CN109271855B - Method for extracting characteristics of industrial control signals - Google Patents
Method for extracting characteristics of industrial control signals Download PDFInfo
- Publication number
- CN109271855B CN109271855B CN201810902497.4A CN201810902497A CN109271855B CN 109271855 B CN109271855 B CN 109271855B CN 201810902497 A CN201810902497 A CN 201810902497A CN 109271855 B CN109271855 B CN 109271855B
- Authority
- CN
- China
- Prior art keywords
- physical signal
- industrial control
- control signals
- signal samples
- correlation coefficient
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2218/00—Aspects of pattern recognition specially adapted for signal processing
- G06F2218/08—Feature extraction
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2218/00—Aspects of pattern recognition specially adapted for signal processing
- G06F2218/12—Classification; Matching
Landscapes
- Engineering & Computer Science (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Theoretical Computer Science (AREA)
- Artificial Intelligence (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Investigating Or Analysing Biological Materials (AREA)
- Other Investigation Or Analysis Of Materials By Electrical Means (AREA)
Abstract
A method for extracting characteristics of industrial control signals comprises the following steps: s1, acquiring and preprocessing the industrial control signal to obtain a physical signal sample; s2, selecting at least two groups of physical signal samples from the physical signal samples to be used as feature byte variograms of different types of physical signal samples; s3, obtaining a correlation coefficient curve based on the variance map; and S4, obtaining the characteristic threshold values of the physical signal samples of different classes based on the correlation coefficient curve. By implementing the method for extracting the characteristics of the industrial control signals, the characteristics of the industrial control signals can be extracted through concise operation, and the method has high efficiency of identifying the characteristics of the industrial control signals and wide application range.
Description
Technical Field
The invention relates to the field of signal detection, in particular to a method for extracting characteristics of industrial control signals.
Background
With the increasing requirements on industrial control safety, the existing industrial control safety detection is realized on the network protocol detection level, and no matter what degree of protection is constructed on the network protocol level, the invasion of various network attack means cannot be avoided. The physical signal layer of the industrial control equipment is undoubtedly the most fundamental detection basis, and the detection means established on the signal layer is a more reliable detection method. However, the corresponding functions of different types of industrial control signals are different, and their characteristics are different. In order to quickly identify the type of the received industrial control signal and judge whether the industrial control signal belongs to a normal signal, a fault signal or other invasive virus signals, enough signal characteristic knowledge needs to be learned, and enough samples are required to be collected to extract the characteristics of different types of signals. Therefore, a method for extracting the characteristics of the industrial control signals, which is simple in operation, high in identification efficiency and wide in application range, is needed.
Disclosure of Invention
The technical problem to be solved by the present invention is to provide a method for extracting characteristics of an industrial control signal, aiming at the above-mentioned defects in the prior art.
The technical scheme adopted by the invention for solving the technical problems is as follows: a method for extracting characteristics of industrial control signals is constructed, and comprises the following steps:
s1, acquiring and preprocessing the industrial control signal to obtain a physical signal sample;
s2, selecting at least two groups of physical signal samples from the physical signal samples to be used as feature byte variograms of different types of physical signal samples;
s3, obtaining a correlation coefficient curve based on the variance map;
and S4, obtaining the characteristic threshold values of the physical signal samples of different classes based on the correlation coefficient curve.
In the method for extracting characteristics of an industrial control signal according to the present invention, the step S1 further includes:
s11, acquiring a classification instruction signal of the industrial control equipment;
s12, exciting the classification command signal and recording the physical signal of the label corresponding to the classification command signal;
and S13, carrying out normalization processing on the physical signal to obtain the physical signal sample.
In the method for extracting characteristics of an industrial control signal according to the present invention, the step S11 further includes:
s111, selecting industrial control equipment to be detected and selecting an instruction classification scheme of the industrial control equipment to be detected;
and S112, classifying the industrial control signals of the industrial control equipment in a labeling mode based on the instruction classification scheme to obtain classification instruction signals.
