CN113822337A - Industrial control abnormity detection method based on multi-dimensional sequence - Google Patents

Industrial control abnormity detection method based on multi-dimensional sequence Download PDF

Info

Publication number
CN113822337A
CN113822337A CN202110964073.2A CN202110964073A CN113822337A CN 113822337 A CN113822337 A CN 113822337A CN 202110964073 A CN202110964073 A CN 202110964073A CN 113822337 A CN113822337 A CN 113822337A
Authority
CN
China
Prior art keywords
data
industrial control
model
abnormal
equipment
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202110964073.2A
Other languages
Chinese (zh)
Inventor
季振洲
李冲
贾东升
和树繁
孔胜嵩
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Harbin Institute of Technology Weihai
Original Assignee
Harbin Institute of Technology Weihai
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Harbin Institute of Technology Weihai filed Critical Harbin Institute of Technology Weihai
Priority to CN202110964073.2A priority Critical patent/CN113822337A/en
Publication of CN113822337A publication Critical patent/CN113822337A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/211—Selection of the most significant subset of features
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/048—Activation functions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Artificial Intelligence (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Molecular Biology (AREA)
  • Computing Systems (AREA)
  • Biophysics (AREA)
  • Biomedical Technology (AREA)
  • Mathematical Physics (AREA)
  • Computational Linguistics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Biology (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention provides an industrial control abnormity detection method and system based on a multidimensional time sequence. The system comprises a model training module, a data collecting module, a model detecting module and an abnormal output module. And the model training module reads data from a historical database of the normal working state of the industrial control equipment, and trains to obtain an industrial control abnormity detection model. The data collection module receives data of the industrial control equipment in real time and transmits the data to the detection module. The model detection module predicts the received data, and when the difference between the received data and the data received in real time is too large, the system is considered to be abnormal. The abnormity detection module analyzes the difference between the prediction data and the abnormity data received in real time in each characteristic dimension, positions the abnormal equipment, and facilitates the administrator to analyze the reason of the abnormal equipment.

