Research On Recognition Method Of Industrial Control Honeypot Based On Common And Individual Characteristics

With the development of the Internet,the industrial production industry is also gradually developing towards intelligence.However,the industrial control system(referred to as the industrial control system)will inevitably face related network security threats when it is connected to the Internet,and the industrial control system will cause greater security hazards after being attacked.Therefore,the industrial control network security is largely related to national security.Therefore,many security protection measures have emerged in the field of industrial control security,and industrial control honeypot is one of them.Accordingly,the identification of industrial control honeypot has become an important part of the attack defense confrontation in the industrial control field.If an attacker can find the industrial control honeypot seduction equipment in advance,he can avoid falling into the seduction trap,thus effectively hiding the attacker’s attack intention;Defenders can better identify the deficiencies of industrial control honeypots through industrial control honeypot identification,thus improving the protection ability of industrial control honeypots.In this paper,a machine learning honeypot recognition method based on personality and common features is proposed to solve the problems of single feature and dependence on experience in existing honeypot recognition methods.In addition,machine learning methods also have problems such as lack of training data and low adaptability.Therefore,this paper proposes a method based on personality and common features to improve the accuracy and stability of industrial control honeypot recognition.The main work contents are as follows:(1)In view of the recognition error caused by the use of single common feature or personality feature recognition,this paper proposes to combine the common feature and personality feature weighting method,collect the corresponding data set through network data,and then identify the industrial control honeypot equipment by combining the common and personality recognition feature weighting method.The experiment shows that,compared with the recognition of industrial control honeypot using only common features or using only individual feature recognition methods,the recognition accuracy of industrial control honeypot can be improved by combining the common and individual recognition methods and using feature fusion in a weighted way.(2)Because machine learning is more suitable for using multi-dimensional features for recognition,and there are few relevant studies now,this paper studies the use of machine learning for automatic industrial control honeypot recognition.As for the lack of training data set for industrial control honeypot recognition based on machine learning,this research trains the machine learning model as a training and testing data set by collecting and sorting data in the industrial control network,and carries out industrial control honeypot machine learning and recognition.After preprocessing the data set,the decision tree,Bayesian classification and support vector machine are used as the single classifier algorithm respectively,and the machine learning efficiency is evaluated according to the accuracy rate,accuracy rate,recall rate and F1 value;Finally,the Bagging algorithm of integrated learning is used to realize soft voting to set the weight of a single classifier,and the results are fused to get the final recognition result.(3)Finally,based on the recognition method based on common and individual characteristics proposed in this paper,the industrial control honeypot recognition system is designed and implemented.Using the common and individual characteristics recognition method combined with machine learning method,it can realize online determination whether the feature value input by the user is an industrial control honeypot.