Traffic Characteristic Map-based Intrusion Detection Model for Industrial Internet
Traffic Characteristic Map-based Intrusion Detection Model for Industrial Internet
复制标题
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Rui-Hong Dong;Dong-Fang Wu;Qiu-yu Zhang;Zhang Tao
中科院分区：
文献类型：
--
作者：
Rui-Hong Dong;Dong-Fang Wu;Qiu-yu Zhang;Zhang Tao
伊朗Stuxnet安全事件后，工业互联网的安全问题非常严重。此外，现代工业场网络的交通建模方法中存在许多缺陷。针对这些问题，提出了基于流量特征图的工业互联网入侵检测模型。该方法首先采用信息熵法选取重要的交通特征属性集，形成交通特征向量;其次，采用多重相关分析方法将交通特征向量转化为三角形面积映射矩阵，建立交通特征图。最后，利用离散余弦变换（DCT）和奇异值分解（SVD）方法，得到正常和异常交通特征图的感知哈希摘要数据库。在此基础上，可以生成相应的入侵检测规则集，这对于工业现场网络流量周期性特征的建模是必不可少的。特别地，证明了传输特征映射感知散列算法（TCM-PH）的鲁棒性和区分性。实验结果表明，该方法在工业现场网络中具有良好的入侵检测性能。
After the Stuxnet security event in Iran, the security issues on industrial Internet are very serious. Besides, there are many flaws existing in the modern traffic modelling approaches to the industrial field network. Aiming at these problems, the traffic characteristic map-based intrusion detection model for industrial Internet was proposed. Firstly, information entropy method was adopted to select vital traffic characteristics attributes set which is used to form traffic characteristic vectors. Secondly, multiple correlation analysis approach was applied to transform traffic characteristics vector into triangle area mapping matrix and traffic characteristic map can be established. Finally, using discrete cosine transform (DCT) and singular value decomposition (SVD) methods, perceptual hash digest database of normal and abnormal traffic characteristics maps was obtained. Thereafter, the corresponding intrusion detection rule set can be generated, which is essential for the modelling of network traffic periodic characteristics in industrial field network. In particular, the robustness and discrimination of the traffic characteristics map perceptual hash algorithm (TCM-PH) were proved. Experimental results show that the proposed approach has a good performance of intrusion detection in the industrial field network.