Description

Industrial control abnormity detection method based on multi-dimensional sequence
Technical Field
The invention belongs to the field of industrial control system anomaly detection, and particularly relates to an industrial control anomaly detection method based on a multi-dimensional inter-sequence.
Background
In recent years, with the development of the internet of things and artificial intelligence, the industrial internet is becoming popular. The industrial control network is not a traditional closed local area network any more, but is accessed into the internet to form the interconnection of everything. This makes the industrial control system not closed, independent, but open, contact. However, with the industrial control system, the risk is increased. Therefore, it is important for the industrial control system to detect an abnormality of the industrial control system.
The detection method can be divided into misuse detection and anomaly detection, and the independent misuse detection adopts a blacklist type detection method, and is characterized in that an effective attack behavior search library is established to comprehensively and quickly match attack behaviors. And the anomaly detection judges the intrusion behavior by establishing a model of normal operation of the system to identify the abnormal operation of the system. Currently, research on intrusion detection of an industrial control system mainly focuses on the field of anomaly detection by using network data, and according to different research objects, the network-based anomaly detection research can be specifically divided into three categories: flow monitoring, protocol detection, equipment and object detection.
Based on the abnormal detection technology of the flow, aiming at the flow characteristics of attack behaviors such as external intrusion, internal damage and the like, data are collected in each network connection link, the network abnormality can be found without analyzing the specific format of a network protocol, and the detection of the intrusion behaviors is realized.
The protocol-based anomaly detection technology relies on the public industrial control system protocol specification and adopts a mature protocol format analysis technology to detect the protocol format and state change in a data packet so as to discover abnormal behaviors. Many industrial protocols today support both TCP/IP and Ethernet communications, including the standard open public protocols such as MODBUS, DNP3, ICCP, ETHERNET/IP, and also include proprietary protocols that are well resolved by researchers such as Siemens S7 COMM. Since attacks on the application content level, such as packet tampering, malicious control instructions, and malicious logic programs, are difficult to detect through traffic, a network stream packet needs to be analyzed to a certain extent, and the instruction type is analyzed according to a protocol format, so that an event sequence is generated to detect intrusion.
The detection method based on the equipment and the object state model can acquire the state information of the equipment and the controlled object by extracting the effective information of the network data application layer. And judging whether the real-time state is abnormal or not by defining methods such as normal and abnormal states of equipment, object mechanism modeling and the like, thereby detecting the intrusion behavior. In an industrial control system, the controller reads and its output can directly change the state of an object, thereby changing the production process. Attacks against industrial control systems are usually targeted at the controller and the controlled object, attempting to modify device parameters or control programs, thereby affecting the object output. The method detects the attack by establishing a normal operation model of the controlled object of the control system.
In the current research of network anomaly detection technology, researchers based on flow and protocol analysis are all based on a single binary communication model and limited to direct interaction of a group of upper computers and controllers. The problem researched by the method for modeling the controlled object is usually separated from the real application environment of the controller and the upper computer, and only the numerical value change of the controlled object is concerned, and the process for realizing the attack behavior is ignored. The single denial of service attack and malicious data tampering are difficult to completely describe the whole process of the APT attack, such as an infiltration invasion process, interaction of a control host, interaction between controllers, data stealing and transmission and the like, so that the attack and the spontaneous behavior of a system are difficult to accurately identify. The detection method based on the equipment and the object state model detects the state deviating from the normal mode by learning the normal working mode of the equipment, and can detect not only the abnormality caused by external behaviors (attacks) but also the abnormality of the equipment. The attack effect on single equipment is better, but the attack effect on multiple equipment is general. The attack of multiple devices may have normal timing characteristics on each device, but the combined result of multiple devices is abnormal, so that the detection rate is low. The result of combining multiple devices with normal timing is abnormal, which indicates that there is necessarily a correlation between these devices. And by adding some related features, a better normal mode of the industrial control system can be learned.
Disclosure of Invention
In order to improve the capability of industrial control system anomaly detection, the invention provides an industrial control anomaly detection method based on a multidimensional time sequence. The method belongs to a detection method based on equipment and object state models, utilizes a full-connection network to extract relevant features among some equipment to increase data features, and then utilizes a long-term and short-term neural network to learn the normal working mode of each equipment and the relevant equipment, thereby improving the capability of the industrial control system for abnormal detection.
An industrial control abnormity detection method based on a multidimensional time sequence comprises the following steps:
step 1: collecting and preprocessing data;
step 2: data feature enhancement and data partitioning;
and step 3: the original features of the data and the features added to the data features are used as input, and an industrial control anomaly detection model based on a multi-dimensional time sequence is constructed;
