An Attack Detection Method of Industry Control System Based on Multi-dimension Abnormities
Zihua Fan, Chaowen Chang, Dongcun Pan · 2017
The existing attack detection methods cannot extract attack of industrial control system(ICS) correctly.In the view of that, we analyze the characteristics of ICS and proposes an attack detection method of ICS based on multi-dimension abnormities.First of all, we divide hosts into multiple dimensions according to business behavior characteristics of ICS.The multi-dimension abnormities could be used by attack detection method as input.Secondly, we use a hierarchical progress to detect attack because of the different relationships of multi-dimension abnormities.For redundant relationship, we use attribute similar method to extract the abnormal events; For parallel relationship, we use the improved native bayesian to do attack aggregation.Finally, we do a simulation experiment and it shows that our attack detection method has good detection effect.