| Nowadays,with the high development of Internet technology,all walks of life are gradually embracing Internet technology and empowering their industries.Relying on advanced technologies such as 5g,cloud computing and big data,the Internet industry has brought profound changes to traditional industries and greatly facilitated people’s lives.Therefore,various industrial infrastructures are undergoing information transformation,such as petroleum,electric power and railway industries.They are an important cornerstone of national industrial information construction.However,with the access of industrial control systems in various industrial infrastructure to the Internet,it also brings potential risks.Nowadays,the political situation in the world is turbulent,and various national hacker organizations hidden in the dark are ready to move.Their goal is the industrial control system in the industrial infrastructure of various countries.Industrial control system is the heart of industrial infrastructure.Once attacked and occupied,the consequences will be unimaginable.Therefore,the national important industrial infrastructure must have multiple safety protection.Nowadays,most industrial computers in China’s industrial infrastructure are domestic Linux system hosts.Therefore,this paper studies the intrusion detection method of industrial control system Linux host based on system call.The research work is as follows:Combining SVM and KNN algorithm,a two-stage hybrid SVM-KNN classifier is realized.Moreover,combining pattern matching with two-stage hybrid SVM-KNN classifier,a hybrid multi-stage detection strategy is proposed.In order to improve the detection efficiency,this paper proposes a self-learning method of blacklist rules.After the operation is determined as an intrusion by the classifier,the corresponding system call sequence will be added to the blacklist rule base.Then for the same intrusion operation,the threat can be quickly identified through pattern matching.At the same time,the application of incremental learning method makes the system obtain self increasing learning ability and enhance its generalization ability.According to the proposed method,this paper implements a Linux host intrusion detection system based on system call.The system is based on the development of domestic hardware platform and operating system,and is designed for the environment of industrial control system.The system adopts client server architecture,which is composed of agent deployed on the host of industrial control system,intrusion detection server deployed separately and administrator client deployed on administrator workstation.The system attaches importance to its own security,ensures that the system cannot be brutally cracked through two factor authentication,ensures that malicious programs cannot tamper with system configuration information through configuration file self-protection,and ensures that the system cannot kill system processes through process self-protection. |
