面向工业互联网设备的异常行为关联分析攻击溯源技术研究OA北大核心CSTPCD

In this paper,an attack tracing detection method based on abnormal behavior correlation analysis mapping is proposed to solve the problem of unclear attack mechanism analysis and jump process in industrial control network side and device side under the industrial Internet scenario.The method is based on similarity comparison of abnormal behavior sequences,mapping analysis of abnormal behavior sequences and attack stages,and constructing a complete attack chain by linking the attack association subgraphs between different devices in series.Finally,the effectiveness of the attack detection and traceability method is verified,through constructing a simulation test environment for industrial intelligent devices and realizing the replay reproduction of common industrial device attack behaviors.