Research on the Application Mode of Security Defense Service of the Closed-source Power Industrial Control System

Aiming at the long-life cycle, stable topology and predictable behavior characteristics of power industrial control system, the security defense service application mode of power industrial control system based on the combination of “off-line learning” and “on-line analysis” is studied. In the “off-line learning” stage, the behavior pattern of the power industrial system is characterized and classified. Therefore, the multi-area basic data extraction and featurization can be established. In the “online analysis” stage, the scenarios such as “operation data extraction in different scenarios”, “abnormal behavior identification based on the baseline” and “collaborative threat defense” are designed, and the technical requirements of the defense architecture and defense model corresponding to the power industrial control system security defense service application mode are summarized. Based on the case where machine learning method is applied in the anomaly detection, the effectiveness and correctness of the security application mode is verified.