基于信息流的工控系统数据传输异常预警仿真

Mathematical modeling and Simulation of network multi intrusion behavior identification

为了准确判断数据在传输过程中是否存在异常行为,实现异常行为的分级预警,提出面向工业控制系统的数据跨域传输异常预警方法。通过构建信息流模型,分析数据传输过程中的异常行为,归一化处理系统中的样本数据得到标准化小波系数。通过小波系数和样本数据总数计算得到预警标准阈值,将信息流模型与预警标准阈值相结合,共同实现对数据传输异常行为的监督,并结合模糊综合评判法获取数据跨域传输异常预警指标。将所有指标划分到相应的因素集中,得到异常预警矩阵,依据最大隶属度原则,对不同程度的异常行为设定不同的预警等级:无警、一级预警和二级预警。仿真结果表明,所提方法可有效分析出数据传输过程中是否存在异常行为,并对异常行为进行精准预警。

In order to accurately judge whether there is abnormal behavior in the process of data transmission and realize hierarchical early warning of abnormal behavior, a cross domain data transmission abnormal behavior early warning method for industrial control system is proposed.. The information flow model was established, the abnormal behavior in the process of data transmission was analyzed, and the sample data in the system was normalized to obtain the standardized wavelet coefficients. According to the wavelet coefficients and the total number of sample data, the early warning standard threshold was obtained. The information flow model was combined with the early warning standard threshold to supervise the abnormal behavior of data transmission. Concurrently, the fuzzy comprehensive evaluation method was introduced to obtain the abnormal early warning index of data cross domain transmission. All indicators were divided into corresponding factor sets to obtain the anomaly early warning matrix. Based on the principle of maximum membership, different degrees of abnormal behavior were set to different early warning levels(no alarm, primary early warning and secondary early warning). The simulation results show that this method can effectively determine the abnormal behavior in the process of data transmission and give accurate early warning.