Research on Industrial Control Anomaly Detection Based on FCM and SVM

摘要

In order to solve the problem of virus and Trojan attacking the application layer network protocol of industrial control system, the rule of Modbus/TCP communication protocol is analyzed. An intrusion detection method based on clustering and support vector machine is proposed. The method combines unsupervised fuzzy C-means clustering (FCM) with supervised support vector (SVM) machine to calculate the distance between industrial control network communication data and cluster center. Partial data satisfying the threshold condition is further classified by support vector machine. Experimental results show that compared with the traditional intrusion detection method, this method can effectively reduce the training time and improve the classification accuracy without needing to know the class label in advance.