In the method for extracting characteristics of an industrial control signal according to the present invention, the step S2 further includes:
s21, selecting at least two groups of physical signal samples which are the same in quantity and cover the value range variation range from the physical signal samples;
s22, obtaining variance points based on the physical signal samples according to the following formula, and making a variance map based on the variance points:
wherein sigma2Representing the variance of the characteristic bytes corresponding to different kinds of physical signal samples, N representing the number of samples of the acquired physical signal samples, xiRepresents the magnitude of the amplitude of the physical signal samples and μ represents the mean of the amplitudes of the physical signal samples.
In the method for extracting characteristics of an industrial control signal according to the present invention, the step S3 further includes:
s31, obtaining the waveform of the physical signal sample where the characteristic byte is located based on the variogram;
s32, calculating the waveform mean value of each category to be used as a reference signal of the characteristic byte of the category;
and S33, obtaining a correlation coefficient curve based on the waveform ranges of the reference signal and the physical signal sample.
In the method for extracting characteristics of an industrial control signal according to the present invention, the step S33 further includes calculating a correlation coefficient value of the correlation coefficient curve based on the following formula:
where ρ isXYRepresenting the value of the correlation coefficient, Cov (X, Y) representing the covariance of the random variables X and Y, D (X) and D (Y) representing the variance of the random variables X and Y, respectively, μxDenotes the mean value, μ, of the random variable XyRepresents a mean value of a random variable Y, wherein the random variable X represents the reference signal and the random variable Y represents a physical signal sample point within a waveform range of the physical signal sample.
Another technical solution to solve the technical problem of the present invention is to configure a computer-readable storage medium, on which a computer program is stored, and the computer program, when executed by a processor, implements the method for extracting characteristics of an industrial control signal.
By implementing the method for extracting the characteristics of the industrial control signals, the characteristics of the industrial control signals can be extracted through concise operation, and the method has high efficiency of identifying the characteristics of the industrial control signals and wide application range.
Drawings
The invention will be further described with reference to the accompanying drawings and examples, in which:
fig. 1 is a flowchart of a feature extraction method of an industrial control signal according to a first embodiment of the present invention;
fig. 2 is a flowchart of a feature extraction method of an industrial control signal according to a first embodiment of the present invention;
FIG. 3 is a schematic diagram of a sort command signal of the present invention;
FIG. 4 is a schematic diagram of the feature byte extraction of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
The invention relates to a method for extracting characteristics of industrial control signals, which comprises the following steps: s1, acquiring and preprocessing the industrial control signal to obtain a physical signal sample; s2, selecting at least two groups of physical signal samples from the physical signal samples to be used as feature byte variograms of different types of physical signal samples; s3, obtaining a correlation coefficient curve based on the variance map; and S4, obtaining the characteristic threshold values of the physical signal samples of different classes based on the correlation coefficient curve. By implementing the method for extracting the characteristics of the industrial control signals, the characteristics of the industrial control signals can be extracted through concise operation, and the method has high efficiency of identifying the characteristics of the industrial control signals and wide application range.
Fig. 1 is a flowchart of a feature extraction method of an industrial control signal according to a first embodiment of the present invention. In step S1, the industrial control signal is acquired and pre-processed to obtain a physical signal sample. In a preferred embodiment of the present invention, the instruction signal of the industrial control device may be obtained first, and then the instruction signal is classified in a labeling manner, so as to obtain a classification instruction signal. The physical signal samples may then be obtained by executing a classification command signal and then recording. In a further preferred embodiment of the invention, the normalization process may be performed on the physical signal samples.
In step S2, at least two groups of physical signal samples are selected from the physical signal samples to be used as feature byte variograms of different classes of physical signal samples. In a preferred embodiment of the present invention, at least two groups of physical signal samples with the same number and covering the value range variation range are selected from the physical signal samples, and then variance points are obtained based on the physical signal samples. Of course, in other preferred embodiments of the present invention, a person skilled in the art can make various signal selections according to actual needs, and can use any method known in the art to make a variogram.
