An Improved Probabilistic Neural Network Method of Security Situation Assessment for Industrial Control System

doi:10.3969/j.issn.1671-1122.2021.03.003

Abstract

Abstract:

Industrial control system is interconnected equipment system for monitoring and controlling physical equipment in industrial environments. In recent years, industrial control system has been increasingly exposed to a variety of new attacks. Aiming at the operation safety problem of industrial control system, this paper proposes an improved probabilistic neural network method of security situation assessment for industrial control system. Firstly, the method preprocesses the collected industrial control data and uses principal component analysis to reduce the dimension of the data. Then, the improved fruit flew optimization algorithm is used to optimize the parameters of the probabilistic neural network. After that, This paper used the improved probabilistic neural network for training and prediction to obtain the classification results of attack types. Finally, the situation value is calculated based on the structured security situation assessment method of industrial control system in this paper, and the system state is evaluated. Experiments show that the improved probabilistic neural network's classification accuracy and accuracy of attack types reach 87.784% and 96.027%, respectively. Compared with the original probabilistic neural network method, the accuracy and accuracy are increased by 2.654% and 4.820%, respectively.

Key words: industrial control system, probabilistic neural network, situation awareness, situation assessment, principal component analysis

CLC Number:

TP309

SHI Leyi, XU Xinghua, LIU Yihao, LIU Jia. An Improved Probabilistic Neural Network Method of Security Situation Assessment for Industrial Control System[J]. Netinfo Security, 2021, 21(3): 15-25.

Figures/Tables 14

References 27

[1]	STOFFER K, FALCO J, SCARFONE K. Guide to Industrial Control Systems (ICS) Security[EB/OL]. http://www.gocs.com.de/pages/fachberichte/archive/ 164-sp800_82_r2_draft.pdf, 2014-06-11.
[2]	GALLOWAY B, HANCKE G P. Introduction to Industrial Control Networks[J]. IEEE Communications Surveys & Tutorials, 2012,15(2):860-880.
[3]	SUO Yanfeng, WANG Shaojie, QIN Yu, et al. Summary of Security Technology and Application in Industrial Control System[J]. Computer Science, 2018,45(4):25-33.
	锁延锋, 王少杰, 秦宇, 等. 工业控制系统的安全技术与应用研究综述[J]. 计算机科学, 2018,45(4):25-33.
[4]	BOLZONI D, LESZCZYNA R, WRÓBEL M R. Situational Awareness Network for the Electric Power System: The Architecture and Testing Metrics [C]//IEEE. 2016 Federated Conference on Computer Science and Information Systems(FedCSIS), September 11-14, 2016, Gdansk, Poland. Poland: IEEE, 2016: 743-749.
[5]	QU Zhaoyang, LI Yaling, LI Peng. A Network Security Situation Evaluation Method Based on DS Evidence Theory [C]//IEEE. 2010 the 2nd Environmental Science and Information Application Technology(ESIAT), July 17-18, 2010, Wuhan, China. New York: IEEE, 2010: 496-499.
[6]	MATUSZAK W J, DIPIPPO L, SUN Y L. CyberSAVe: Situational Awareness Visualization for Cyber Security of Smart Grid Systems [C]// ACM. Proceedings of the Tenth Workshop on Visualization for Cyber Security, October 14-16, 2013, Atlanta Georgia, USA. New York: ACM, 2013: 25-32.
[7]	KOTENKO I, NOVIKOVA E. Visualization of Security Metrics for Cyber Situation Awareness [C]//IEEE. 2014 Ninth International Conference on Availability, Reliability and Security(ARES), September 9, 2014, Fribourg, Switzerland. Switzerland: IEEE, 2014: 506-513.
[8]	GARCIA-TEODORO P, DIAZ-VERDEJO J, MACIÁ-FERNÁNDEZ G, et al. Anomaly-based Network Intrusion Detection: Techniques, Systems and Challenges[J]. Computers & Security, 2009,28(1):18-28.
[9]	YANG Jiang, CHENG Haili, LI Shanyu, et al. On Network Security Situation Prediction Based on RBF Neural Network [C]//IEEE. 2017 36th Chinese Control Conference(CCC), July 26-28, 2017, Dalian, China. New York: IEEE, 2017: 4060-4063.
[10]	PAIK I. Situation Awareness Based on Big Data Analysis [C]//IEEE. 2016 International Conference on Machine Learning and Cybernetics(ICMLC), July 10-13, 2016, Jeju, South Korea. New York: IEEE, 2016: 911-916.
[11]	WEI Yu, XU Guobin, CHEN Zhijiang, et al. A Cloud Computing Based Architecture for Cyber Security Situation Awareness [C]//IEEE. 2013 IEEE Conference on Communications and Network Security(CNS), October 14-16, 2013, Washington D. C. , USA. USA: IEEE, 2013: 488-492.
[12]	LEI Si, WANG Zhongbin, LIU Xinhua, et al. Cutting State Diagnosis for Shearer through the Vibration of Rocker Transmission Part with an Improved Probabilistic Neural Network[J]. Sensors, 2016,16(4):479-497.
[13]	WU Xiaopo, YANG Mingshi, MENG Weibo, et al. Specific Emitter Identification for Satellite Communication Using Probabilistic Neural Networks[J]. International Journal of Satellite Communications and Networking, 2019,37(3):283-291.
[14]	LI Fangwei, WANG Sen, ZHU Jiang, et al. Security Situation Element Acquisition of Based on Enhanced Probabilistic Neural Networks[J]. Telecommunication Engineering, 2017,57(1):64-71.
	李方伟, 王森, 朱江, 等. 基于增强型概率神经网络的安全态势要素获取[J]. 电讯技术, 2017,57(1):64-71.
[15]	YANG Hong, YANG Ying. An Improved Probabilistic Neural Network with GA Optimization [C]//IEEE. 2012 Fifth International Conference on Intelligent Computation Technology and Automation, January 12-14, 2012, Zhangjiajie, China. New York: IEEE, 2012: 76-79.
[16]	PORWIK P, DOROZ R, ORCZYK T. Signatures Verification Based on PNN Classifier Optimised by PSO Algorithm[J]. Pattern Recognition, 2016,100(60):998-1014.
[17]	WANG Lin, LV Shengxiang, ZENG Yurong. Literature Survey of Fruit Fly Optimization Algorithm[J]. Control and Decision, 2017,32(7):1153-1162.
	王林, 吕盛祥, 曾宇容. 果蝇优化算法研究综述[J]. 控制与决策, 2017,32(7):1153-1162.
[18]	WU Jun, OTA K, DONG Mianxiong, et al. Big Data Analysis-based Security Situational Awareness for Smart Grid[J]. IEEE Transactions on Big Data, 2018,4(3):408-417.
[19]	CHEN Liang, JIA Mengmeng, YUAN Xiaodong, et al. Construction and Application Research of Active Distribution Network Situation Awareness System [C]//IEEE. 2016 IEEE PES Asia-pacific Power and Energy Engineering Conference(APPEEC), October 25-28, 2016, Xi'an, China. New York: IEEE, 2016: 863-869.
[20]	CHEN Liandong. Research on Power Industry Network Security Situation Awareness[D]. Beijing:North China Electric Power University, 2015.
	陈连栋. 电力行业网络安全态势感知研究[D]. 北京:华北电力大学, 2015.
[21]	LI Zhaorong. Research on Grid Security Situation Assessment and Prediction for Intelligent Dispatching[D]. Beijing:North China Electric Power University, 2017.
	李昭蓉. 面向智能调度的电网安全态势评估与预测研究[D]. 北京:华北电力大学, 2017.
[22]	PAN W T. A New Fruit Fly Optimization Algorithm: Taking the Financial Distress Model as an Example[J]. Knowledge-based Systems, 2012,26(2):69-74.
[23]	Mississippi State University Critical Infrastructure Protection Center. Industrial Control System Cyber Attack Data Set[EB/OL]. https://sites.google.com/a/uah.edu/tommy-morris-uah/ics-data-sets, 2014-04-15.
[24]	HSU J, MUDD D, THORNTON Z. Mississippi State University Project Report-SCADA Anomaly Detection Project Summary[EB/OL]. http://www.ece.uah.edu/~thm0009/icsdatasets/MSU_SCADA_ Final_Report.pdf, 2014-02-17.
[25]	CHEN Weipeng, AO Zhigang, GUO Jie, et al. The Security Assessment of Network Space Situational Awareness System Based on Improved BP Neural Network[J]. Computer Science, 2018,45(11A):335-337, 341.
	陈维鹏, 敖志刚, 郭杰, 等. 基于改进的 BP 神经网络的网络空间态势感知系统安全评估[J]. 计算机科学, 2018,45(11A):335-337,341.
[26]	TANG Yongli, LI Weijie, YU Jinxia, et al. Network Security Situation Based on Improved D-S Evidence Theory[J]. Journal of Nanjing University of Science and Technology, 2015,39(4):405-411.
	汤永利, 李伟杰, 于金霞, 等. 基于改进D-S证据理论的网络安全态势评估方法[J]. 南京理工大学学报, 2015,39(4):405-411.
[27]	YU Qun, LI Hao, QU Yuqing. Security Situational Awareness of Power Grid Based on Deep Learning[J]. Science Technology and Engineering, 2019,19(35):273-278.
	于群, 李浩, 屈玉清. 基于深度学习的电网安全态势感知[J]. 科学技术与工程, 2019,19(35):273-278.

一级指标	二级指标
资产	硬件资产
	软件资产
	信息资产
	其他资产
脆弱性	工业控制系统漏洞
	设备脆弱性
	物理环境脆弱性
	网络脆弱性
稳定性	功角稳定性
	电压稳定性
	频率稳定性
	网络稳定性
威胁	0（攻击类型为:41）
	1（攻击类型为:1~6）
	2（攻击类型为:13~14）
	3（攻击类型为:15~18）
	4（攻击类型为:19~20）
	5（攻击类型为:21~30）
	6（攻击类型为:35~38）
	7（攻击类型为:39~40）
	8（攻击类型为:7~12）
防御措施	高
	中
	低

特征	描述
PA1:VH- PA3:VH	阶段A-C的电压相角
PM1:V- PM3:V	阶段A-C的电压幅度
PA4:IH- PA6:IH	阶段A-C的当前相角
PM4:I- PM6:I	阶段A-C的当前幅度
PA7:VH- PA9:VH	正-负-零电压相角
PM7:V- PM9:V	正-负-零电压幅度
PA10:VH- PA12:VH	正-负-零当前相角
PM10:V- PM12:V	正-负-零当前幅度
F	继电器频率
DF	继电器的频率增量
PA:Z	继电器的外部阻抗
PA:ZH	继电器的外部阻抗角度
S	继电器的状态标志

	PNN	FOA-PNN	PCA-FOA-PNN	PCA-IFOA-PNN
精确率	0.91207	0.96048	0.95986	0.96027
召回率	0.91723	0.96833	0.95227	0.9624
F值	0.9146	0.9644	0.956	0.9613

方法	精确率
改进的BP评估模型	89%
改进的D-S证据理论评估方案	94%
深度神经网络评估模型	96%
PCA-IFOA-PNN	96%