to predict the residual error,and output the predicted value of network security situation after the residual error correction.Experimental results show that compared with the existing prediction methods,the proposed method can reach the convergence state faster and the loss value is smaller,which has a higher accuracy of network security situation prediction.