Behavior Prediction for Industrial Control System

While the Industrial control system(ICS) is making great progress for the society, it is facing a huge security risk at the same time. There are some methods like upgrading system and updating patches to protect the ICS, but they are inevitable lagging behind anyway. Byte-level is useful for network intrusion detection and does not need knowledge of the device to be detected. Based on the network data in the industrial control system, we propose an adaptive DBSCAN clustering method for extracting the control instructions in the data packet, and then learning these instructions with the n-gram model. According to received instructions, we are able to predict the next possible instruction. Whether the system is being attacked can be recommended by comparing the instruction that we forecast with the real instruction. Experiments show that the behavior prediction has high accuracy.