In step S3, a correlation coefficient curve is obtained based on the variance map. In a preferred embodiment of the present invention, the waveform of the physical signal sample in which the characteristic byte is located is obtained based on the variance map. Further, the waveform mean of each class is calculated as a reference signal for the feature byte of the class. Then, a correlation coefficient curve is obtained based on the waveform ranges of the reference signal and the physical signal samples. In the invention, the analysis shows that the variance value of the curve segment where the characteristic byte is located is large, and the size is about 0.5, and the waveform range of the classification data of the characteristic can be obtained according to the characteristic. And observing how many classes the characteristic byte contains, and then calculating the mean value of the corresponding dimension of each class as a reference signal of the class. After the reference signal is obtained, the correlation coefficient is calculated by the points of the reference signal and the characteristic range corresponding to the normalized signal, and finally, a correlation coefficient curve under the reference signal is obtained.
In step S4, feature thresholds for different classes of physical signal samples are obtained based on the correlation coefficient curve. In the preferred embodiment of the present invention, if the feature byte contains a plurality of categories, a plurality of correlation coefficient curves are obtained, and the threshold for identifying classification data belonging to different categories can be determined by observing the distribution trend of the curves.
By implementing the method for extracting the characteristics of the industrial control signals, the characteristics of the industrial control signals can be extracted through concise operation, and the method has high efficiency of identifying the characteristics of the industrial control signals and wide application range.
Fig. 2 is a flowchart of a feature extraction method of an industrial control signal according to a first embodiment of the present invention. In step S1, a classification command signal of the industrial control device is acquired. In a preferred embodiment of the present invention, the industrial control device to be detected is selected, the instruction classification scheme of the industrial control device to be detected is selected, and then the industrial control signals of the industrial control device are classified by labeling based on the instruction classification scheme to obtain the classification instruction signals. Fig. 3 shows the sort instruction signal of the present invention.
In step S2, the sorting command signal is excited and the physical signal of the label corresponding to the sorting command signal is recorded. In a preferred embodiment of the present invention, the sorting command signal may be excited and the physical signal of the label tag corresponding to the sorting command signal may be based on trigger-stop recording. In a further preferred embodiment of the invention, the instruction function of the sorting instruction signal can be verified by replaying the sorting instruction signal. The physical signal with the classification label can be obtained by exciting the classification command signals of all functional classifications. Those skilled in the art will appreciate that any trigger-abort condition setting known in the signaling art may be used with the present invention. The skilled person can make relevant selections according to actual needs. The present invention is not limited by the specific trigger-abort conditions.
In step S3, the physical signal is normalized to obtain the physical signal sample. The waveform of the physical signal can be generally processed by adopting the normalization of positive and negative upper and lower limit values of a voltage value.
At step S4, at least two sets of physical signal samples with the same number and covering the range of value range variation are selected from the physical signal samples.
In step S5, a variance point is obtained according to a set formula based on the physical signal sample, and a variance map is constructed based on the variance point. In other preferred embodiments of the present invention, one skilled in the art can use any method known in the art to make a variogram according to actual needs.
In a preferred embodiment of the present invention, each variance point σ on the variance map can be calculated by the following formula2
Wherein sigma2Representing the variance of the characteristic bytes corresponding to different classes of classification command signals, N representing the number of samples of the collected classification command signals, xiRepresents the magnitude of the sample point amplitude and μ represents the mean of the sample point amplitudes.
In step S6, a waveform of the physical signal sample in which the feature byte is located is obtained based on the variance map. As known to those skilled in the art, the waveform of the physical signal sample may also be represented by the sequence number of the physical signal sample where the characteristic byte is located. In the preferred embodiment of the present invention, it is found by analysis that the variance value of the curve segment where the characteristic byte is located is large, and the size is about 0.5, and from this characteristic, the waveform range of the classification data of the characteristic can be obtained. Observe how many categories the signature byte contains.
