Anomaly detection for industrial control operations with optimized ABC–SVM and weighted function code correlation analysis

摘要: Under the tendency of interconnection and interoperability in Industrial Internet, anomaly detection, which has been widely recognized, won significant accomplishments industrial cyber security. However, a crucial issue is how to effectively extract communication features can accurately comprehensively describe control operations. Aiming at function code field Modbus/TCP protocol, this paper proposes novel feature extraction algorithm based on weighted correlation, not only indicates contribution single whole sequence, but also analyzes correlation different codes. In order design serviceable detection engine, dynamic adjusting ABC–SVM (Artificial Bee Colony–Support Vector Machine) model double mutations developed identify abnormal behaviors communications. The experimental results show that proposed reflect changes behavior communications, improved strengthen performance by comparing with other engines.