An abnormal user login behavior detection method of industrial control system based on multi-dimensional probability analysis

Abstract Aiming at the poor detection performance of user abnormal login behavior in the complex environment of industrial control system, a new method based on multi-dimensional probability analysis is proposed. First of all, login time, source, destination and other login parameters are collected. Secondly, the abnormal probability of login parameters is calculated. Thirdly, the login transfer probability among multiple destination hosts is calculated. Finally, through the comprehensive analysis of the above three probabilities, an abnormal login behavior detection model based on multi-dimensional probability analysis is constructed. Experiments show that this method can effectively identify the abnormal login behavior of users caused by various types of network attacks.