工业控制系统软件的用户操作异常检测方法 - 中国测试.pdf

第40卷第4期 中国测试 Vol.40 No.4 2014年7月 CHINA MEASUREMENT TEST July，2014 doi院10.11857/j.issn.1674-5124.2014.04.025 工业控制系统软件的用户操作异常检测方法 文元美袁 余雪晨 （广东工业大学信息工程学院，广东 广州 510006） 摘 要院针对工业控制网络终端控制系统软件的用户行为安全问题，提出用户操作层面行为可信评估的方法。首先从 软件日志文档中提取出整数数列的历史序列，然后引入Apriori方法进行用户操作行为序列频繁模式挖掘，并基于挖 掘出的模式集建立概率矩阵，最后通过提取当前用户行为序列，基于BLAST-SSAHA算法与历史序列模式集序列匹 配，对用户行为可信性进行检测，为后续系统平台可信性评估提供依据。实验表明：文章提出的方法是有效可行的。 工业控制网 关键词院用户操作异常；数据挖掘；模式匹配； + 中图分类号院TP301曰TP311.53曰TP206 .3曰O224 文献标志码院A 文章编号院1674-5124渊2014冤04-0098-04 User operation anomaly detection method of software in industrial control system WEN Yuan-mei，YU Xue-chen （School of Information Engineering，Guangdong University of Technology，Guangzhou 510006，China） Abstract: A behavior trust evaluation method was proposed to solve the problem of user behavior security of terminal control system software for industrial control network. Firstly，history sequences in the form of numerical array were extracted from the log file of software. Then，the Apriori mining algorithm was exploited to obtain the frequent sequential patterns from user action sequence， and a matrix of probabilities was established upon mined patterns. Finally，the credibility of user behavior was detected by extracting the current user behavior sequence to match with the sequence in historical sequence pattern set based on BLAST-SSAHA algorithm. These results can provide the basis for evaluating the credibility of the system. The experimental and analytical results show that the effectiveness and feasibility of the met