基于概率本体的CPS入侵检测方法研究

Cyber Physical System security has become a hot topic and has attracted the most attention. However, the current CPS intrusion detection technology, in varying degrees, exist the problems of high false alarm rate, poor real-time performance, not easy knowledge sharing and so on. Since the probabilistic ontology has advantages in the description of semantic relations between concepts, structured information sharing, model evolution, uncertain knowledge representation and reasoning. Therefore, it was introduced into the field of intrusion detection of CPS. Doing research in probabilistic ontology representation, reasoning and inference process visualization, comprehensible rules generation in CPS intrusion detection, which is to improve the accuracy and intelligibility of intrusion detection. On this basis, doing research into intrusion detection rule evaluation methods and the CPS rules exchange algorithm to improve learning efficiency and system interoperability between subsystems; Exploring joint cross-layer optimization approach combining task scheduling in application layer, which is to shorten communication delay in distributed intrusion detection and finally fulfill an accurate, collaborative, real-time distributed intrusion detection. Through the above theoretical research, and strive to achieve breakthrough results in the probabilistic ontology modeling and reasoning, knowledge exchange, as well as other aspects of cross-layer optimization in CPS, which provide a theoretical basis and technical support for the study of CPS security-related fields.

CPS（信息物理融合系统）的安全是备受关注的热点问题。然而，当前的CPS入侵检测方法在不同程度上存在误警率高、实时性差、不便于知识共享等问题。由于概率本体在概念间语义关系的描述、结构化信息共享、模型可演化、以及不确定知识表示和推理等方面有优势，本课题将其引入CPS的入侵检测领域。通过CPS入侵检测的概率本体表示方法、推理方法以及推理过程可视化、规则表达可交互的研究，提高入侵检测的准确性和可理解性；在此基础上，研究入CPS入侵检测规则的评估方法以及规则交换算法，提高子系统的学习效率和系统间的协同能力；探索结合应用层任务调度的跨层联合优化方法，缩短分布式入侵检测的通信延时，最终实现准确、协同、实时CPS分布式入侵检测。通过上述理论研究，争取在概率本体建模与推理、知识交换、以及CPS跨层优化等方面取得突破性的成果，为CPS安全相关领域的研究提供理论基础和技术支撑。

本课题主要搭建了CPS入侵检测平台，搜集最新恶意软件，实现了对CPS子系统的攻击，采集相关的入侵特征数据，供入侵检测分类器在线检测和离线学习之用；利用本体工具protege对CPS安全进行本体描述，采用Netica工具构建贝叶斯网络，实现基于概率本体的可视化推理。同时，针对CPS系统环境下处理硬实时作业的调度算法进行研究，将调度后的任务紧迫系数传递给网络下层，实现跨层联合优化。最后，对保证CPS实时和可靠性重要影响的网络延时抖动消除进行了研究，缩短分布式入侵检测的通信延时，最终实现准确、协同、实时 CPS 分布式入侵检测。