KR102435460B1 - System for Detecting Abnormal Control Data - Google Patents

Abstract

A system for detecting abnormal control data according to an embodiment of the present invention includes: a data parsing unit configured to parse control data transmitted from a control terminal to obtain a command of the control data and at least one value of the command; A security rule generator generating a normal control data security rule to which a command and an abnormal control data discrimination model are mapped; decorrelation multidimensional control data that is out of correlation between the control data and an outlier ( outlier) an abnormal control data generation unit for generating control data; an abnormal data determination unit for determining whether the target control data is abnormal by comparing the target control data received from the control terminal with the normal control data security rule; and , The security rule generating unit is configured to validate the abnormal control data identification model using the decorrelation multidimensional control data and the outlier control data to determine the learning end time of the abnormal control data identification model. .

Description

Abnormal control data detection system and method {System for Detecting Abnormal Control Data}

The present invention relates to processing of control data, and more particularly, to a system and method capable of detecting abnormal control data.

As the onlineization of factory control devices such as programmable logic controllers (PLCs) increases, cyber attacks targeting factory control devices are also increasing.

Cyberattacks targeting factory control devices may cause malfunction or inoperability of factory control devices by illegally changing the command or value of control data transmitted to factory control devices, and severe This may damage the factory controls.

A security system such as an intrusion detection system for protecting factory control devices from such cyber attacks has been proposed. A general intrusion detection system is designed to distinguish whether the control data input to the factory control device is normal control data or abnormal control data by determining whether the control data is in violation of a predetermined security rule.

However, in the general intrusion detection system as described above, it is not easy to actively respond to changes in abnormal control data because the security rules are set in advance at the time of system construction, so it is difficult to accurately detect abnormal control data of a newly generated attack type. There is a problem that there is no

In addition, in the general intrusion detection system as described above, since the security rules are predetermined at the time of system construction, the system administrator must create a new security rule whenever the applicable factory control device is changed, so system construction and maintenance costs are reduced. There is a problem with increasing.

The present invention is to solve the above-described problem, and it is a technical feature to provide an abnormal control data detection system capable of generating abnormal control data for data having a correlation.

In addition, the present invention has a technical feature to provide an abnormal control data detection system capable of generating abnormal control data out of the normal control data range.

In addition, the present invention provides an abnormal control data detection system capable of determining a security rule for more accurately detecting abnormal data by learning a security rule using control data including the generated abnormal control data. do.

A system for detecting abnormal control data according to an embodiment of the present invention includes: a data parsing unit configured to parse control data transmitted from a control terminal to obtain a command of the control data and at least one value of the command; A security rule generator for generating a normal control data security rule to which a command and an abnormal control data discrimination model are mapped; decorrelation multidimensional control data that is out of correlation between the control data and outliers outside the normal control data range of the control data (outlier) Abnormal control data generation unit for generating control data; Abnormal data determination unit for determining whether the target control data is abnormal by comparing the target control data received from the control terminal with the normal control data security rule; includes; and the security rule generation unit validates the abnormal control data identification model using the decorrelation multidimensional control data and the outlier control data to determine the learning end time of the abnormal control data identification model. do.

According to an embodiment of the present invention, abnormal control data for various situations can be more accurately detected by generating abnormal control data for correlated control data and abnormal control data outside the range of normal control data.

In addition, according to an embodiment of the present invention, it is possible to quickly verify the security rule by generating multidimensional abnormal control data for the correlated control data.

In addition, according to an embodiment of the present invention, it is possible to generate a security rule capable of more accurately detecting abnormal control data with respect to input control data by learning a security rule using control data including abnormal control data.

1 is a diagram schematically showing a network configuration to which an abnormal control data detection system according to an embodiment of the present invention is applied.
FIG. 2 is a block diagram schematically showing the configuration of the gateway shown in FIG. 1 .
FIG. 3 is a block diagram schematically showing the configuration of the detection server shown in FIG. 1 .
4A is a diagram illustrating a network part of control data according to an embodiment of the present invention.
4B is a diagram illustrating a data part of control data according to an embodiment of the present invention.
FIG. 5 is a block diagram schematically illustrating an abnormal control data generator shown in FIG. 3 .
6 is a flowchart of a method for generating abnormal control data according to an embodiment of the present invention.
FIG. 7 is a flowchart of the method for generating outlier control data shown in FIG. 6 .
8A is a graph illustrating a result of a stepwise value distribution of control data by an algorithm for generating minimum outlier control data and maximum outlier control data.
8B is a graph showing a result of a step-by-step value distribution of control data by an intermediate outlier control data generation algorithm.
9 is a flowchart of a method for generating decorrelation multidimensional control data according to an embodiment of the present invention.
10 is a graph illustrating a value distribution for first to third control data.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The meaning of the terms described herein should be understood as follows.