In step S7, the waveform mean value of each class is calculated as a reference signal for the feature byte of the class. Figure 4 shows the characteristic bytes of the invention. In the invention, it can be observed how many classes the characteristic byte contains, and then calculate the mean value on the corresponding dimension of each class as the reference signal of the class. In other embodiments of the present invention, other reference signals may be used.
In step S8, a correlation coefficient curve is obtained based on the waveform ranges of the reference signal and the physical signal sample.
In a further preferred embodiment of the invention, the visual formula of the correlation coefficient algorithm is:
where ρ isXYRepresenting the value of the correlation coefficient, Cov (X, Y) representing the covariance of the random variables X and Y, d (X) and d (Y) representing the variance of the random variables X and Y, respectively, with X being the number of rows of the feature points on the abscissa and Y being the correlation coefficient on the ordinate.
In the invention, after the reference signal is obtained, the correlation coefficient is calculated by the reference signal and the point of the characteristic range corresponding to the normalized signal, and finally, the correlation coefficient curve under the reference signal is obtained. If the characteristic byte contains a plurality of categories, a plurality of correlation coefficient curves are obtained, and the threshold value for identifying physical signal samples belonging to different categories can be determined by observing the distribution trend of the curves.
In a further preferred embodiment of the present invention, the threshold is used to detect the receipt of a test sample (i.e., a test industrial control signal). For example, the correlation values of the test sample with various reference signals can be compared to a threshold value, which can be used as a feature to distinguish signal classes to see if it belongs to the corresponding class.
The method is based on the algorithm of calculating the variance and the correlation through statistics, firstly determines the interval range of the characteristic bytes, then calculates the correlation to obtain the threshold for identifying various signals, has simple operation, high identification efficiency and wide application range, and greatly develops the signal characteristic extraction technology.
The description of the invention also describes the implementation of particular functions and their interrelationships by means of method steps. The boundaries and sequence of these method steps have been specifically defined herein for the convenience of the description. The boundaries and sequence of these functions and relationships may be redefined so that they function properly. These redefinitions of boundaries and order are intended to fall within the spirit and scope of the claimed invention.
The present invention may also be implemented by a computer program product, comprising all the features enabling the implementation of the methods of the invention, when loaded in a computer system. The computer program in this document refers to: any expression, in any programming language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following: a) conversion to other languages, codes or symbols; b) reproduced in a different format.
While the invention has been described with reference to specific embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted without departing from the scope of the invention. In addition, many modifications may be made to adapt a particular situation or material to the teachings of the invention without departing from its scope. Therefore, it is intended that the invention not be limited to the particular embodiment disclosed, but that the invention will include all embodiments falling within the scope of the appended claims.
Claims (6)
1. A method for extracting features of industrial control signals is characterized by comprising the following steps:
s1, acquiring and preprocessing the industrial control signal to obtain a physical signal sample;
s2, selecting at least two groups of physical signal samples from the physical signal samples to be used as feature byte variograms of different types of physical signal samples;
s3, obtaining a correlation coefficient curve based on the variance map;
s4, obtaining characteristic thresholds of different types of physical signal samples based on the correlation coefficient curve;
the step S3 further includes:
s31, obtaining the waveform of the physical signal sample where the characteristic byte is located based on the variogram;
s32, calculating the waveform mean value of each category to be used as a reference signal of the characteristic byte of the category;
s33, obtaining a correlation coefficient curve based on the waveform ranges of the reference signal and the physical signal sample;
the step S2 further includes selecting at least two groups of physical signal samples that are equal in number and cover the range of value range from the physical signal samples, then obtaining variance points based on the physical signal samples, and making the variance map based on the variance points.
