一种基于DNP3协议的IFAR攻击检测算法

IFAR Attack Detection Algorithm Based on DNP3 Protocol

分布式网络协议(DNP3)是现代监控和数据采集网络协议之一,是主设备和从设备之间进行通信的双向协议。为了提高可靠性,DNP3在其应用层中包含了传输功能。因为DNP3并未考虑安全机制,所以它很容易遭受到攻击。基于DNP3的通信系统,文章搭建了Pfsense防火墙,并结合Snort进行攻击检测,采用孤立森林与关联规则算法(IFAR),将数据分为异常与非异常,并将异常数据处理为强规则,扩充入侵检测系统。测试结果表明,该算法能有效检测异常攻击,检测率可达到93.35%。

Distributed network protocol(DNP3)is one of the modern monitoring and data acquisition network protocols.DNP3 is a two-way protocol for communication between the master device and the slave device through various communication media.In order to improve reliability,DNP3 includes a transmission function in its application layer.However,in its design stage,DNP3 is vulnerable to attacks.Based on the DNP3 communication system,this paper builds a Pfsense firewall,combines Snort for attack detection,proposes the iForest-Association Rules(IFAR)method,uses the IFAR to divide the data into abnormal and non-abnormal,and handles the abnormal data into strong rules and expands intrusion detection system.Test results show that the algorithm can effectively detect abnormal attacks.The test data set is compared with the attack formula,and the final detection rate is 93.35%.