一种改进概率神经网络的工业控制系统安全态势评估方法

doi:10.3969/j.issn.1671-1122.2021.03.003

信息网络安全 ›› 2021, Vol. 21 ›› Issue (3): 15-25.doi: 10.3969/j.issn.1671-1122.2021.03.003

一种改进概率神经网络的工业控制系统安全态势评估方法

石乐义¹^,²(), 徐兴华¹, 刘祎豪², 刘佳³

1.中国石油大学（华东）海洋与空间信息学院,青岛266580
2.中国石油大学（华东）计算机科学与技术学院,青岛 266580
3.国家知识产权局专利局专利审查协作天津中心,天津 300304

收稿日期:2020-11-10 出版日期:2021-03-10 发布日期:2021-03-16
通讯作者: 石乐义 E-mail:shileyi@upc.edu.cn
作者简介:石乐义（1975—）,男,山东,教授,博士,主要研究方向为网络安全、博弈论、移动互联网|徐兴华（1997—）,男,山东,硕士研究生,主要研究方向为机器学习、网络安全|刘祎豪（1996—）,男,江西,硕士研究生,主要研究方向为机器学习、网络安全|刘佳（1995—）,女,河北,硕士,主要研究方向为机器学习、网络安全
基金资助:
国家自然科学基金(61772551);山东省自然科学基金(ZR2019MF034)

An Improved Probabilistic Neural Network Method of Security Situation Assessment for Industrial Control System

SHI Leyi¹^,²(), XU Xinghua¹, LIU Yihao², LIU Jia³

1. College of Oceanography and Space Informatics, China University of Petroleum (East China), Qingdao 266580, China
2. College of Computer Science and Technology, China University of Petroleum (East China), Qingdao 266580, China
3. Patent Examination Cooperation (Tianjin) Center of the Patent Office, CNIPA,Tianjin 300304, China

Received:2020-11-10 Online:2021-03-10 Published:2021-03-16
Contact: SHI Leyi E-mail:shileyi@upc.edu.cn

摘要/Abstract

摘要：

工业控制系统是用于工业环境中监视和控制物理设备的互连设备系统,近年来日益遭受层出不穷的各类新型攻击。针对工业控制系统的运行安全问题,文章提出一种改进概率神经网络的工业控制系统安全态势评估方法。该方法首先对收集到的工控数据进行预处理,并利用主成分分析法对数据进行降维;然后使用改进的果蝇优化算法对概率神经网络的参数进行优化,之后通过优化后的概率神经网络进行训练和预测,得到攻击类型的分类结果;最后结合文章中结构化的工控系统安全态势评估方法计算态势值,对系统的状态进行评估。实验表明,改进后的概率神经网络对攻击类型的分类准确率和精确率分别达到87.784%和96.027%,相比原概率神经网络方法,准确率和精确率分别提高了2.654%和4.820%。

关键词: 工业控制系统, 概率神经网络, 态势感知, 态势评估, 主成分分析法

Abstract:

Industrial control system is interconnected equipment system for monitoring and controlling physical equipment in industrial environments. In recent years, industrial control system has been increasingly exposed to a variety of new attacks. Aiming at the operation safety problem of industrial control system, this paper proposes an improved probabilistic neural network method of security situation assessment for industrial control system. Firstly, the method preprocesses the collected industrial control data and uses principal component analysis to reduce the dimension of the data. Then, the improved fruit flew optimization algorithm is used to optimize the parameters of the probabilistic neural network. After that, This paper used the improved probabilistic neural network for training and prediction to obtain the classification results of attack types. Finally, the situation value is calculated based on the structured security situation assessment method of industrial control system in this paper, and the system state is evaluated. Experiments show that the improved probabilistic neural network's classification accuracy and accuracy of attack types reach 87.784% and 96.027%, respectively. Compared with the original probabilistic neural network method, the accuracy and accuracy are increased by 2.654% and 4.820%, respectively.

Key words: industrial control system, probabilistic neural network, situation awareness, situation assessment, principal component analysis

中图分类号:

TP309

石乐义, 徐兴华, 刘祎豪, 刘佳. 一种改进概率神经网络的工业控制系统安全态势评估方法[J]. 信息网络安全, 2021, 21(3): 15-25.

SHI Leyi, XU Xinghua, LIU Yihao, LIU Jia. An Improved Probabilistic Neural Network Method of Security Situation Assessment for Industrial Control System[J]. Netinfo Security, 2021, 21(3): 15-25.

图/表 14

图1

图2

图3

表1

图4

表2

图5

图6

图7

图8

图9

表3

表4

图 10

参考文献 27

[1]	STOFFER K, FALCO J, SCARFONE K. Guide to Industrial Control Systems (ICS) Security[EB/OL]. http://www.gocs.com.de/pages/fachberichte/archive/ 164-sp800_82_r2_draft.pdf, 2014-06-11.
[2]	GALLOWAY B, HANCKE G P. Introduction to Industrial Control Networks[J]. IEEE Communications Surveys & Tutorials, 2012,15(2):860-880.
[3]	SUO Yanfeng, WANG Shaojie, QIN Yu, et al. Summary of Security Technology and Application in Industrial Control System[J]. Computer Science, 2018,45(4):25-33.
	锁延锋, 王少杰, 秦宇, 等. 工业控制系统的安全技术与应用研究综述[J]. 计算机科学, 2018,45(4):25-33.
[4]	BOLZONI D, LESZCZYNA R, WRÓBEL M R. Situational Awareness Network for the Electric Power System: The Architecture and Testing Metrics [C]//IEEE. 2016 Federated Conference on Computer Science and Information Systems(FedCSIS), September 11-14, 2016, Gdansk, Poland. Poland: IEEE, 2016: 743-749.
[5]	QU Zhaoyang, LI Yaling, LI Peng. A Network Security Situation Evaluation Method Based on DS Evidence Theory [C]//IEEE. 2010 the 2nd Environmental Science and Information Application Technology(ESIAT), July 17-18, 2010, Wuhan, China. New York: IEEE, 2010: 496-499.
[6]	MATUSZAK W J, DIPIPPO L, SUN Y L. CyberSAVe: Situational Awareness Visualization for Cyber Security of Smart Grid Systems [C]// ACM. Proceedings of the Tenth Workshop on Visualization for Cyber Security, October 14-16, 2013, Atlanta Georgia, USA. New York: ACM, 2013: 25-32.
[7]	KOTENKO I, NOVIKOVA E. Visualization of Security Metrics for Cyber Situation Awareness [C]//IEEE. 2014 Ninth International Conference on Availability, Reliability and Security(ARES), September 9, 2014, Fribourg, Switzerland. Switzerland: IEEE, 2014: 506-513.
[8]	GARCIA-TEODORO P, DIAZ-VERDEJO J, MACIÁ-FERNÁNDEZ G, et al. Anomaly-based Network Intrusion Detection: Techniques, Systems and Challenges[J]. Computers & Security, 2009,28(1):18-28.
[9]	YANG Jiang, CHENG Haili, LI Shanyu, et al. On Network Security Situation Prediction Based on RBF Neural Network [C]//IEEE. 2017 36th Chinese Control Conference(CCC), July 26-28, 2017, Dalian, China. New York: IEEE, 2017: 4060-4063.
[10]	PAIK I. Situation Awareness Based on Big Data Analysis [C]//IEEE. 2016 International Conference on Machine Learning and Cybernetics(ICMLC), July 10-13, 2016, Jeju, South Korea. New York: IEEE, 2016: 911-916.
[11]	WEI Yu, XU Guobin, CHEN Zhijiang, et al. A Cloud Computing Based Architecture for Cyber Security Situation Awareness [C]//IEEE. 2013 IEEE Conference on Communications and Network Security(CNS), October 14-16, 2013, Washington D. C. , USA. USA: IEEE, 2013: 488-492.
[12]	LEI Si, WANG Zhongbin, LIU Xinhua, et al. Cutting State Diagnosis for Shearer through the Vibration of Rocker Transmission Part with an Improved Probabilistic Neural Network[J]. Sensors, 2016,16(4):479-497.
[13]	WU Xiaopo, YANG Mingshi, MENG Weibo, et al. Specific Emitter Identification for Satellite Communication Using Probabilistic Neural Networks[J]. International Journal of Satellite Communications and Networking, 2019,37(3):283-291.
[14]	LI Fangwei, WANG Sen, ZHU Jiang, et al. Security Situation Element Acquisition of Based on Enhanced Probabilistic Neural Networks[J]. Telecommunication Engineering, 2017,57(1):64-71.
	李方伟, 王森, 朱江, 等. 基于增强型概率神经网络的安全态势要素获取[J]. 电讯技术, 2017,57(1):64-71.
[15]	YANG Hong, YANG Ying. An Improved Probabilistic Neural Network with GA Optimization [C]//IEEE. 2012 Fifth International Conference on Intelligent Computation Technology and Automation, January 12-14, 2012, Zhangjiajie, China. New York: IEEE, 2012: 76-79.
[16]	PORWIK P, DOROZ R, ORCZYK T. Signatures Verification Based on PNN Classifier Optimised by PSO Algorithm[J]. Pattern Recognition, 2016,100(60):998-1014.
[17]	WANG Lin, LV Shengxiang, ZENG Yurong. Literature Survey of Fruit Fly Optimization Algorithm[J]. Control and Decision, 2017,32(7):1153-1162.
	王林, 吕盛祥, 曾宇容. 果蝇优化算法研究综述[J]. 控制与决策, 2017,32(7):1153-1162.
[18]	WU Jun, OTA K, DONG Mianxiong, et al. Big Data Analysis-based Security Situational Awareness for Smart Grid[J]. IEEE Transactions on Big Data, 2018,4(3):408-417.
[19]	CHEN Liang, JIA Mengmeng, YUAN Xiaodong, et al. Construction and Application Research of Active Distribution Network Situation Awareness System [C]//IEEE. 2016 IEEE PES Asia-pacific Power and Energy Engineering Conference(APPEEC), October 25-28, 2016, Xi'an, China. New York: IEEE, 2016: 863-869.
[20]	CHEN Liandong. Research on Power Industry Network Security Situation Awareness[D]. Beijing:North China Electric Power University, 2015.
	陈连栋. 电力行业网络安全态势感知研究[D]. 北京:华北电力大学, 2015.
[21]	LI Zhaorong. Research on Grid Security Situation Assessment and Prediction for Intelligent Dispatching[D]. Beijing:North China Electric Power University, 2017.
	李昭蓉. 面向智能调度的电网安全态势评估与预测研究[D]. 北京:华北电力大学, 2017.
[22]	PAN W T. A New Fruit Fly Optimization Algorithm: Taking the Financial Distress Model as an Example[J]. Knowledge-based Systems, 2012,26(2):69-74.
[23]	Mississippi State University Critical Infrastructure Protection Center. Industrial Control System Cyber Attack Data Set[EB/OL]. https://sites.google.com/a/uah.edu/tommy-morris-uah/ics-data-sets, 2014-04-15.
[24]	HSU J, MUDD D, THORNTON Z. Mississippi State University Project Report-SCADA Anomaly Detection Project Summary[EB/OL]. http://www.ece.uah.edu/~thm0009/icsdatasets/MSU_SCADA_ Final_Report.pdf, 2014-02-17.
[25]	CHEN Weipeng, AO Zhigang, GUO Jie, et al. The Security Assessment of Network Space Situational Awareness System Based on Improved BP Neural Network[J]. Computer Science, 2018,45(11A):335-337, 341.
	陈维鹏, 敖志刚, 郭杰, 等. 基于改进的 BP 神经网络的网络空间态势感知系统安全评估[J]. 计算机科学, 2018,45(11A):335-337,341.
[26]	TANG Yongli, LI Weijie, YU Jinxia, et al. Network Security Situation Based on Improved D-S Evidence Theory[J]. Journal of Nanjing University of Science and Technology, 2015,39(4):405-411.
	汤永利, 李伟杰, 于金霞, 等. 基于改进D-S证据理论的网络安全态势评估方法[J]. 南京理工大学学报, 2015,39(4):405-411.
[27]	YU Qun, LI Hao, QU Yuqing. Security Situational Awareness of Power Grid Based on Deep Learning[J]. Science Technology and Engineering, 2019,19(35):273-278.
	于群, 李浩, 屈玉清. 基于深度学习的电网安全态势感知[J]. 科学技术与工程, 2019,19(35):273-278.

一级指标	二级指标
资产	硬件资产
	软件资产
	信息资产
	其他资产
脆弱性	工业控制系统漏洞
	设备脆弱性
	物理环境脆弱性
	网络脆弱性
稳定性	功角稳定性
	电压稳定性
	频率稳定性
	网络稳定性
威胁	0（攻击类型为:41）
	1（攻击类型为:1~6）
	2（攻击类型为:13~14）
	3（攻击类型为:15~18）
	4（攻击类型为:19~20）
	5（攻击类型为:21~30）
	6（攻击类型为:35~38）
	7（攻击类型为:39~40）
	8（攻击类型为:7~12）
防御措施	高
	中
	低

特征	描述
PA1:VH- PA3:VH	阶段A-C的电压相角
PM1:V- PM3:V	阶段A-C的电压幅度
PA4:IH- PA6:IH	阶段A-C的当前相角
PM4:I- PM6:I	阶段A-C的当前幅度
PA7:VH- PA9:VH	正-负-零电压相角
PM7:V- PM9:V	正-负-零电压幅度
PA10:VH- PA12:VH	正-负-零当前相角
PM10:V- PM12:V	正-负-零当前幅度
F	继电器频率
DF	继电器的频率增量
PA:Z	继电器的外部阻抗
PA:ZH	继电器的外部阻抗角度
S	继电器的状态标志

	PNN	FOA-PNN	PCA-FOA-PNN	PCA-IFOA-PNN
精确率	0.91207	0.96048	0.95986	0.96027
召回率	0.91723	0.96833	0.95227	0.9624
F值	0.9146	0.9644	0.956	0.9613

方法	精确率
改进的BP评估模型	89%
改进的D-S证据理论评估方案	94%
深度神经网络评估模型	96%
PCA-IFOA-PNN	96%

一种改进概率神经网络的工业控制系统安全态势评估方法

An Improved Probabilistic Neural Network Method of Security Situation Assessment for Industrial Control System

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 14

参考文献 27

相关文章 15

编辑推荐

Metrics

本文评价

[1]	杜晔, 王子萌, 黎妹红. 基于优化核极限学习机的工控入侵检测方法[J]. 信息网络安全, 2021, 21(2): 1-9.
[2]	李世斌, 李婧, 唐刚, 李艺. 基于HMM的工业控制系统网络安全状态预测与风险评估方法[J]. 信息网络安全, 2020, 20(9): 57-61.
[3]	余晴, 郑崇辉, 杜晔. 面向云平台虚拟层的安全态势评估关键技术研究[J]. 信息网络安全, 2020, 20(7): 53-59.
[4]	张晓宇, 王华忠. 基于改进Border-SMOTE的不平衡数据工业控制系统入侵检测[J]. 信息网络安全, 2020, 20(7): 70-76.
[5]	赵志岩, 纪小默. 智能化网络安全威胁感知融合模型研究[J]. 信息网络安全, 2020, 20(4): 87-93.
[6]	刘玉岭, 唐云善, 张琦, 李枫. 电力调度自动化软件安全态势评估方法[J]. 信息网络安全, 2019, 19(8): 15-21.
[7]	段詠程, 王雨晴, 李欣, 杨乐. 基于RSAR的随机森林网络安全态势要素提取[J]. 信息网络安全, 2019, 19(7): 75-81.
[8]	尚文利, 尹隆, 刘贤达, 赵剑明. 工业控制系统安全可信环境构建技术及应用[J]. 信息网络安全, 2019, 19(6): 1-10.
[9]	尚文利, 张修乐, 刘贤达, 尹隆. 工控网络局域可信计算环境构建方法与验证[J]. 信息网络安全, 2019, 19(4): 1-10.
[10]	徐国天, 张铭. 网络安全态势感知中Trie树关键词高速匹配算法研究[J]. 信息网络安全, 2019, 19(4): 55-62.
[11]	陈瑞滢, 陈泽茂, 王浩. 工业控制系统安全监控协议的设计与优化研究[J]. 信息网络安全, 2019, 19(2): 60-69.
[12]	吕宗平, 丁磊, 隋翯, 顾兆军. 基于时间自动机的工业控制系统网络安全风险分析[J]. 信息网络安全, 2019, 19(11): 71-81.
[13]	陶源, 黄涛, 张墨涵, 黎水林. 网络安全态势感知关键技术研究及发展趋势分析[J]. 信息网络安全, 2018, 18(8): 79-85.
[14]	耿欣. 烟草企业工业控制系统安全保障体系研究[J]. 信息网络安全, 2017, 17(9): 34-37.
[15]	戚犇, 王梦迪. 基于信息增益的贝叶斯态势要素提取[J]. 信息网络安全, 2017, 17(9): 54-57.