2. The method for extracting features of industrial control signals according to claim 1, wherein the step S1 further includes:
s11, acquiring a classification instruction signal of the industrial control equipment;
s12, exciting the classification command signal and recording the physical signal of the label corresponding to the classification command signal;
and S13, carrying out normalization processing on the physical signal to obtain the physical signal sample.
3. The method for extracting features of industrial control signals according to claim 2, wherein the step S11 further includes:
s111, selecting industrial control equipment to be detected and selecting an instruction classification scheme of the industrial control equipment to be detected;
and S112, classifying the industrial control signals of the industrial control equipment in a labeling mode based on the instruction classification scheme to obtain classification instruction signals.
4. The method for extracting features of industrial control signals according to claim 1, wherein in the step S2,
the variance point is obtained according to the following formula:
wherein sigma2Representing the variance of the characteristic bytes corresponding to different kinds of physical signal samples, N representing the number of samples of the acquired physical signal samples, xiRepresents the magnitude of the amplitude of the physical signal samples and μ represents the mean of the amplitudes of the physical signal samples.
5. The method for extracting features of industrial control signals according to claim 1, wherein the step S33 further includes calculating the correlation coefficient value of the correlation coefficient curve based on the following formula:
where ρ isXYRepresenting the value of the correlation coefficient, Cov (X, Y) representing the covariance of the random variables X and Y, D (X) and D (Y) representing the variance of the random variables X and Y, respectively, μxDenotes the mean value, μ, of the random variable XyRepresents a mean value of a random variable Y, wherein the random variable X represents the reference signal and the random variable Y represents a physical signal sample point within a waveform range of the physical signal sample.
6. A computer-readable storage medium, on which a computer program is stored, wherein the program, when executed by a processor, implements a method for feature extraction of an industrial control signal according to any one of claims 1 to 5.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201810902497.4A CN109271855B (en) | 2018-08-09 | 2018-08-09 | Method for extracting characteristics of industrial control signals |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201810902497.4A CN109271855B (en) | 2018-08-09 | 2018-08-09 | Method for extracting characteristics of industrial control signals |
Publications (2)
Publication Number | Publication Date |
---|---|
CN109271855A CN109271855A (en) | 2019-01-25 |
CN109271855B true CN109271855B (en) | 2021-07-09 |
Family
ID=65153484
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201810902497.4A Active CN109271855B (en) | 2018-08-09 | 2018-08-09 | Method for extracting characteristics of industrial control signals |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN109271855B (en) |
Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8019702B1 (en) * | 2007-12-07 | 2011-09-13 | Google Inc. | Supervised learning with multi-scale time intervals using a statistical classification model to classify unlabeled events |
CN102780700A (en) * | 2012-07-27 | 2012-11-14 | 天津市亚安科技股份有限公司 | Method and device for realizing baud rate and protocol self-adaption in video monitoring field |
CN106209843A (en) * | 2016-07-12 | 2016-12-07 | 工业和信息化部电子工业标准化研究院 | A kind of data flow anomaly towards Modbus agreement analyzes method |
CN107181724A (en) * | 2016-03-11 | 2017-09-19 | 华为技术有限公司 | A kind of recognition methods for cooperateing with stream, system and the server using this method |
CN107689847A (en) * | 2017-09-30 | 2018-02-13 | 电子科技大学 | Mark auxiliary radio communication system signal method of sending and receiving |
CN107809310A (en) * | 2017-11-15 | 2018-03-16 | 深圳大学 | Information detecting method, device and receiving device based on packet variance |
CN108108712A (en) * | 2017-12-29 | 2018-06-01 | 哈尔滨工业大学 | A kind of Emitter Fingerprint feature extracting method based on variance dimension |
