论文部分内容阅读
基于通信行为的异常检测是工业控制系统入侵检测的难点问题.通过利用粒子群优化(particle swarm optimization,PSO)算法对单类支持向量机(one-class support vector machine,OCSVM)算法的参数进行优化,提出一种PSO-OCSVM算法.该算法根据正常的Modbus功能码序列建立正常通信行为的入侵检测模型,识别出异常的Modbus TCP通信流量.通过仿真对比分析,证明PSO-OCSVM算法满足工业控制系统通信异常检测对高效性、可靠性和实时性的需求.
Anomaly detection based on communication behavior is a difficult problem in intrusion detection of industrial control systems.Optimization of parameters of one-class support vector machine (OCSVM) algorithm by using particle swarm optimization (PSO) , A PSO-OCSVM algorithm is proposed.The algorithm builds an intrusion detection model of normal communication behavior according to the normal Modbus function code sequence, and identifies the abnormal Modbus TCP traffic.According to the simulation analysis, it is proved that the PSO-OCSVM algorithm meets the requirements of industrial control system Communication anomaly detection of high efficiency, reliability and real-time needs.