Patent ID: 11927949
Assignee: ZHEJIANG UNIVERSITY
Field: Control (Instruments)
Classification: CPC G  H | IPC G

Claim 4:
5. The method for anomaly classification of an ICS communication network according to claim 4, wherein step 4) comprises:
4.1) executing a real-time time label error algorithm:, ❘
      "\[LeftBracketingBar]"
     
     
      
       t
       i
       anom
      
      -
      
       t
       i
       whit
      
     
     
      ❘
      "\[RightBracketingBar]"
     
    
    
     
      γ
      samp
     
     ·
     
      T
      trai
     
    
   
   ≤
   ε
  
  ⁢
  

  
   (
   
    
     i
     =
     1
    
    ,
    2
    ,
    3
    ,
    …
       
    ,
    
     
      
       n
      
      
       
        n
        ∈
        ℕ
       
      
     
    
   
    
   )
  
 

wherein a predefined errors ε is used as a critical value to limit a deviation between a timestamp of an anomaly event and a timestamp of whitelisting, tianom is an element of an anomaly event time series Tnanom, and tiwhit is an element of a time series Tnwhit of whitelisted ICS valid action time and planned maintenance event time; if the critical value of the deviation between the timestamp of the anomaly event and the timestamp of whitelisting is within the deviation, the abnormal ICS communication traffic is generated by the ICS valid action and planned maintenance event;
if |tkanom−tkwhit|/(γsamp·Ttrai)>ε, the abnormal ICS communication traffic is generated by the malicious action;
4.2) calculating average values of upper and lower bounds of the online traffic threshold interval and an average value of the background traffic sequence forecasted in the ikanom-th short cycle based on the upper and lower bounds of the online traffic threshold interval of the online SARIMA model in the short cycle with an anomaly event and the background traffic sequence of the ICS communication network forecasted by the trained LSTM deep learning model, wherein normal background traffic sequence of the ICS communication network comprises:, 1
    
     T
     fore
    
   
   ⁢
   
    
     ∑
     
      i
      =
      1
     
     
      T
      fore
     
    
    
     l
     i
     
      (
      
       i
       k
       anom
      
      )
     
    
   
  
  ≤
  
   
    1
    
     N
     fore
    
   
   ⁢
   
    
     ∑
     
      i
      =
      1
     
     
      N
      fore
     
    
    
     
      x
      ~
     
     
      i
      ,
      k
     
     ′
    
   
  
  ≤
  
   
    1
    
     T
     fore
    
   
   ⁢
   
    
     ∑
     
      i
      =
      1
     
     
      T
      fore
     
    
    
     u
     i
     
      (
      
       i
       k
       anom
      
      )
     
    
   
  
 

 
  
   k
   =
   1
  
  ,
  2
  ,
  …
      
  ,
  n
 

 
  n
  ∈
  ℕ
 

wherein {tilde over (x)}′i,k is an element of {tilde over (X)}Nfore,k;
based on the variance {tilde over (σ)}k of the forecasted traffic sequence of the LSTM deep learning model and the variance {circumflex over (σ)}k of the online traffic threshold interval generated by the SARIMA online detection algorithm, obtaining that a variance {circumflex over (σ)}k of the normal background traffic of the ICS communication network needs to be less than the variance {circumflex over (σ)}k of the online traffic threshold interval generated dynamically by the SARIMA algorithm:

{tilde over (σ)}k≤{circumflex over (σ)}k

when the inequation, {
  
   
    
     
      
       
        1
        
         N
         fore
        
       
       ⁢
       
        
         ∑
         
          i
          =
          1
         
         
          N
          fore
         
        
        
         
          x
          ~
         
         
          i
          ,
          k
         
         ′
        
       
      
      >
      
       
        1
        
         T
         fore
        
       
       ⁢
       
        
         ∑
         
          i
          =
          1
         
         
          T
          fore
         
        
        
         u
         i
         
          (
          
           i
           k
           anom
          
          )
         
        
       
      
     
    
    
     
      
       k
       =
       1
      
      ,
      2
      ,
      …
         
      ,
      n
       
     
    
    
     
      n
      ∈
      ℕ
     
    
   
   
    
     
      
       
        σ
        ~
       
       k
      
      >
      
       
        σ
        ^
       
       k
      
     
    
    
      
    
    
      
    
   
   
    
     
      0
      <
      
       
        1
        
         N
         fore
        
       
       ⁢
       
        
         ∑
         
          i
          =
          1
         
         
          N
          fore
         
        
        
         
          x
          ~
         
         
          i
          ,
          k
         
         ′
        
       
      
      <
      
       
        1
        
         T
         fore
        
       
       ⁢
       
        
         ∑
         
          i
          =
          1
         
         
          T
          fore
         
        
        
         l
         i
         
          (
          
           i
           k
           anom
          
          )
         
        
       
      
     
    
    
     
      
       k
       =
       1
      
      ,
      2
      ,
      …
         
      ,
      n
     
    
    
     
      n
      ∈
      ℕ, holds, the ICS communication network is faulty or abnormal, and the abnormal ICS communication traffic is caused by the abnormal ICS network or communication data transmission failure;
4.3) using a Berkeley packet filter (BPF) algorithm to distinguish data packet types in real-time collected communication network traffic, wherein the BPF algorithm comprises:, X
    t
   
   
    →
    BPF
   
   
    
     X
     t
     TCP
    
    +
    
     X
     t
     UDP
    
    +
    
     X
     t
     ARP
    
    +
    
     X
     t
     ICMP
    
    +
    …
   
  
  ⁢
  

  
   wherein
      
   
    →
    BPF, is the BPF algorithm, XtTCP is a TCP traffic sequence split from an original traffic sequence Xt, and XtUDP is a UDP traffic sequence split from the original traffic sequence Xt;
calculating a distribution deviation τtype(ikanom) of different types of data packets under the ICS network data traffic:, τ
   type
   
    (
    
     i
     k
     anom
    
    )
   
  
  =
  
   
    
     (
     
      
       
        
         [
         
          X
          
           T
           trai
          
          
           (
           
            i
            k
            anom
           
           )
          
         
         ]
        
        type
       
       -
       
        
         [
         
          X
          
           T
           fore
          
          
           (
           
            i
            k
            anom
           
           )
          
         
         ]
        
        type
       
      
      
       
        ∑
        
         m
         =
         1
        
        
         T
         trai
        
       
       
        X
        m
        
         (
         
          i
          k
          anom
         
         )
        
       
      
     
     )
    
    2
   
   /
   
    
     (
     
      
       
        T
        trai
       
       -
       
        T
        fore
       
      
      
       T
       trai
      
     
     )
    
    2
   
  
 

wherein [Xt]type represents total traffic of a specified type of packet in the ICS communication network traffic sequence Xt;
based on the normal traffic training sequence X′Ntrai, calculating a baseline of the distribution deviation by using the BPF, wherein the normal traffic training sequence X′Ntrai is an offline training set of the trained LSTM deep learning model:, Dist
    type
   
   =
   
    
     
      [
      
       X
       
        N
        trai
       
       ′
      
      ]
     
     type
    
    /
    
     
      ∑
      
       i
       =
       1
      
      
       N
       trai
      
     
     
      X
      i
      ′
     
    
   
  
  ⁢
  

  
   (
   
    
     type
     =
     UDP
    
    ,
    TCP
    ,
    ARP
    ,
     
    etc
   
   )
  
 

when τtype(ikanom) satisfies τtype(ikanom)>εtypepd·Disttype2, the ICS communication traffic anomaly event is caused by the malicious intrusion attack on the ICS communication network, wherein εtypeps represents an allowable distribution error of a specified type of packet.