Family Cites Families (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20130304739A1 (en) * | 2012-05-10 | 2013-11-14 | Samsung Electronics Co., Ltd. | Computing system with domain independence orientation mechanism and method of operation thereof |
-
2018
- 2018-08-09 CN CN201810902497.4A patent/CN109271855B/en active Active
Patent Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8019702B1 (en) * | 2007-12-07 | 2011-09-13 | Google Inc. | Supervised learning with multi-scale time intervals using a statistical classification model to classify unlabeled events |
CN102780700A (en) * | 2012-07-27 | 2012-11-14 | 天津市亚安科技股份有限公司 | Method and device for realizing baud rate and protocol self-adaption in video monitoring field |
CN107181724A (en) * | 2016-03-11 | 2017-09-19 | 华为技术有限公司 | A kind of recognition methods for cooperateing with stream, system and the server using this method |
CN106209843A (en) * | 2016-07-12 | 2016-12-07 | 工业和信息化部电子工业标准化研究院 | A kind of data flow anomaly towards Modbus agreement analyzes method |
CN107689847A (en) * | 2017-09-30 | 2018-02-13 | 电子科技大学 | Mark auxiliary radio communication system signal method of sending and receiving |
CN107809310A (en) * | 2017-11-15 | 2018-03-16 | 深圳大学 | Information detecting method, device and receiving device based on packet variance |
CN108108712A (en) * | 2017-12-29 | 2018-06-01 | 哈尔滨工业大学 | A kind of Emitter Fingerprint feature extracting method based on variance dimension |
Non-Patent Citations (2)
Title |
---|
Features extraction and analysis for classifying causable patterns in control charts;Khaled Assaleh et al.;《Computers & Industrial Engineering》;20050831;第49卷(第1期);全文 * |
雷达辐射源特征提取和个体识别;杨凡;《中国优秀硕士学位论文全文数据库 信息科技辑》;20180615(第06期);全文 * |
Also Published As
Publication number | Publication date |
---|---|
CN109271855A (en) | 2019-01-25 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN107276805B (en) | Sample prediction method and device based on intrusion detection model and electronic equipment | |
CN108030494B (en) | Electrocardiosignal error flag training sample recognition methods based on cross validation | |
CN101984450B (en) | Malicious code detection method and system | |
CN108957251B (en) | Cable joint partial discharge mode identification method | |
CN110795732A (en) | SVM-based dynamic and static combination detection method for malicious codes of Android mobile network terminal | |
CN113435546B (en) | Migratable image recognition method and system based on differentiation confidence level | |
CN109992969B (en) | Malicious file detection method and device and detection platform | |
CN107688742B (en) | Large-scale rapid mobile application APP detection and analysis method | |
CN112733146B (en) | Penetration testing method, device and equipment based on machine learning and storage medium | |
EP3905084A1 (en) | Method and device for detecting malware | |
CN108508297B (en) | Fault arc detection method based on mutation coefficient and SVM | |
CN111753290A (en) | Software type detection method and related equipment | |
CN108900538B (en) | Industrial control signal detection method and device | |
CN115396204A (en) | Industrial control network flow abnormity detection method and device based on sequence prediction | |
CN114024761B (en) | Network threat data detection method and device, storage medium and electronic equipment | |
CN109271855B (en) | Method for extracting characteristics of industrial control signals | |
CN111950606A (en) | Disconnecting link state identification method, device, equipment and storage medium | |
CN116707992A (en) | Malicious traffic avoidance detection method based on generation countermeasure network | |
CN110718270B (en) | Method, device, equipment and storage medium for detecting type of gene sequencing result | |
CN114970694B (en) | Network security situation assessment method and model training method thereof | |
CN112163217B (en) | Malware variant identification method, device, equipment and computer storage medium | |
KR102247179B1 (en) | Xai-based normal learning data generation method and device for unsupervised learning of abnormal behavior detection model | |
CN113468555A (en) | Method, system and device for identifying client access behavior | |
CN112528893A (en) | Abnormal state identification method and device and computer readable storage medium | |
CN108062473B (en) | Training set pruning and malicious program identification method and device |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant |