Research on Network Traffic Anomaly Detection of Source-Network-Load Industrial Control System Based on GRU-OCSVM

Abstract

With the large number of distributed generators and diverse loads connected to industrial control systems, there are more and more interactions among power supply, power grid and load. Any network link attack in the source network will affect the security of the industrial control system, resulting in economic loss of the industrial control system. Therefore, it is very important to study the network attacks against the source-network-load industrial control system. Aiming at the current insufficient situation of network traffic anomaly detection in the source-network-load industrial control system, this paper analysed the composition and flow characteristics of the source-network-load system, studied the scheme of network traffic anomaly detection of the source-network-load system, and proposed a network traffic anomaly detection algorithm based on GRU-OCSVM. The time characteristics of the traffic sequence were extracted by the GRU and input into OCSVM for traffic anomaly detection. Finally, the original network traffic of the source-network-load system was collected to construct anomaly detection data set for simulation experiment. The experimental results showed that the proposed method had high detection rate and low false positive rate, which can meet the needs of network traffic anomaly detection in the source-network-load system.