关键词: 工业控制网络, OPC协议, 白名单, PSO-BP算法, 异常检测, 自适应变异

Abstract: Abstract: In response to anomaly detection in industry control networks with OPC protocol, an anomaly detection method integrated white list filter and unsupervised learning algorithm based on adaptive mutation of PSO-BP neural network was proposed. Firstly, use the white list technology filters the communication behaviors that could not match with the white list rules base at first time, and then use the results of sample training by offline unsupervised learning in neural network system filters the abnormal communication behaviors that trusted with the white list at second time. Using neural network to improve the detection rate under incomplete information, and according to the neural network detection results, constantly improve the white list rule library, improve the detection rate of abnormal communication over network.The adaptive mutation process was added to the PSO-BP algorithm to avoid fall into the local optimal solution prematurely during the training process. The experimental data of KDD CUP99 using the training set and test, the accuracy of anomaly detection enhance the accuracy.And realized the purpose of making use of the depth learning to adjust the white list rule to make up for the shortage of the traditional white list technology.

Key words: Industrial control network, OPC protocol, white list, PSO-BP algorithm, anomaly detection, adaptive mutation