本文關(guān)鍵詞：非侵入式的基于功耗的PLC異常監(jiān)測(cè)系統(tǒng)　出處：《浙江大學(xué)》2017年碩士論文　論文類型：學(xué)位論文

  更多相關(guān)文章： 工業(yè)控制系統(tǒng) 可編程邏輯控制器 旁路分析 異常檢測(cè) 基于長(zhǎng)短記憶單元的神經(jīng)網(wǎng)絡(luò)

【摘要】：工業(yè)控制系統(tǒng)廣泛應(yīng)用于關(guān)鍵基礎(chǔ)設(shè)施的建設(shè)中,關(guān)系到國(guó)計(jì)民生,其重要性不言而喻。隨著信息技術(shù)的發(fā)展,工業(yè)控制系統(tǒng)不再是物理隔絕系統(tǒng),其與信息技術(shù)的結(jié)合為工業(yè)控制系統(tǒng)本身帶來了嚴(yán)重的安全威脅�？删幊踢壿嬁刂破�(Programmable Logic Controller,PLC)作為工業(yè)控制系統(tǒng)中的關(guān)鍵組成部分,直接控制現(xiàn)場(chǎng)設(shè)備的運(yùn)行,一旦其遭到攻擊運(yùn)行了惡意指令,將直接給控制現(xiàn)場(chǎng)造成重大財(cái)產(chǎn)損失甚至人員傷亡。然而,現(xiàn)有的防護(hù)方案大多是移植于傳統(tǒng)的網(wǎng)絡(luò)安全方案,無法很好的應(yīng)用于工業(yè)控制系統(tǒng)中。PLC運(yùn)行邏輯簡(jiǎn)單且工作模式單一,其運(yùn)行時(shí)產(chǎn)生的功耗信息與運(yùn)行的程序之間有密切的關(guān)系。基于上述分析,本文創(chuàng)新性地提出了一種非侵入式的基于功耗的PLC安全監(jiān)測(cè)系統(tǒng)。基于功耗的監(jiān)測(cè)系統(tǒng)通過采集PLC運(yùn)行時(shí)的功耗信息,并結(jié)合稀疏編碼算法從原始信息中提取最優(yōu)的特征組合,然后通過訓(xùn)練一個(gè)基于長(zhǎng)短記憶單元的神經(jīng)網(wǎng)絡(luò)來完成異常程序的檢測(cè)。該檢測(cè)算法在不需要異常程序樣本的情況下,可以實(shí)現(xiàn)對(duì)已知攻擊和未知攻擊的檢測(cè)。為了驗(yàn)證算法的有效性,我們?cè)趯?shí)驗(yàn)室搭建了簡(jiǎn)單的液位控制系統(tǒng),并完成了木馬攻擊,基于該實(shí)驗(yàn)平臺(tái),我們驗(yàn)證了在正常情況和異常情況下,該算法都能達(dá)到很好的檢測(cè)效果。當(dāng)攻擊程序與原程序的差別大于0.63%時(shí),檢測(cè)準(zhǔn)確率高于99.83%。在完成實(shí)驗(yàn)驗(yàn)證后,我們基于自主設(shè)計(jì)的STM32數(shù)據(jù)采集器完成了實(shí)時(shí)監(jiān)測(cè)系統(tǒng)的開發(fā)。該系統(tǒng)具有非侵入式,無需對(duì)原工業(yè)控制系統(tǒng)進(jìn)行軟硬件的修改,能夠?qū)崿F(xiàn)對(duì)未知異常進(jìn)行檢測(cè)等優(yōu)點(diǎn)。
[Abstract]:Industrial control systems are widely used in the construction of key infrastructure in relation to the importance of self-evident. Beneficial to the people's livelihood, with the development of information technology, industrial control system is no longer a physical isolation system, combined with the information technology has brought a serious security threat for the industrial control system. The programmable logic controller (Programmable Logic Controller, PLC) as a key component in the industrial control system, direct control of site equipment operation, once the attack run malicious commands directly to the control site causing heavy casualties and property losses. However, most of the existing protection scheme of network security solutions to the traditional application of transplantation, not very good at.PLC industrial control system operation logic is simple and single working mode, a secret between the power of information and operation of its runtime program Cut the relationship. Based on the above analysis, this paper proposes a non intrusive PLC safety monitoring system based on power consumption. The power consumption of the monitoring system through the power consumption information collection PLC based on runtime, and combined with the sparse encoding feature extraction algorithm is the optimal combination of the information from the original, and then through the training of a neural network the length of the memory element is accomplished based on the abnormal detection. The detection algorithm does not require abnormal samples, can be used to detect known and unknown attack. In order to verify the effectiveness of the algorithm, we build a simple level control system in the laboratory, and completed the Trojan attacks, based on the experimental platform and we verified in normal and abnormal conditions, the algorithm can achieve good detection effect. When the attack program with the original program the difference is greater than 0.63%, the detection accuracy The rate is higher than that of 99.83%. in the experiment verification, we designed STM32 data acquisition system is completed based on development of real-time monitoring system. The system is non intrusive, without the original industrial control system hardware and software modifications, can realize the advantages of detection of unknown anomalies.

【學(xué)位授予單位】：浙江大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2017
【分類號(hào)】：TP274;TP273

【參考文獻(xiàn)】

相關(guān)期刊論文 前7條

1 王灝然;肖玉s，

本文編號(hào)：1360477