The singular expression is to be understood as including the plural expression unless the context clearly defines otherwise, and the terms "first", "second", etc. are used to distinguish one element from another, The scope of rights should not be limited by these terms.

It should be understood that terms such as “comprise” or “have” do not preclude the possibility of addition or existence of one or more other features or numbers, steps, operations, components, parts, or combinations thereof.

The term “at least one” should be understood to include all possible combinations from one or more related items. For example, the meaning of “at least one of the first, second, and third items” means each of the first, second, or third items as well as two of the second, second and third items. It means a combination of all items that can be presented from more than one.

1 is a diagram schematically showing a network configuration to which an abnormal control data detection system according to an embodiment of the present invention is applied.

The control terminal 100 shown in FIG. 1 controls the factory control device 110 and serves to collect operation data generated by the factory control device 110 . The control terminal 100 according to an embodiment of the present invention may include a supervisory control and data acquisition (SCADA) or a human machine interface (HMI).

The factory control device 110 controls the facilities disposed at the operation site based on the control data transmitted from the control terminal 100 , and transmits the facility control result or operation data obtained from each facility to the control terminal 100 . perform the role The factory control device 110 may include a programmable logic controller (PLC).

The abnormal control data detection system 120 connects the control terminal 100 and the factory control device 110 . Specifically, the abnormal control data detection system 120 transmits the control data generated by the control terminal 100 to the factory control device 110 , and transmits the operation data generated by the factory control device 110 to the control terminal 100 . ) to pass

FIG. 2 is a block diagram schematically showing the configuration of the gateway shown in FIG. 1 . As shown in FIG. 2 , the security gateway 130 includes a data blocking unit 210 , a data mirroring unit 220 , and a bypass unit 230 .

When control data is received from the control terminal 110 , the data blocking unit 210 determines whether an IP address (Internet Protocol Address) of the received control data corresponds to a pre-registered IP address. As a result of the determination, if the IP address of the received control data does not correspond to the pre-registered IP address, the data blocking unit 210 determines that the control data is abnormal control data received through an abnormal path, and the corresponding control data is returned to the factory. It is possible to block transmission to the control device 110 .

The data blocking unit 210 may determine whether the IP address of the control data received from the control terminal 110 corresponds to a pre-registered IP address based on the normal path list generated by the detection server 140 . . In this case, normal IP addresses may be registered in the normal path list.

The data blocking unit 210 may notify the user of the blocking result when the control data is blocked.

The data mirroring unit 220 transmits control data from the control terminal 100 to the factory control device 110 . At this time, the data mirroring unit 220 transmits the duplicated control data to the detection server 140 by replicating the control data without network delay. The detection server 140 can detect the abnormal control data by acquiring the control data through the replication function of the data mirroring unit 220 .

The bypass unit 230 adjusts the transmission path of the control data according to whether an error occurs in the security gateway 140 . Specifically, the bypass unit 230 transmits control data to the factory control device 110 through the data mirroring unit 220 when no error occurs in the security gateway 130 .

However, when an error occurs in the gateway 130 , the bypass unit 230 bypasses the data mirroring unit 220 and directly transmits the control data to the factory control device 110 . In this case, the copy function of the control data is not performed.

The detection server 140 generates a normal control data security rule based on the first control data collected among the control data, and compares the target control data with the normal control data security rule when the target control data to be determined is received. It is determined whether the target control data is abnormal control data.

Hereinafter, the configuration of the detection server 140 according to the present invention will be described in detail with reference to FIGS. 3 to 6 .

FIG. 3 is a block diagram schematically showing the configuration of the detection server shown in FIG. 1 .

The detection server 140 according to an embodiment of the present invention includes a data collection unit 310, a data parsing unit 320, a security rule generation unit 330, an abnormal control data generation unit 340, and an abnormal control data determination unit. 350 , a monitoring unit 360 , and a database 370 .

The data collection unit 310 extracts and collects at least some of the control data received through the data mirroring unit 220 in order to generate a normal control data security rule. In this case, it may be assumed that the control data received through the data mirroring unit 220 during the operation period of the control terminal 100 and the factory control device 110 are normal control data, and accordingly, the data collection unit 310 is Among the control data, the control data received through the data mirroring unit 220 may be collected during the operation period of the control terminal 100 and the factory control device 110 .

4A is a diagram showing a network part of control data according to an embodiment of the present invention, and FIG. 4B is a diagram showing a data part of control data according to an embodiment of the present invention.

The data parsing unit 320 parses the control data collected by the data collection unit 310 to obtain a command and a value for the corresponding command to extract the first control data.

As shown in FIGS. 4A and 4B , the control data collected by the data collection unit 310 includes a network part and a data part.

The network part includes control device information and transmission/reception destination information.

The control device information includes SysInfo (System Information), PType (ProtoType), and Name. In this case, SysInfo (System Information) means controller protocol information, PType (ProtoType) means controller protocol type information, and Name means controller model information.

The sending and receiving destination information includes SMac (Source Mac Address), Sport (Source Port), SIP (Source Internet Protocol), and includes DMac (Destination Mac Address), DIP (Destination Internet Protocol), and DPort (Destination Port), It may further include a VID (Vlan ID) that is network information. At this time, SMac (Source Mac Address) means the MAC address that transmitted the control data, Sport (Source Port) means the port that transmitted the control data, and SIP (Source Internet Protocol) is the IP address that transmitted the control data. DMac (Destination Mac Address) means a MAC address to receive control data, DIP (Destination Internet Protocol) means an IP address to receive control data, and DPort (Destination Port) means to receive control data. It means a port to be used, and VID (Vlan ID) is network information and may refer to identification information used to distinguish between virtual networks when virtual networks are separated.

The data part includes Fun(Function), Value and Addr(Address). In this case, Fun (Function) means information on the operating state of the control device, Addr means information including a command and the number of data (Order) for the command, and Value means information about the command. data values.

The data parsing unit 320 according to an embodiment of the present invention parses the collected control data to obtain a command (TT001), the number of data for the command (24EA), and values of each data (0ADA090B00002C63DB800020AD70003000F000F00??) in the data part. The first control data is obtained by extraction. For example, the data parsing unit 320 may obtain the temperature-related first control data by extracting a temperature increase (Add), which is a command, and a temperature value to be increased, which is a value.

In another embodiment of the present invention, the data collection unit 310 is omitted, and the data parsing unit 320 is copied by the data mirroring unit 220 and controls at least a part of the control data stored in the database 370 . Data can be directly extracted and parsed.

The security rule generator 330 generates a normal control data security rule by learning the command obtained by the data parsing unit 320 and the value of the command using a machine learning technique.

The security rule generator 330 may set one command and one data set to which an abnormal control data determination model corresponding to the command is mapped as one normal control data security rule.

The security rule generator 330 may list the generated abnormal control data determination model and store it in the database 370 . This will be described later in detail with reference to FIGS. 5 to 8 .

According to an embodiment of the present invention, the security rule generating unit 330 learns abnormal control using control data stored in the database 370 and abnormal control data generated by the abnormal control data generating unit 340 to be described later. Validate the data discrimination model. That is, it is possible to evaluate the performance of the abnormal control data discrimination model learned through the control data using the abnormal control data and determine the learning end time of the abnormal control data discrimination model. Specifically, the security rule generator 330 inputs the decorrelation multidimensional control data and the outlier control data to the abnormal control data identification model to calculate the accuracy of the abnormal control data identification model, and sets the calculated accuracy with the predetermined reference accuracy range. By comparison, the learning end point of the abnormal control data discrimination model is determined.

FIG. 5 is a block diagram of the abnormal control data generator shown in FIG. 3 . Referring to FIG. 5 , the abnormal control data generating unit 340 will be described in detail.

Referring to FIG. 5 , the abnormal control data generator 340 includes a data preprocessor 341 , an outlier control data generator 342a , and a decorrelation multidimensional control data generator 342b .

The data preprocessor 341 preprocesses the control data to generate abnormal control data. That is, the data preprocessor 341 removes noise from the control data and calculates statistical information about the control data from which the noise has been removed.

The data preprocessor 341 may remove noise from the control data. Specifically, the data preprocessor 341 may determine a value having a distribution different from that of most control data values and having a very low frequency of occurrence as noise. Alternatively, the data preprocessor 341 may determine a specific value as noise.

The data preprocessor 341 may calculate a minimum value (Min), a maximum value (Max), an average (Mean), and a standard deviation of the control data from which the noise has been removed. The calculated statistical information of the control data may be transmitted to the outlier control data generator 342a and the decorrelation multidimensional control data generator 342b.

Also, the data preprocessor 341 may randomly extract at least a portion of the control data from which the noise has been removed. For example, the data pre-processing unit 341 may extract 10% or more and 30% or less of the control data and transmit it to the outlier control data generation unit 342a and the decorrelation multidimensional control data generation unit 342b. Accordingly, since the abnormal control data is generated using some of the control data, the time required to generate the abnormal control data may be reduced.

According to an embodiment of the present invention, the outlier control data generation unit 342a generates outlier control data that is out of the normal control data range of the control data. Specifically, the outlier control data generation unit 342a generates a normal control data range by applying a Gaussian kernel density estimation to the control data, and the minimum outlier control data smaller than the minimum value of the normal control data range, the normal The maximum outlier control data greater than the maximum value of the control data range and intermediate outlier control data between the normal control data are generated. In this case, the outlier control data generation unit 342a may generate outlier control data by using some of the control data. For example, the outlier control data generator 342a may generate outlier control data using 50% of control data among the control data. A method of generating the outlier control data will be described later in detail with reference to FIGS. 7 to 8B .

According to an embodiment of the present invention, the decorrelation multidimensional control data generator 342b generates decorrelation multidimensional control data out of correlation between control data. Specifically, the decorrelation multidimensional control data generation unit 342b calculates a correlation coefficient using a correlation matrix for the control data, analyzes the correlation between the control data, and determines the absolute value of the correlation coefficient equal to or greater than a predetermined critical correlation coefficient. Control data having a value is extracted. For example, the critical correlation coefficient may be 0.7. The decorrelated multidimensional control data generating unit 342b generates a correlated multidimensional control data pattern by using the extracted control data. Also, the decorrelation multidimensional control data generator 342b calculates each control data range and combines all values within the calculated control data range to generate preliminary decorrelation multidimensional control data patterns. The decorrelation multidimensional control data, which is control data out of correlation, is generated by removing a combination of correlated control data among all combinations of control data. That is, by removing a pattern matching the correlated multidimensional control data from among the preliminary decorrelated multidimensional control data patterns, the decorrelated multidimensional control data is generated. In this case, the decorrelation multidimensional control data generator 342b may generate decorrelation multidimensional control data by using some of the control data. For example, the outlier control data generator 342a may generate decorrelation multidimensional control data using 50% of control data among the control data. A method of generating decorrelation multidimensional control data will be described later in detail with reference to FIGS. 9 to 10 .

Referring back to FIG. 3 , the abnormal control data determination unit 350 determines whether the target control data is abnormal control data by applying the target control data to be determined to the abnormal control data determination model of the normal control data security rule. . Specifically, the abnormal control data determination unit 350 applies the normal control data security rule, which is a data set of the abnormal control data determination model corresponding to the command of the target control data and the command of the target control data, to the target control data to obtain the target control data. It is determined whether there is abnormal control data of It is determined whether the corresponding target control data corresponds to the normal control data ranges based on the command and the value of the target control data among the normal control data ranges stored in the database 370 . In this case, the target control data is transmitted to the data parsing unit 320 through the data mirroring unit 220 .

Meanwhile, when it is determined that the target control data is the abnormal control data, the abnormal control data determining unit 350 notifies the user of the determination result.

The monitoring unit 360 detects whether the data collection unit 310 , the data parsing unit 320 , the security rule generation unit 330 , the abnormal control data determination unit 350 , and the database 370 are operating normally. and, if it is operating abnormally, the corresponding part or the entire detection server 140 is terminated and operated again.

The database 370 stores the normal control data range generated by the security rule generator 330 . As described above, the normal control data security rules may be stored in the database 370 in the form of a list. Also, a command obtained from control data and a value range of the corresponding command may be mapped and stored in the database 370 .

6 is a flowchart of a method for generating abnormal control data according to an embodiment of the present invention. A method for generating abnormal control data according to an embodiment of the present invention will be described in detail with reference to FIG. 6 .

Referring to FIG. 6 , first, control data stored in the database 370 is loaded ( S610 ). In this case, the loaded control data may be in the form of commands and values parsed. Alternatively, the loaded control data may be parsed into commands and values by the data parsing unit 320 .

Thereafter, the noise of the control data is removed (S620). At this time, a value having a distribution different from that of most of the control data and having a very low frequency of occurrence is determined as noise, and the corresponding value can be removed from the control data. Alternatively, a specific value may be determined as noise and the corresponding value may be removed from the control data.

Thereafter, statistical information about the control data from which the noise is removed is calculated (S630). Specifically, it is possible to calculate the minimum value, the maximum value, the average, and the standard deviation for the control data from which the noise has been removed. The calculated statistical information may be transmitted to the outlier control data generator 342a and the decorrelation multidimensional control data generator 342b.

Thereafter, outlier control data is generated through the control data (S641) and decorrelation multidimensional control data is generated (S642). A method of generating the outlier control data will be described later in detail with reference to FIGS. 7 to 8B , and a method of generating decorrelation multidimensional control data will be described in detail later with reference to FIGS. 9 to 10 .

Thereafter, the generated abnormal control data is transmitted to the security rule generator 330 (S650). Accordingly, abnormal control data can be used to create a security rule.

FIG. 7 is a flowchart of the method for generating outlier control data shown in FIG. 6 . 8A is a graph showing the stepwise value distribution result of the control data by the method for generating the minimum outlier control data and the maximum outlier control data, and FIG. 8B is a graph showing the result of the stepwise value distribution of the control data by the intermediate outlier control data generation method. .

First, a normal control data range is generated by applying a Gaussian kernel density estimation to the control data (S701). Specifically, as shown in FIGS. 8A and 8B , a normal control data range is generated by applying a Gaussian kernel density estimation to the value of the control data. In this case, a threshold of the frequency of value generation may be set, for example, the threshold value of the frequency of value generation may be set to 1.0. Accordingly, only values having a frequency of occurrence greater than or equal to the threshold are included in the normal control data range. Also, as shown in FIG. 8A , after noise of control data is removed, Gaussian kernel density estimation may be applied.

Although not shown, outlier control data may be generated by extracting control data of 50% of the control data input from the data preprocessing unit 341 to the outlier control data generating unit 342a.

Thereafter, the minimum outlier control data, the maximum outlier control data, and the intermediate outlier control data are generated using the generated normal control data range ( S702 ).

The minimum outlier control data OCD1 is calculated through the minimum normal control data Min that is the minimum value of the normal control data range and the average of the normal control data range Mean. When there is one normal control data range, the outlier control data generation unit 342a generates the minimum outlier control data through the minimum normal control data (Min), which is the minimum value of one normal control data range, and the average (Mean) of the normal control data range. (OCD1) can be calculated. Alternatively, when there are a plurality of normal control data ranges, the minimum outlier control data OCD1 is the minimum value of the normal control data range having the smallest value among the plurality of normal control data ranges. The minimum normal control data Min and the normal control data range. It can be calculated through the mean of

Specifically, the minimum outlier control data OCD1 may be calculated according to [Equation 1].

[Equation 1]

In this case, Min is the minimum value of the normal control data range, Mean is the average of the normal control data range, and r is 0.3 or more and 1.0 or less.

The maximum outlier control data OCD2 is calculated through the normal control maximum data Max that is the maximum value of the normal control data range and the average of the normal control data range Mean. When there is one normal control data range, the maximum outlier control data OCD2 may be calculated through the maximum normal control data Max, which is the maximum value of one normal control data range, and the average of the normal control data ranges. . Alternatively, when there are a plurality of normal control data ranges, the maximum outlier control data OCD2 is the maximum value of the normal control data range having the largest value among the plurality of normal control data ranges, the normal control maximum data Max and the normal control data. It can be calculated through the mean of the range.

Specifically, the maximum outlier control data OCD2 may be calculated according to [Equation 2].

[Equation 2]

In this case, Max is the maximum value of the normal control data range, Mean is the average of the normal control data range, and r is 0.3 or more and 1.0 or less.

In addition, as shown in FIG. 8B , when there are a plurality of normal control data ranges, the intermediate outlier control data OCD3 between different normal control data ranges may be calculated. Specifically, the normal control data range may include an nth normal control data range and an (n+1)th normal control data range, and the intermediate outlier control data OCD3 is the nth normal control data range having a smaller value. It can be calculated through the maximum value (B, Max _nth ) of and the minimum value (C, Min _(n+1)th ) of the (n+1)th normal control data range having a larger value.

Specifically, the intermediate outlier control data OCD3 may be calculated according to [Equation 3].

[Equation 3]

In this case, Max _nth is the maximum value of the nth normal control data range,

Min _(n+1)th is the minimum value of the n+1th normal control data range.

Thereafter, the minimum outlier control data, the maximum intermediate value control data, and the intermediate outlier control data are integrated into the outlier control data (S703). Accordingly, it is possible to learn and verify the abnormal control data discrimination model of the normal control data security rule using the outlier control data.

9 is a flowchart of an algorithm for generating multidimensional abnormal control data according to an embodiment of the present invention. 10 is a graph illustrating a value distribution for first to third control data.

First, correlations with respect to the input control data are analyzed (S910). Specifically, a correlation coefficient between the control data is calculated using a correlation matrix for the control data, and the correlation between the control data is analyzed. Each correlation coefficient has a larger absolute value as the correlation between the control data increases. For example, if the correlation between the control data of each graph shown in FIG. 10 is analyzed, the control data shown in the first graph and the control data shown in the third graph are the control data shown in the first graph and the control data shown in the second graph. It may have a greater correlation than the illustrated control data. That is, the correlation coefficient between the control data shown in the first graph and the control data shown in the third graph may have an absolute value greater than the correlation coefficient between the control data shown in the first graph and the control data shown in the second graph.

Thereafter, the decorrelation multidimensional control data generator 342b extracts control data having a high correlation by using the calculated correlation coefficient ( S920 ). Specifically, control data having an absolute value greater than or equal to the critical correlation coefficient is extracted. In this case, the critical correlation coefficient may be 0.7. When decorrelation multidimensional control data is generated for control data whose absolute value of the correlation coefficient is 0.4 or more and less than 0.7, these control data do not have a high correlation, so the control is not suitable for verifying the abnormal control data discrimination model. is data. Accordingly, control data having a high correlation in which the absolute value of the correlation coefficient is greater than or equal to the critical correlation coefficient is extracted. At this time, when there are four or more extracted control data, the complexity between the corresponding control data increases and the time required to calculate the decorrelated multidimensional control data increases. In order to efficiently calculate the decorrelated multidimensional control data, It is possible to extract three or less control data among the control data. For example, the control data of the first graph and the control data of the third graph having a high correlation among the control data of each graph shown in FIG. 10 may be extracted.

Thereafter, a correlated multidimensional control data pattern is generated using the extracted control data (S931). The correlated multidimensional control data pattern is multidimensional and includes values of normal control data stored in the database 370 .

In addition, a control data range of each of the extracted control data is calculated, and a preliminary decorrelation multidimensional control data pattern is generated using the calculated control data ranges ( S932 ). Specifically, a control data range of each of the extracted control data is calculated, and values within the calculated control data range are combined to generate preliminary decorrelation multidimensional control data patterns that are all possible patterns within the control data range.

Thereafter, decorrelation multidimensional control data is generated using the correlated multidimensional control data patterns and the preliminary decorrelation multidimensional control data patterns ( S950 ). Specifically, the decorrelated multidimensional control data is generated by removing the same pattern as the correlated multidimensional control data patterns from the preliminary decorrelated multidimensional control data pattern. That is, decorrelation multidimensional control data that deviates from correlation by removing the same pattern as the correlated multidimensional control data patterns indicating the correlation between control data from the preliminary decorrelation multidimensional control data pattern of all combinations of values of the extracted control data. create For example, as shown in FIG. 10 , the extracted control data may include first control data corresponding to one command and second control data corresponding to another command. The first control data of the first graph may have values of A, B, and C, and the second control data of the second graph is (D,E). It can have values of (F,G) and (H,I). At this time, the preliminary decorrelation multidimensional control data patterns are A-(D,E), A-(F,G), A-(H,I), B-(D,E), B-(F,G), It may be a multidimensional control data pattern including values of B-(H,I), C-(D,E), C-(F,G), and C-(H,I), and the correlated multidimensional data pattern is A -(D,E), A-(F,G), B-(F,G), B-(H,I), C-(D,E), C-(F,G), C-( It may be a multidimensional control data pattern including a value of H,I). Accordingly, the multidimensional data pattern identical to the correlated multidimensional data pattern is removed from the preliminary inverse dimensional multidimensional control data patterns to obtain decorrelated multidimensional control data including the values of A-(H,I) and B-(D,E). can create

According to an embodiment of the present invention, since the decorrelation control data is generated as multidimensional data, it is possible to detect abnormal data based on the correlation between the control data. In particular, since the decorrelation control data is multidimensional data based on the correlation between some of the control data, it does not take time to change the dimension, and abnormal control data detection for the entire control data is possible.

Those skilled in the art to which the present invention pertains will understand that the above-described present invention may be embodied in other specific forms without changing the technical spirit or essential characteristics thereof.

Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive. The scope of the present invention is indicated by the following claims rather than the above detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts should be interpreted as being included in the scope of the present invention. do.

All disclosed methods and procedures described herein may be implemented, at least in part, using one or more computer programs or components. These components may be configured as a series of series via any conventional computer-readable medium or machine-readable medium including volatile and non-volatile memory such as RAM, ROM, flash memory, magnetic or optical disks, optical memory, or other storage media. They may be provided as computer instructions. The instructions may be provided as software or firmware, and may be implemented, in whole or in part, in a hardware configuration such as ASICs, FPGAs, DSPs, or any other similar device. The instructions may be configured to be executed by one or more processors or other hardware components, which when executing the series of computer instructions perform all or part of the methods and procedures disclosed herein or make it possible to perform

100: control terminal 110: factory control device
120: Abnormal control data detection system
130: security gateway 140: detection server

Claims (15)

a data parsing unit that parses the control data transmitted from the control terminal to obtain a command of the control data and at least one value of the command;
a security rule generator generating a normal control data security rule in which the command and the abnormal control data determination model are mapped;
an abnormal control data generation unit for generating decorrelated multidimensional control data deviating from the correlation between the control data and outlier control data deviating from the normal control data range of the control data;
An abnormal data determination unit for determining whether the target control data is abnormal by comparing the target control data received from the control terminal with the normal control data security rule; and
The security rule generating unit,
Validating the abnormal control data discrimination model using the decorrelation multidimensional control data and the outlier control data to determine a learning end time of the abnormal control data discrimination model,
The abnormal control data generation unit,
and generating a minimum outlier control data smaller than a minimum value of the normal control data range and a maximum outlier control data larger than a maximum value of the normal control data range. According to claim 1,
The abnormal control data generation unit,
Abnormal control data detection system, characterized in that generating the normal control data range based on the value. 3. The method of claim 2,
The abnormal control data generation unit,
Generating a normal control data range by applying a Gaussian kernel density estimation to the value,
[Equation 1]

generates the minimum outlier control data according to OCD1, where OCD1 is the minimum outlier control data, Min is the minimum value of the normal control data range, Mean is the average of the normal control data range, and r is a value of 0.3 or more and 1.0 or less,
[Equation 2]

generates the maximum outlier control data according to OCD2, where OCD2 is the maximum outlier control data, Max is the maximum value of the normal control data range, Mean is the average of the normal control data range, and r is a value greater than or equal to 0.3 and less than or equal to 1.0. Control data detection system. According to claim 1,
The abnormal control data generation unit,
Normal control data range including an nth (n is a positive integer) normal control data range and a (n+1)th normal control data range that are distinguished from each other by applying a Gaussian Kernel Density estimation to the value create,
and generating outlier control data including intermediate outlier control data that is greater than a maximum value of the nth normal control data range and smaller than a minimum value of the (n+1)th normal control data range. 5. The method of claim 4,
The intermediate outlier control data is
[Equation 3]