and 4, step 4: and carrying out abnormity detection on data uploaded by the industrial control system in real time.
Further, the specific process for step 1 is: and a data acquisition and supervisory control System (SCADA) is used for acquiring working state data of field equipment of the industrial control system in real time, integrating the acquired data according to the time stamp, and taking the data of each equipment as a characteristic to obtain data of a multi-dimensional time sequence. Meanwhile, in order to accelerate the convergence of the model and avoid the influence of the data dimension, the data are normalized.
Further, the specific process for step 2 is: some field devices of the industrial control system have certain correlation, the correlation characteristics of some industrial control devices are extracted by utilizing a full-connection network, and the correlation characteristics and the original characteristics are integrated together to be used as the input of a long-term and short-term neural network.
Further, the specific process for step 3 is: selecting a long-short-term neural network (LSTM) model to process multi-dimensional time sequence data, constructing an LSTM network, initializing the number of LSTM hidden layer units, setting an activation function as a relu function, selecting an Adam optimizer and a mse loss function, training the model, and obtaining a normal working mode.
Further, the specific process for step 4 is: and inputting data collected by the industrial control system in real time into an industrial control abnormity detection model of a multi-dimensional time sequence, calculating the mean square error between the result predicted by the model and the data at the next moment, and when the mean square error is larger than a certain threshold value, determining that the industrial control system is abnormal, otherwise, determining that the industrial control system normally operates.
An industrial control abnormity detection system based on a multi-dimensional time sequence comprises a data collection module, a model training module, a model detection module and an abnormity output module.
And the data collection module is used for collecting real-time data of the field devices of the industrial control system. The field devices of the industrial control system, such as sensors, actuators and the like, upload own working state data in real time, then the data collection module reads data from the network card, integrates the data of all the devices together through a timestamp to form data of a multidimensional time sequence, and transmits the data to the model detection module through an interface of the model detection module.
And the model training module has the function of learning the normal working mode of the field equipment of the industrial control system. The method comprises the steps of firstly reading historical data of normal working states of various devices of the industrial control system, then extracting some association features among the devices through a plurality of full-connection networks, integrating the association features with original features, and then training and learning the features of the various devices and normal working modes of the association features among the various devices by using a long-short-term neural network to obtain an abnormal detection model of the industrial control system.
And the model detection module is used for monitoring abnormal data of the field equipment of the industrial control system in real time. Firstly, loading a model trained by a model training module, collecting uploaded industrial control real-time data through an interface of a data collection module, then carrying out abnormity detection on the real-time data by using the trained model, if the predicted data and the real-time uploaded data have larger difference, judging that an industrial control system is abnormal, immediately stopping the operation of the industrial control system, and transmitting the data to an abnormity output module; otherwise, the industrial control system is normal, and the data detection at the next moment is continued.
And the abnormal output module is used for positioning the field equipment with the abnormal industrial control system. The abnormal data and the data predicted by the model are read from the model detection module, the difference between the data obtained by model prediction and the abnormal data in each dimension is analyzed, the dimension with larger difference is larger, the probability of abnormality occurrence is larger, and the field device is judged to have a fault.
Drawings
FIG. 1 is a flow chart of an industrial control anomaly detection method based on a multi-dimensional time series.
Fig. 2 is a system architecture diagram of an industrial control anomaly detection system based on a multi-dimensional time series.
Detailed Description
The present invention is described in further detail below with reference to the attached drawings.
The first embodiment is as follows: the present embodiment is described with reference to fig. 1, and the present embodiment is specifically an industrial control anomaly detection method based on a multidimensional time series, the method includes the following steps:
step 1: collecting and preprocessing data;
the SCADA system can be used for reading the working state data of the field equipment of the industrial control system in real time, the collected data are integrated according to the time stamps, and the data of each equipment is taken as a feature to obtain the data of the multidimensional time sequence. Meanwhile, in order to accelerate the convergence of the model and avoid the influence of the data dimension, the data is normalized by a min-max method, and the calculation formula is as follows.
Figure BDA0003223328450000041
Where x represents an attribute value in the original data, xminRepresents the minimum value, x, in the propertymaxRepresents the maximum value, x, in the attributenewAnd representing the attribute value after normalization processing, wherein the value range is between 0 and 1.
Step 2: data feature enhancement and data partitioning;
the full-connection network is utilized to extract the associated characteristics of some industrial control equipment, and the calculation formula is as follows.
Figure BDA0003223328450000051
Wherein x isi,kDenotes the kth feature of the data at the ith time, n denotes the number of features of the original data, wkWeight coefficient, x, representing the kth feature of the datai,jRepresenting the extracted associated features.
And integrating the related features and the original features together, wherein the integrated data is as follows:
xi＝[xi,1,...,xi,n,xi,n+1,...,xi,n+l]
wherein l is the number of features extracted by the fully-connected network.
At the same time, an appropriate time step t is selected, then [ x ]i,xi+t-1]And xi+tIs a pair of input and output. Their long and short term neural network inputs.
Wherein, XiIs the feature vector after feature enhancement at the ith moment.
And step 3: the original features of the data and the features added to the data features are used as input, and an industrial control anomaly detection model based on a multi-dimensional time sequence is constructed;
the choice is to use a long short term neural network (LSTM) model to process the multidimensional time series data, which, in contrast to RNN, has a hidden layer incorporating a gating mechanism including an input gate, an output gate, and a forgetting gate, and an update of the cell state.
First it is decided what information we will discard from the cell state. This is achieved byThis decision is made through a so-called forgetting gate. The door will read ht-1And xtOutputting a value between 0 and 1 to each of the cells in the cell state Ct-1The numbers in (1). 1 means "complete retention" and 0 means "complete discard".
ft＝σ(Wf·[ht-1,xt]+bf)
Wherein f isiRepresenting the activation value of a forgetting gate, WfWeight matrix, h, representing a forgetting gatet-1Representing the output value at time t-1, bfRepresents the offset vector of the forgetting gate, and represents sigma which is a sigmoid activation function.
And secondly to determine what new information is deposited in the cellular state. Here two parts are involved. First, the sigmoid layer, called the "input gate layer," decides what value we are going to update. Then, a tanh layer creates a new candidate value vector CtAnd, content to be updated is selected.
it＝σ(Wi·[ht-1,xt]+bi)
Figure BDA0003223328450000052
Wherein itRepresenting the activation value of the input gate, WiWeight matrix representing input gates, biRepresenting the offset vector of the input gate, WCWeight matrix representing input gates, bCRepresents the bias vector of the input gate, tanh represents the activation function,. about.CtRepresenting the cell status information at the current time t.
Then time to update the old cell status, Ct-1Is updated to Ct。
Figure BDA0003223328450000061
Wherein, CtRepresenting the cell status information at the current time t.
Finally, a sigmoid layer is used to determine which part of the cell state will be output. Next, the cell state is processed by tanh (to obtain a value between-1 and 1) and multiplied by the output of the sigmoid gate to obtain an output.
ot＝σ(Wo·[ht-1,xt]+bo)
ht＝ot*tanh(Ct)
otRepresenting the activation value of the output gate, WoWeight matrix representing output gates, boRepresenting the offset vector of the output gate.
Do not remember htIs xt’Then the loss function is:
Figure BDA0003223328450000062
training the model, minimizing a loss function, adjusting the weight coefficient of the model by utilizing error back propagation, and finally obtaining a normal working mode.
And 4, step 4: and carrying out abnormity detection on data uploaded by the industrial control system in real time.
Inputting data collected by an industrial control system in real time into an industrial control abnormity detection model of a multi-dimensional time sequence, calculating the mean square error between the result predicted by the model and the data at the next moment, and selecting a proper threshold value, wherein the threshold value can be a maximum value of the mean square error at each moment after the model converges.
Figure BDA0003223328450000063
When the mean square error is larger than a certain threshold value, the industrial control system is considered to be abnormal; otherwise, the industrial control system is considered to run normally.
The second embodiment is as follows: the present embodiment is described with reference to fig. 2, and the present embodiment is specifically an industrial control abnormality detection system based on a multidimensional time series. The system comprises a data collection module, a model training module, a model detection module and an anomaly output module.
The model training module firstly reads historical data of normal working states of various devices of the industrial control system, and learns the normal working modes of the features of the various devices and the associated features among the various devices by using the method described in the first embodiment to obtain an abnormal detection model of the industrial control system.
The data collection module can read the working state data of the field equipment of the industrial control system in real time by using the SCADA system, the field equipment of the industrial control system such as a sensor, an actuator and the like uploads the working state data of the field equipment in real time, the data is read from the network card, the collected data is integrated according to a timestamp, and the data of each equipment is taken as a characteristic to obtain the data of the multidimensional time sequence. The data is passed to the model detection module through an interface with the model detection module.
The model detection module is used for loading the model trained by the model training module, collecting uploaded industrial control real-time data through an interface of the data collection module, inputting the industrial control abnormal detection model of the multidimensional time sequence, calculating the mean square error between the prediction result of the model and the data at the next moment, selecting a proper threshold value, wherein the threshold value can be a maximum value of the mean square error at each moment after the model converges, and when the mean square error is larger than the threshold value, the industrial control system is considered to be abnormal, the operation of the industrial control system is immediately stopped, and the data are transmitted to the abnormal output module; otherwise, the industrial control system is normal, and the data detection at the next moment is continued.
The abnormal output module reads the abnormal data and the data predicted by the model from the model detection module, analyzes the difference between the data obtained by model prediction and the abnormal data in each dimension, and according to the dimension with larger difference, the probability of the abnormal data is larger, and judges which field devices have faults.
The above description is only a preferred embodiment of the present invention, and these embodiments are based on different implementations of the present invention, and the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention.

Claims (8)

1. An industrial control abnormity detection method based on a multidimensional time sequence is characterized by comprising the following steps:
data used for model training is historical data of normal working states of various devices of an industrial control system, and the industrial control device data has massive characteristics, so that the problems that the data is too little and insufficient and the normal working states of the devices cannot be reflected are avoided;
extracting the associated characteristics of the equipment by using a full-connection network;
selecting a proper time step t, taking continuous t +1 data as a group of input and output, taking the first t data as an input and taking the last data as a corresponding output;
and training by using the long and short term neural network to obtain a model of the normal working state of the equipment, selecting a proper threshold, and when the difference between the predicted data and the actually received data is greater than the threshold, determining that the industrial control system is abnormal, otherwise, determining that the industrial control system is normal.
2. The data used for model training according to claim 1 has massive features, and can fully reflect the distribution of the data, so that a proper prediction model is selected, and a normal working model of the industrial control equipment can be obtained through training theoretically.
3. The method of claim 1, wherein the correlation features are extracted automatically during the model training process, and the weight vector is adjusted to extract more representative correlation features as errors are propagated backwards.
4. The method of claim 1, wherein the step of selecting the time step with the highest model accuracy is performed by performing a large number of experiments in conjunction with a specific industrial control scenario.
5. The proper threshold value according to claim 1, wherein the threshold value is an upper limit of normal operation of the equipment, and after the model converges, the largest mean square error among the mean square errors at various time instants is an upper limit of normal operation of the existing equipment, and the largest mean square error can be used as the threshold value.
6. An industrial control anomaly detection system based on a multi-dimensional time series is characterized by comprising:
the data collection module can collect real-time monitoring data of each device of the industrial control system in real time, and when the data is judged to be normal, the real-time monitoring data can be stored in a historical database of the normal working state of the device, so that the historical data of the normal working state is increased, and the accuracy of the model is improved;
the abnormal output module can position abnormal equipment according to the difference between the prediction data and the abnormal data received in real time in each feature dimension, and therefore managers can conveniently analyze the reason of the abnormal equipment.
7. The accuracy of the model is improved according to claim 6, generally speaking, the more sufficient the data set is, the better the model is, and as the model runs in the industrial control system, richer historical data of normal working states are obtained, and the model training module can update the training model periodically to obtain a better model.
8. The device for locating the abnormality according to claim 6, further facilitating an administrator to analyze the cause of the abnormality of the device, wherein the administrator can analyze the historical command of the device with the abnormality to find out whether the device is abnormal due to an external cause or an internal cause, and if the device is abnormal due to the external cause, the administrator can find out a command for causing the device to malfunction, so as to trace the attack.
CN202110964073.2A 2021-08-21 2021-08-21 Industrial control abnormity detection method based on multi-dimensional sequence Pending CN113822337A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110964073.2A CN113822337A (en) 2021-08-21 2021-08-21 Industrial control abnormity detection method based on multi-dimensional sequence

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110964073.2A CN113822337A (en) 2021-08-21 2021-08-21 Industrial control abnormity detection method based on multi-dimensional sequence

Publications (1)

Publication Number Publication Date
CN113822337A true CN113822337A (en) 2021-12-21

Family

ID=78923184

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110964073.2A Pending CN113822337A (en) 2021-08-21 2021-08-21 Industrial control abnormity detection method based on multi-dimensional sequence

Country Status (1)

Country Link
CN (1) CN113822337A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115021956A (en) * 2022-04-20 2022-09-06 哈尔滨工业大学（威海） Multi-dimensional time sequence anomaly detection method and system based on cloud edge cooperation

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115021956A (en) * 2022-04-20 2022-09-06 哈尔滨工业大学（威海） Multi-dimensional time sequence anomaly detection method and system based on cloud edge cooperation

Similar Documents

Publication Publication Date Title
CN112202736B (en) Communication network anomaly classification method based on statistical learning and deep learning
CN108881196B (en) Semi-supervised intrusion detection method based on depth generation model
CN111353153B (en) GEP-CNN-based power grid malicious data injection detection method
CN109617888B (en) Abnormal flow detection method and system based on neural network
CN111107102A (en) Real-time network flow abnormity detection method based on big data
CN112738014B (en) Industrial control flow anomaly detection method and system based on convolution time sequence network
CN111585948A (en) Intelligent network security situation prediction method based on power grid big data
CN112202726B (en) System anomaly detection method based on context sensing
CN117113262B (en) Network traffic identification method and system
CN112688946A (en) Method, module, storage medium, device and system for constructing abnormality detection features
CN114785573A (en) Intelligent substation process layer network abnormal flow detection method based on deep learning
CN116205265A (en) Power grid fault diagnosis method and device based on deep neural network
CN113988136A (en) Medium-voltage circuit breaker fault diagnosis method based on deep learning and intelligent optimization
Sokolov et al. Traffic modeling by recurrent neural networks for intrusion detection in industrial control systems
CN113822337A (en) Industrial control abnormity detection method based on multi-dimensional sequence
CN117041019A (en) Log analysis method, device and storage medium of content delivery network CDN
CN116170208A (en) Network intrusion real-time detection method based on semi-supervised ISODATA algorithm
Shi et al. Distributed adaptive clustering learning over time-varying multitask networks
Gao et al. The prediction role of hidden markov model in intrusion detection
CN116094758B (en) Large-scale network flow acquisition method and system
CN115987643A (en) Industrial control network intrusion detection method based on LSTM and SDN
CN115033893B (en) Information vulnerability data analysis method of improved clustering algorithm
CN115632887A (en) Block chain network abnormal data detection method, device and equipment
CN112769619B (en) Multi-classification network fault prediction method based on decision tree
CN111650898B (en) Distributed control system and method with high fault tolerance performance

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination