CN106230772A - Industry internet Deviant Behavior excavates scheme - Google Patents

Abstract

According to the characteristics of data behavior in the industrial control network under the mobile Internet environment, an improved hybrid multi-classification naive Bayesian algorithm and a massive data incremental learning algorithm based on two-step screening are provided, and applied to abnormal behavior mining of mobile industrial control systems and analysis. The abnormal behavior mining scheme is designed by abnormal behavior classification and mining algorithm: the method of suspicious behavior classification and the process of data mining. In the industrial control network under the mobile Internet environment, the mining of behavior data is divided into two stages: classifier learning stage and network behavior monitoring stage; after obtaining various behavior classifiers, data mining of malware behavior enters the second stage, network behavior monitoring stage. The Naive Bayesian classification algorithm has the characteristics of fast calculation speed, high classification accuracy and good robustness under the premise of independent classification categories, and has been widely used.

Description

Industrial Internet Abnormal Behavior Mining Solution

technical field

The invention relates to a mining scheme, in particular to a mining scheme for abnormal behavior of the industrial Internet.

Background technique

Security protection against abnormal behavior of industrial control systems in the mobile Internet environment mainly includes two aspects, network side protection and terminal side protection.

1. Network side protection

Network side protection usually refers to the use of feature matching engines to analyze the network traffic of industrial control systems in the mobile Internet environment, mainly referring to specific industrial control protocols, such as OPC, DNP3, etc., and also includes abnormal behaviors and samples of various mobile terminals. files etc. for analysis. The intrusion detection technology of the industrial control system realizes the monitoring of abnormal behavior in the industrial control network by using the bypass mode.

2. Terminal side protection

The protection on the terminal side mainly prevents attacks through the security detection of mobile terminals in the industrial control network. Currently commonly used security analysis techniques include:

· Scan for malicious behavior characteristics. This protection method can detect known abnormal malicious behaviors with high precision, but cannot detect unknown or new abnormal malicious behaviors.

· Static sampling analysis principle. This principle is used to conduct fixed sampling analysis on the application on the mobile terminal to determine whether the application's behavior is abnormal malicious behavior. This sampling analysis should be performed based on the security options set by the user in advance. Abnormal behaviors in the mobile industrial control network, especially new abnormal behaviors, cannot be prevented in time.

· Dynamic behavior analysis technology. In order to save computing resources of mobile terminals, this technology proposes a cloud-based mobile malicious program security detection system, which detects uploaded mobile malicious programs by deploying a cloud malicious program detection server in the mobile Internet. This method is equivalent to exchanging bandwidth for saving computing resources of the mobile terminal.

In the industrial control network under the mobile Internet environment, although the traditional feature matching technology can obtain better detection results for known abnormal behaviors, due to the improvement of the intelligence of mobile terminals, the services carried on mobile terminals, especially industrial The control business is also growing rapidly, and various new and modified attacks against mobile terminals emerge in an endless stream.

Contents of the invention

Purpose of the invention: According to the behavior characteristics of the industrial control network in the mobile Internet environment, an improved hybrid multi-classification naive Bayesian algorithm and a massive data incremental learning algorithm based on two-step screening are invented, and the industrial control network in the mobile Internet environment is given. Network abnormal behavior monitoring system and processing flow. That is, data mining algorithms are introduced for abnormal behavior analysis.

The present invention is realized in the following way: industrial Internet abnormal behavior mining scheme, abnormal behavior classification and mining algorithm design:

1. The method of suspicious behavior classification and the process of data mining. In the industrial control network under the mobile Internet environment, the mining of behavior data is divided into two stages: the classifier learning stage and the network behavior monitoring stage. After obtaining various behavior classifiers, the data mining of malware behavior enters the second stage, the network behavior monitoring stage.

2. Network behavior mining analysis, the TCP connection and application layer protocol part of the obtained live network behavior data select key header fields, traffic statistics and key content fields as the characteristics of abnormal behavior analysis.

3. Design of abnormal behavior mining algorithm, mixed multi-category naive Bayesian algorithm and two-step screening incremental learning method; firstly, use whitelist scanning engine to scan live network behavior data to obtain normal behavior for incremental learning; use known anomalies The output of the behavioral signature matching engine yields anomalous behavior. In this way, the original incremental training set DT including abnormal behavior and normal behavior is obtained, and then after two-step screening, it is added to the incremental training set to train the existing model.

Compared with the prior art, the present invention has the positive effect that the data mining algorithm can better detect abnormal behaviors in traditional Internet network behavior analysis and intrusion detection. Chandrashekhar et al. used clustering algorithm to mine and analyze network intrusion detection data, and Modi et al. applied Bayesian classification algorithm to intrusion detection based on cloud computing platform. The Naive Bayesian classification algorithm has the characteristics of fast calculation speed, high classification accuracy and good robustness under the premise of independent classification categories, and has been widely used.

Description of drawings

Fig. 1 is a schematic flow chart of the learning phase of the network behavior classifier of the present invention.

Fig. 2 is a schematic flow chart of the network behavior monitoring stage of the present invention.

detailed description

The behavior of malware in industrial control networks in the mobile Internet environment has different characteristics at each infection stage, so the classification of its behavior helps to improve the accuracy of monitoring. Abnormal behaviors of mobile terminals in industrial control networks in the mobile Internet environment may include:

·Attacks on mobile industrial control systems by malicious programs such as mobile terminal zombies, Trojan horses and viruses, and artificial attacks on mobile industrial control systems. These malicious attacks have the characteristics of great harm and heavy losses. Attackers can control the core operation of the mobile industrial control system through malicious instructions, or maliciously download confidential information in the industrial control system.

·Infected terminals spread malicious codes to other terminals in various ways. Due to the strong communication capabilities of mobile terminals, infected terminals can spread malicious programs that are deceptively downloaded through SMS and link to other terminals; they can also spread malicious programs to other terminals by using bluetooth, infrared, etc.

Mobile terminals equipped with industrial mobile applications visit malicious websites, upload the confidential information of the industrial control system, and then leak the confidential information to malicious third parties; or download viruses, Trojan horses and other malicious software from malicious websites, and pass the infected Mobile terminals initiate attacks on industrial control systems, etc.

Milligan et al. summarized the security hazards of mobile malicious programs, including information leakage, confidential data theft, malicious attacks, network fraud attacks, and network denial of service attacks.

Since mobile terminals are closely related to industrial applications and users, abnormal behaviors are often associated with mobile terminal types, client program types, user information, etc., and the transmission protocols are diversified, and the attack methods are also diverse. Therefore, in the analysis of abnormal behavior in the industrial control network under the mobile Internet environment, it is necessary to consider not only terminal information, user information, but also the relevant characteristics and attributes of transmission protocols at all levels.

According to the analysis of the abnormal behavior of the industrial control network in the mobile Internet environment, the infection period of malware can be divided into three stages: the diffusion stage, the stage of accessing malicious servers, and the attack stage. In the diffusion stage, malicious software can be sent to other mobile terminals through MMS, HTTP, FTP and email. After the malware infects the mobile terminal, it downloads update files and control instructions by connecting to a malicious server, or uploads the system information obtained by the terminal to a malicious website. Ultimately, malicious software can use infected terminals to launch various attacks on industrial control systems, including maliciously downloading data from industrial control systems, issuing illegal control commands to attack systems, and sending private secrets to other terminals or websites at will.

According to the above three processes, malware behaviors are divided into three categories: spreading behaviors, visiting malicious websites behaviors and attacking behaviors. These three types of behaviors are classified and processed by different classifiers to improve the recognition of malicious behaviors.

Abnormal behavior classification and mining algorithm design:

1. The method of suspicious behavior classification and the process of data mining. In the industrial control network under the mobile Internet environment, the mining of behavior data is divided into two stages: the classifier learning stage and the network behavior monitoring stage. Among them, the process of behavior classifier data mining in the learning stage is shown in Figure 1. During the learning phase, the model uses known mobile malware and normal network access as learning data for a behavioral classifier. Among them, malware as learning data has three stages of behavior: diffusion behavior, malicious access behavior and attack behavior. Similarly, normal network access data also has similar types of behaviors, such as the normal information exchange between mobile terminals, the behavior of downloading files, the behavior of accessing the system, and the behavior of issuing normal control commands to the control system. The behavior classifier module divides the learning data into three behavior subsets according to the characteristics of the data behavior: diffusion behavior subset, malicious access behavior subset and attack behavior subset. Then, the data of these three behavioral subsets are used to learn three different Naive Bayesian classifiers respectively. The three classifiers are: diffusion behavior classifier F1, malicious access behavior classifier F2 and attack behavior classifier F3.

After obtaining various behavior classifiers, the data mining of malware behavior enters the second stage, the network behavior monitoring stage, as shown in Figure 2. In the monitoring phase, real data from the mobile network is fed into the behavior classifier obtained in the first phase. The behavior classification module divides the network data into three subsets according to the behavior characteristics of the network data. Then, the behavior data of these three subsets are respectively input into corresponding behavior classifiers for analysis and classification, so as to judge whether these network behavior data are malicious behavior data.

2. Network behavior mining analysis. Traditional network intrusion behavior mining analysis usually uses KDD'99 intrusion detection data for mining analysis. KDD'99 network intrusion behavior is collected by DARPA'98 intrusion detection system project, including denial of service, prompting privilege attacks, remote attacks, and scanning attacks. Each connection in the data is described by 41 features, including basic connection features, traffic statistics features, content features, and host-based network traffic statistics features. Due to the difference between the attack behavior in the industrial control network and the traditional network in the mobile Internet environment, the high-speed acquisition probe used in this system collects the abnormal behavior traffic and normal behavior traffic on the existing mobile industrial control network; Match the attack characteristics of the interconnected industrial control network to obtain labeled abnormal behavior data; use the whitelist scanning engine to scan to obtain labeled normal behavior data. With reference to the network behavior feature description of KDD'99, the present invention selects key packet header fields, traffic statistics and key content fields as the characteristics of abnormal behavior analysis in the TCP connection and the application layer protocol part of the obtained network behavior data. For example, if there is an attack of information theft, the key content field usually includes some special strings.

3. Algorithm design for abnormal behavior mining, mixed multi-classification naive Bayesian algorithm

Let X={x ₁ , x ₂ ,...,x _k } be a data tuple, which is described by k attributes {A ₁ , A ₂ ,..., A _k }; let D be A collection of training tuples and associated class labels (training set). Assuming that for a given tuple X with n+1 class attribute values C = {C ₀ , C ₁ , ..., C _n }, the Naive Bayesian classification method predicts that X belongs to class C _i with the highest probability, if and only if

P(C _i |X)＞P(C _j |X), (0≤j≤n, i≠j) (1)

Since is a fixed constant for all classes, by Bayes' theorem (Equation 2),

$\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>$

It is only necessary to determine the maximum P(X|C _i )P(C _i ): in order to predict the class label of X, for each class C _i , calculate P(X|C _i )P(C _i ).

The attribute values selected in the mobile Internet industrial control network network request are independent of each other, so it can be based on the independent probability values of each attribute P(x ₁ |C _i ), P(x ₂ |C _i ),...,P( x _k |C _i ), for probability calculation:

$\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; )</span>$

If the binary classification naive Bayesian algorithm is used to classify malicious behaviors, then n is equal to 1, and the total number of categories is 2, that is, there are only normal behaviors and abnormal behaviors in the categories. Since the abnormal behavior may be caused by a variety of malicious programs and the behaviors are not the same, a mixed multi-classification Naive Bayesian algorithm is used for analysis. When modeling, the behavior of different types of malicious programs is added to the training set D for multi-classification training; when detecting, it is detected by binary classification. For n+1 classification sets C, define C ₀ as normal behavior category, C′ as abnormal behavior category, including n types of malicious program behavior subset C′={C ₁ , C ₂ ,...,C _n }, Then C={C ₀ , C'}.

When classifying and detecting network behavior X, the output of the mixed multi-classification Naive Bayesian algorithm is formula 4. For network behavior X, when the class conditional probability P(C ₀ |X) of normal behavior class C ₀ is greater than the maximum value of abnormal behavior class conditional probability, X is judged as normal behavior, otherwise it is abnormal behavior.

C(X) = arg max(max(P(C ₁ |X)), P(C ₂ |X), ..., P(C _n |X)), P(C ₀ |X) (4)

Two-step filtering incremental learning method:

Both network behavior detection and model incremental learning in industrial control networks in the mobile Internet environment involve massive data processing, so it is necessary to select data with a relatively high probability of class support that helps to correct the model for incremental learning. In the actual detection, first use the whitelist scanning engine to scan the live network behavior data to obtain the normal behavior for incremental learning; use the output of the known abnormal behavior feature matching engine to obtain the abnormal behavior. In this way, the original incremental training set DT including abnormal behavior and normal behavior is obtained, and then after two-step screening, it is added to the incremental training set to train the existing model.

The first step of screening is to use the existing model to perform multi-classification naive Bayesian classification detection on the original incremental training set DT, and the output results are divided into two cases:

In the first case, if the classification of abnormal network behavior in the original incremental training set belongs to a certain classification in the detection model, such as the behavior of a certain type of malicious program in the original training model, then use the existing model for detection calculation , and judge whether the classification is accurate according to formula (1). If the classification is accurate, there is no need for incremental learning with that data. If the classification is inaccurate, it is further judged according to the formula (4) whether abnormal behaviors are judged as normal behaviors. If there is, it means that the data has a large deviation from the original model, so it cannot be added for incremental learning.

In the second case, if the classification of abnormal network behavior in the original incremental training set does not belong to a certain classification in the detection model, then directly use formula (4) to judge whether the classification is accurate, and if it is accurate, it will be used for the next step of screening.

In the second step of screening, the relative class support probability PS is calculated for the remaining data in the training set DT, assuming:

P(C _m |X)＝max(P(C ₁ |X), P(C ₂ |X),..., P(C _n |X)), P(C ₀ |X) 0≤m≤ n (5)

The relative class support probability PS is:

$\mathrm{<span\; class="notranslate">\; P</span>}\mathrm{<span\; class="notranslate">\; S</span>}<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; m</span>}}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span>}{{<span\; class="notranslate">\; \&Pi;</span>}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&NotEqual;</span>\mathrm{<span\; class="notranslate">\; m</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 6</span>}<span\; class="notranslate">\; )</span>$

Set a data screening threshold TH, and only the training data with relative class support probability PS>TH will be added to the training set DT′ for incremental calculation, and the training set will be incrementally trained using the following formula:

${\mathrm{<span\; class="notranslate">\; P</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; c</span>}\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; u</span>}\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; count</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}{<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; C</span>}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; +</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; D.</span>}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; +</span><span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; DT</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; |</span>}<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 7</span>}<span\; class="notranslate">\; )</span>$

in:

Count(C _i ) is the number of network behaviors of category C _i in the training set D;

Count'(C _i ) is the number of network behaviors of category C _i in the newly added incremental training set DT';

|C|The total number of network behavior categories in the training set D;

|D|The total number of network behavior categories in the training set D;

|DT|The total number of network behaviors in the newly added incremental training set;

Count(C _i ∧ x _j ) is the number of network behaviors in the training set D where the category is C _i and the value of attribute A _i is X _j ;

·count′(C _i ∧ x _j ) is the number of network behaviors whose category is C _i and attribute A _i value is X _j in the newly added incremental training set DT′;

· |A _i | indicates the value number of attribute A _i .

Claims (3)

1. industry internet Deviant Behavior excavates scheme, it is characterised in that: described Deviant Behavior excavates scheme by Deviant Behavior Classification and mining algorithm design: the method for questionable conduct classification and the process of data mining, under mobile interchange environment In industrial control network, the excavation of behavioral data is divided into two stages: grader study stage and network behavior monitor the stage；? After obtaining each class behavior grader, the data mining of Malware behavior enters second stage, network behavior monitoring stage.

2. Deviant Behavior as claimed in claim 1 excavates scheme, it is characterised in that: described network behavior mining analysis, obtains The TCP of the existing network behavioral data taken connects and application layer protocol part chooses crucial header field, traffic statistics and key The feature that content field is analyzed as Deviant Behavior.

3. Deviant Behavior as claimed in claim 1 excavates scheme, it is characterised in that: described Deviant Behavior mining algorithm sets Meter, mixing many classification NB Algorithm and two steps screening Increment Learning Algorithm；Scan first with white list scanning engine Existing network behavioral data obtains the normal behaviour for incremental learning；The output utilizing known exception behavior characteristics coupling engine obtains Deviant Behavior.Thus obtain the original incremental training collection DT including Deviant Behavior and normal behaviour, after then carrying out two step screenings Join incremental training concentration existing model is trained.