| In recent years,cyber attacks against energy infrastructure control systems have occurred frequently,posing a huge threat to social security and production security.As an important link in oil storage,it is urgent to carry out technical research on network security protection.However,due to the real-time and continuous operation of its control system,it is difficult to directly carry out research on the real operating system.Therefore,on the basis of sufficient research and analysis,this paper establishes a simulation platform that reflects the typical process flow and control strategy of oil storage,and conducts research on virtual attack simulation,testing and anomaly detection algorithms on this platform.The main work is summarized as follows:(1)Design the overall system framework of the simulation platform according to the process flow and control strategy of the real oil depot.Based on physical equipment and PLC controllers,an on-site control layer is established to represent the real production process;virtual physical models are constructed based on Matlab simulation software to achieve expansion and supplementation of complex process control;Kingview software realizes data acquisition,on-site monitoring,and other functions and forms a monitoring layer;establishes network communication between components based on Modbus TCP protocol,and sets the clock synchronization between the real-time module(Real-Time)in the Matlab simulation software and the PLC controller,to ensure the real-time and effectiveness of communication.(2)According to the characteristics of industrial control network and attack characteristics,the control loop model of oil tank is established,and seven attack modes of point attack and control loop attack are designed.The virtual attack test is carried out based on the simulation platform,and the characteristics and abnormal effects of each attack are analyzed.The Kingview database is used to collect equipment information and network information,and the normal data and abnormal data are marked to form a complete self-built oil depot data set.(3)Research anomaly detection models based on self-built oil depot data sets and related public industrial control data sets,and propose a multialgorithm fusion improved RBF anomaly detection algorithm and anomaly detection algorithm based on small sample learning(RPN-RMN),which is combined with other anomaly detection algorithms.The comparison shows that the proposed algorithm can improve the detection accuracy and reduce the false negative rate,and has practical application significance;each anomaly detection algorithm performs well in the classification of the selfbuilt oil depot data set,indicating that the data set has obvious attack characteristics and has certain application value. |
