Patent ID: 11927949
Assignee: ZHEJIANG UNIVERSITY
Field: Control (Instruments)
Classification: CPC G  H | IPC G

Claim 0:
1. A method for anomaly classification of an industrial control system (ICS) communication network, comprising the following steps:
1) collecting, by a monitoring host of an ICS communication network, traffic data in real time from an industrial switch in the ICS communication network, and storing, by an industrial server, the real-time collected communication traffic data;
2) performing online detection by using multiple short-cycle seasonal autoregressive integrated moving average (SARIMA) models, comprising:
running, for the traffic data collected in real time, multiple short-cycle SARIMA(p, d, q)×(P, D, Q)s statistical learning models in a distributed manner to generate an online traffic threshold interval for each short-cycle SARIMA models of the multiple SARIMA models in real time, and obtaining an abnormal traffic data set of ICS communication network corresponding to traffic data exceeding the online traffic threshold interval, wherein the traffic data exceeding the online traffic threshold interval is abnormal traffic data, and wherein the abnormal traffic data set comprising a training set for a short-cycle SARIMA model with the abnormal traffic data, upper and lower bounds of the online traffic threshold interval obtained from the training set, an online monitoring data set for comparing with the online traffic threshold interval, and time series corresponding to abnormal traffic data;
3) identifying background traffic data of the ICS communication network by using an trained long short term memory (LSTM) deep leaning model in an online way, comprising:
using the training set for each of the short-cycle SARIMA model with the abnormal traffic data as input of the trained LSTM deep learning model, and outputting a corresponding forecasted traffic sequence as the background traffic data; and
obtaining a variance {tilde over (σ)}k of the forecasted traffic sequence and a variance {circumflex over (σ)}k of the online traffic threshold interval; and
4) classifying anomalies of the ICS communication network, comprising:
determining whether an anomaly of the ICS communication network is generated by an ICS valid action and planned maintenance event or by a malicious action, based on the time series corresponding to the abnormal traffic data;
determining whether the anomaly of the ICS communication network is generated by an abnormal ICS network or communication data transmission failure, based on the upper and lower bounds of the online traffic threshold interval, the forecasted traffic sequence, the variance {tilde over (σ)}k of the forecasted traffic sequence and the variance {circumflex over (σ)}k of the online traffic threshold interval; and
determining whether the anomaly of the ICS communication network is caused by a malicious intrusion attack on the ICS communication network by using a Berkeley packet filter (BPF) algorithm to distinguish data packet types of the traffic data collected in real time from the ICS communication network based on a distribution deviation for each data packet type.