基于逆向云算法模型的工业控制系统工艺稳定性建模与攻击防护

doi:10.11959/j.issn.2096-6652.202006

摘要/Abstract

摘要：

与传统的网络安全防御手段相比，基于工艺流程的工业系统安全防护研究愈发成为工业控制安全领域的重要研究方向。提出一种改进型BC-1stM无确定度逆向云算法，通过对时间序列与工艺流程的正常状态进行建模，实现在工业系统中基于工艺攻击方式的安全防护检测与告警，并采用田纳西伊士曼化工过程平台进行验证。结果表明，该模型在进行攻击行为检测与攻击点检测方面有很高的查准率，提高了工业系统的安全防护能力。

关键词: 工业控制系统, 工艺流程, 正常状态模型, 入侵检测, 逆向云算法

Abstract:

Compared with traditional network security defense methods,industrial system security protection research based on process flow has become an important research direction in the field of industrial security.An improved backward cloud algorithm based on first order absolute central moment (BC-1stM) non-deterministic reverse cloud method was proposed,which was modeled by the time series and the normal state of the process flow.The security protection detection and alarm based on the process attack mode in the industrial system was realized,and Tennessee Eastman chemical process platform was adopted to validate the algorithm.The results show that the model had a high precision in the detection of attack behavior and detection of attack points,and improved the security protection capability of industrial systems.

Key words: industrial control system, process flow, steady state model, intrusion detection, reverse cloud algorithm

中图分类号:

TP309.2

蔺俊豪,冯冬芹. 基于逆向云算法模型的工业控制系统工艺稳定性建模与攻击防护[J]. 智能科学与技术学报, 2020, 2(1): 53-61.

Junhao LIN,Dongqin FENG. Process stability modeling and attack protection of industrial control system based on reverse cloud algorithm model[J]. Chinese Journal of Intelligent Science and Technology, 2020, 2(1): 53-61.

图/表 20

图1

图2

表1

图3

图4

图5

图6

图7

表2

表3

图8

图9

图10

图11

图12

图13

图14

图15

图16

图17

参考文献 12

[1]	梁耀, 冯冬芹, 徐珊珊 ,等. 加密传输在工控系统安全中的可行性研究[J]. 自动化学报, 2018,44(3): 434-442.
	LIANG Y , FENG D Q , XU S S ,et al. Feasibility analysis of encrypted transmission on security of industrial control systems[J]. Acta Automatica Sinica, 2018,44(3): 434-442.
[2]	BABU B , IJYAS T , MUNEER P ,et al. Security issues in SCADA based industrial control systems[C]// International Conference on Anti-cyber Crimes. Piscataway:IEEE Press, 2017.
[3]	陆耿虹, 冯冬芹 . 基于粒子滤波的工业控制网络态势感知建模[J]. 自动化学报, 2018,44(8): 1405-1412.
	LU G H , FENG D Q . Modeling of industrial control network situation awareness with particle filtering[J]. Acta Automatica Sinica, 2018,44(8): 1405-1412.
[4]	李俊, 郭娴, 孙军 . 基于扩展 Kalman 滤波的工业控制系统 DDoS攻击检测[J]. 电子技术应用, 2016,42(4): 73-77.
	LI J , GUO X , SUN J . The detection of DDoS attack for industrial control systems based on extended Kalman filtering[J]. Application of Electronic Technique, 2016,42(4): 73-77.
[5]	杨伟, 何杰, 万亚东 ,等. 基于IEEE802.15.4e标准的工业物联网安全时间同步策略[J]. 计算机研究与发展, 2017,54(9): 2032-2043.
	YANG W , HE J , WAN Y D ,et al. Security countermeasures for time synchronization in IEEE802.15.4e-based industrial IoT[J]. Journal of Computer Research and Development, 2017,54(9): 2032-2043.
[6]	李绍晖, 刘纪伟 . 一种面向工业控制系统的改进CUSUM入侵检测方法[J]. 电子技术应用, 2015,41(9): 118-121.
	LI S H , LIU J W . An improved CUSUM algorithm in intrusion detection for industry control systems[J]. Application of Electronic Technique, 2015,41(9): 118-121.
[7]	王华忠, 杨智慧, 颜秉勇 ,等. 融合PCA和PSO-SVM方法在工控入侵检测中的应用[J]. 科技通报, 2017,33(1): 80-85.
	WANG H Z , YANG Z H , YAN B Y ,et al. Application of fusion PCA and PSO-SVM method in industrial control intrusion detection[J]. Bulletin of Science and Technology, 2017,33(1): 80-85.
[8]	贾志伟, 关忠仁, 赵建芳 . 一种基于半监督学习的入侵检测算法[J]. 成都信息工程学院学报, 2012,27(6): 560-563.
	JIA Z W , GUAN Z R , ZHAO J F . Intrusion detection algorithm based on semi-supervised learning[J]. Journal of Chengdu University of Information Technology, 2012,27(6): 560-563.
[9]	李金武 . 基于云模型主机安全评估方法[J]. 洛阳师范学院学报, 2017,36(2): 59-63.
	LI J W . An assessment method of host security based on cloud model[J]. Journal of Luoyang Normal University, 2017,36(2): 59-63.
[10]	王辉, 秦术, 刘少英 ,等. 曲线拟合的逆向云改进算法[J]. 智能系统学报, 2014,9(5): 590-594.
	WANG H , QIN S , LIU S Y ,et al. An improved algorithm of backward cloud based on curve fitting[J]. CAAI Transactions on Intelligent Systems, 2014,9(5): 590-594.
[11]	刘常昱, 冯芒, 戴晓军 ,等. 基于云 X 信息的逆向云新算法[J]. 系统仿真学报, 2004,16(11): 2417-2420.
	LIU C Y , FENG M , DAI X J ,et al. A new algorithm of backward cloud[J]. Journal of System Simulation, 2004,16(11): 2417-2420.
[12]	DOWNS J J , VOGEL E F . A plant-wide industrial process control problem[J]. Computers and Chemical Engineering, 1993,17: 245-255.

攻击参数	正弦攻击	方波攻击	阶跃攻击	浪涌攻击
攻击参数1	频率0.2 rad/s	周期30 s	初始值0 Pa	阶跃值200 Pa
攻击参数2	振幅±75 Pa	振幅±100 Pa	峰值1 000 Pa	阶跃值250 Pa
攻击参数3	偏移度0	脉冲比50%	起始时间60 s	阶跃值300 Pa
攻击参数4	相位20 rad	起始时间20 s	采样时间70 s	间隔时间20 s

攻击类型	平均时延/ms	最大时延/ms
正弦攻击	810	1 280
方波攻击	511	645
阶跃攻击	553	553
浪涌攻击	773	822

变量号	变量名	变量标准值	单位
1	D物料流量	3 664.0	kg/h
2	E物料流量	4 509.3	kg/h
6	反应器压力	2 705.0	KPa
12	分离器压力	2 663.7	KPa
15	汽提塔压力	3 102.2	KPa
46	放空阀操作量	40.064%	—