基于粒子滤波的工业控制网络态势感知建模

粒子滤波(Particle filtering，PF)算法能有效地对工控系统这一类非线性、非高斯噪声系统进行状态估计，但在实际采用经典粒子滤波状态估计检测攻击时，实验结果显示该方法存在很高的漏检率，无法保障系统安全.因此改进经典算法，提出了基于粒子滤波输入估计的态势理解算法.该算法在考虑系统输入与输出关系的同时，结合蒙特卡洛思想，提取工控系统态势特征，计算态势指标，最终实现态势理解.实验结果表明，该算法能有效地感知持续性攻击，并判断系统态势.

Modeling of Industrial Control Network Situation Awareness With Particle Filtering

Particle filtering (PF) algorithm can estimate the states of industrial control systems, which are non-linear and have non-Gaussian noises. However, when using classical particle filtering state estimation to detect continuous attacks, it is shown that the false negative rate is too high to ensure the security of the system. Therefore, a situation perception algorithm by means of particle filtering input estimation is proposed to improve the effectiveness of the classical algorithm. Considering the relationship between system input and output and combining Monte-Carlo simulation, the proposed algorithm can extract industrial control system situation features, calculate situation metrics and realize the situation perception. Experimental results indicate that the proposed algorithm can recognize continuous attacks and judge the system situation effectively.