论文部分内容阅读
为解决病毒、木马攻击工业控制系统应用层网络协议的问题,分析了Modbus/TCP通信协议的规则,提出了一种基于聚类和支持向量机的半监督分簇策略,该策略将无监督的模糊C均值聚类(fuzzy C-means,FCM)和有监督的支持向量机(support vector machine,SVM)相结合,实现了工控异常检测的半监督机器学习.首先提取工业控制系统Modbus/TCP协议的通信流量数据,对其进行数据预处理,然后利用模糊C均值聚类得到聚类中心,计算通信数据与聚类中心的距离,将满足阈值条件的部分数据进一步由遗传算法(genetic algorithm,GA)优化的支持向量机分类.实验结果表明,与传统的入侵检测方法相比,该方法将无监督学习和有监督学习完美结合,并且在不需要提前知道类别标签的前提下即可有效地降低训练时间,提高分类精度.
In order to solve the problem that virus and Trojan attack the application layer network protocol of industrial control system, the rules of Modbus / TCP communication protocol are analyzed and a semi-supervised clustering strategy based on clustering and support vector machine is proposed. Fuzzy C-means (FCM) and supervised support vector machine (SVM) are combined to realize the semi-supervised machine learning of industrial anomaly detection.Firstly, the Modbus / TCP protocol of industrial control system Then the data are processed by fuzzy C-means clustering, and the distance between communication data and clustering center is calculated. Part of the data meeting the threshold condition is further processed by genetic algorithm (GA ) .Experimental results show that compared with the traditional intrusion detection methods, this method can combine unsupervised learning with supervised learning, and can effectively reduce without knowing the category tags in advance Training time, improve the classification accuracy.