OCD3 is the intermediate outlier control data, Max _nth is the maximum value of the nth normal control data range, and Min _(n+1)th is the minimum value of the n+1th normal control data range. data detection system. According to claim 1,
The abnormal control data generation unit,
Analyze the correlation between the control data to extract at least a portion of the control data in which the absolute value of the correlation coefficient is greater than or equal to a predetermined critical correlation coefficient,
Each of the value ranges of the extracted control data is calculated to generate preliminary decorrelation multidimensional control data patterns that are all possible patterns within the control data range,
By combining the extracted control data to generate correlated multidimensional control data patterns, which are patterns of control data having a correlation,
and generating decorrelated multidimensional control data by removing a pattern matching the correlated multidimensional control data from among the preliminary decorrelated multidimensional control data patterns. According to claim 1,
The abnormal control data generation unit,
Extracting at least a portion of the control data in which the absolute value of the correlation coefficient is equal to or greater than a predetermined critical correlation coefficient by calculating a correlation coefficient between the control data using a correlation matrix for the control data,
Each of the value ranges of the extracted control data is calculated to generate preliminary decorrelation multidimensional control data patterns that are all possible patterns within the control data range,
By combining the extracted control data to generate correlated multidimensional control data patterns, which are patterns of control data having a correlation,
and generating decorrelated multidimensional control data by removing a pattern matching the correlated multidimensional control data from among the preliminary decorrelated multidimensional control data patterns. According to claim 1,
The security rule generating unit,
By using the decorrelation multidimensional control data and the outlier control data to validate the abnormal control data identification model, the accuracy of the abnormal control data identification model is calculated, and the accuracy of the calculated abnormal control data identification model is determined in advance. Abnormal control data detection system, characterized in that when the value is within a predetermined reference accuracy range, learning of the verified abnormal control data discrimination model is terminated and stored in a database. parsing the target control data transmitted from the control terminal to obtain a command of the target control data and at least one value of the command;
generating abnormal control data including outlier control data and decorrelation multidimensional control data using control data stored in a database;
generating a normal control data security rule to which an abnormal control data determination model is mapped; and
Determining whether the target control data transmitted from the control terminal is abnormal control data using the normal control data security rule;
The step of generating the normal control data security rule comprises:
learning an abnormal control data identification model using the control data, and verifying the abnormal control data identification model using the abnormal control data to determine a learning end time of the abnormal control data identification model;
In the step of generating the abnormal control data, a correlation multidimensional control data pattern generated by combining control data having an absolute value of a correlation coefficient equal to or greater than a predetermined critical correlation coefficient among preliminary decorrelation multidimensional control data patterns that is a pattern of all possible control data is removed. Abnormal control data detection method, characterized in that to generate decorrelated multidimensional control data. 10. The method of claim 9,
The generating of the abnormal control data comprises:
analyzing the correlation with respect to the control data;
extracting control data in which an absolute value of a correlation coefficient from the control data is equal to or greater than a predetermined critical correlation coefficient;
generating a correlated multidimensional control data pattern by combining the extracted control data;
generating a preliminary decorrelation multidimensional control data pattern that is a pattern of all possible control data by calculating a control data range of the extracted control data and combining data within the calculated control data range; and
and generating decorrelated multidimensional control data by removing a pattern matching the correlated multidimensional control data pattern from the preliminary decorrelated multidimensional control data pattern. 11. The method of claim 10,
The step of analyzing the correlation with respect to the control data,
Abnormal control data detection method, characterized in that by calculating a correlation coefficient between the control data by using a correlation matrix for the control data, the control data having an absolute value of the correlation coefficient equal to or greater than a predetermined critical correlation coefficient is extracted. . 11. The method of claim 10,
The generating of the abnormal control data comprises:
generating a normal control data range of the control data;
generating minimum outlier control data and generating maximum outlier control data; and
and generating intermediate outlier control data that is data between the normal control data ranges when there are a plurality of normal control data ranges. 10. The method of claim 9,
The generating of the abnormal control data comprises:
generating a normal control data range by applying Gaussian kernel density estimation to the control data;
generating minimum outlier control data smaller than the minimum value of the normal control data range and generating maximum outlier control data larger than the maximum value of the normal control data range; and
and generating intermediate outlier control data that is outlier control data between the normal control data ranges when the number of the normal control data ranges is plural. 14. The method of claim 13,
generating the minimum outlier control data smaller than the minimum value of the normal control data range and generating the maximum outlier control data larger than the maximum value of the normal control data range;
[Equation 1]

generates the minimum outlier control data according to OCD1, where OCD1 is the minimum outlier control data, Min is the minimum value of the normal control data range, Mean is the average of the normal control data range, and r is a value of 0.3 or more and 1.0 or less,
[Equation 2]

generates the maximum outlier control data according to OCD2, where OCD2 is the maximum outlier control data, Max is the maximum value of the normal control data range, Mean is the average of the normal control data range, and r is a value greater than or equal to 0.3 and less than or equal to 1.0. Control data detection method. 14. The method of claim 13,
When there are a plurality of normal control data ranges, generating intermediate outlier control data that is outlier control data between the normal control data ranges includes:
The normal control data range includes an nth (n is a positive integer) normal control data range and a (n+1)th normal control data range that are distinguished from each other,
The intermediate outlier control data is
[Equation 3]

OCD3 is the intermediate outlier control data, Max _nth is the maximum value of the nth normal control data range, and Min _(n+1)th is the minimum value of the n+1th normal control data range. Data detection methods.

Images