工业控制网络流量特性分析与建模
|
摘要
采集了真实环境中的基于工业以太网的工业控制网络流量,通过对流量特性的分析发现其流量特性与普通IT网络流量特性的差异,并详细分析了其成因.通过分析发现,工业控制网络流量分布整体较规律,数据包时间间隔既不服从泊松分布又不服从重尾分布,小时间尺度上具有周期性,没有表现出自相似的特性,大时间尺度上则较为平稳.最后,应用季节乘积ARIMA模型对工业网络流量进行了实证分析.结果表明:应用该模型对工业网络流量进行建模预报是可行可靠的.
This paper collects network traffic of an industrial control system that is based on industrial Ethernet in a real environment. By analyzing the characteristics of the network,it is found that there is an obvious difference between the characteristics of industrial control network and ordinary IT network. The cause of the difference is carefully analyzed. The traffic of industrial control network has a relatively regularity. As a whole,the distribution packet intervals neither follow a Poisson distribution nor subject to heavy tailed distribution. In a small time scale,the traffic has a periodicity and it does not show selfsimilarity,while it is stationary in a large time scale. Finally,a multiple seasonal ARIMA model is used to make empirical analysis on the industrial network traffic. Results show that the model is feasible and reliable.
This paper collects network traffic of an industrial control system that is based on industrial Ethernet in a real environment. By analyzing the characteristics of the network,it is found that there is an obvious difference between the characteristics of industrial control network and ordinary IT network. The cause of the difference is carefully analyzed. The traffic of industrial control network has a relatively regularity. As a whole,the distribution packet intervals neither follow a Poisson distribution nor subject to heavy tailed distribution. In a small time scale,the traffic has a periodicity and it does not show selfsimilarity,while it is stationary in a large time scale. Finally,a multiple seasonal ARIMA model is used to make empirical analysis on the industrial network traffic. Results show that the model is feasible and reliable.
引文
[1]冯冬芹,廖智军,金建祥,等.基于以太网的工业控制网络实时通信模型研究[J].仪器仪表学报,2005,26(9):891-894.FENG Dong-qin,LIAO Zhi-jun,JIN Jian-xiang,et al.Study on real-time communication models for Ethernetbased industrial control network[J].Chinese Journal of Scientific Instrument,2005,26(9):891-894.(in Chinese)
[2]王浩,吴中福,王平.工业控制网络安全模型研究[J].计算机科学,2007,34(5):96-98.WANG Hao,WU Zhong-fu,WANG Ping.Research on security model for industrial control networks[J].Computer Science,2007,34(5):96-98.(in Chinese)
[3]The University of Waikato.traffic traces[EB/OL].[2014-01-10].http:∥wand.net.nz/wits/Waikato/1/20040507-233830-64.php.
[4]侯重远,江汉红,芮万智,等.工业网络流量异常检测的概率主成分分析法[J].西安交通大学学报,2012,46(2):70-75.HOU Zhong-yuan,JIANG Han-hong,RUI Wan-zhi,et al.A probabilistic principal component analysis approach for detecting traffic anomaly in industrial networks[J].Journal of Xi'an Jiaotong University,2012,46(2):70-75.(in Chinese)
[5]袁小坊.IP网络测量数据存储与流量建模研究[D].长沙:湖南大学计算机与通信学院,2010.YUAN Xiao-fang.The research on data storage and traffic modeling in IP network measurement[D].Changsha:Institute of Computer Science and Communication,Hunan University,2010.(in Chinese)
[6]张宾,杨家海,吴建平.Internet流量模型分析与评述[J].软件学报,2011,22(1):115-131.ZHANG Bin,YANG Jia-hai,WU Jian-ping.Survey and analysis on the Internet traffic model[J].Journal of Software,2011,22(1):115-131.(in Chinese)
[7]KARAGIANNIS T,MOLLE M,FALOUTSOS M,et al.A nonstationary poisson view of Internet traffic[C]∥23rd Annual Joint Conference of the IEEE Computer and Communications Societies.Hong Kong:IEEE,2004,3:1558-1569.
[8]LELAND W E,TAQQU M S,WILLINGER W,et al.On the self-similar nature of Ethernet traffic[C]∥ACM SIGCOMM Computer Communication Review.New York:ACM,1993,23(4):183-193.
[9]韩忠玲.分形高斯噪声Hurst参数估计的实验评价[D].上海:华东师范大学信息学院,2008.HAN Zhong-ling.Experimental evaluation on methods of the Hurst parameter estimation using fractional Gaussian noise[D].Shanghai:Institute of Information,East China Normal University,2008.(in Chinese)
[10]WILLINGER W,TAQQU M S,SHERMAN R,et al.Self-similarity through high-variability:statistical analysis of Ethernet LAN traffic at the source level[J].IEEE Transaction on Networking,1997,5(1):71-86.
[11]SHUMMAP R H.Time series analysis and its applications[M].2nd ed.New York:Springer,2009:42-56.
[12]王燕.应用时间序列分析[M].3版.北京:中国人民大学出版社,2012:68-87.
[2]王浩,吴中福,王平.工业控制网络安全模型研究[J].计算机科学,2007,34(5):96-98.WANG Hao,WU Zhong-fu,WANG Ping.Research on security model for industrial control networks[J].Computer Science,2007,34(5):96-98.(in Chinese)
[3]The University of Waikato.traffic traces[EB/OL].[2014-01-10].http:∥wand.net.nz/wits/Waikato/1/20040507-233830-64.php.
[4]侯重远,江汉红,芮万智,等.工业网络流量异常检测的概率主成分分析法[J].西安交通大学学报,2012,46(2):70-75.HOU Zhong-yuan,JIANG Han-hong,RUI Wan-zhi,et al.A probabilistic principal component analysis approach for detecting traffic anomaly in industrial networks[J].Journal of Xi'an Jiaotong University,2012,46(2):70-75.(in Chinese)
[5]袁小坊.IP网络测量数据存储与流量建模研究[D].长沙:湖南大学计算机与通信学院,2010.YUAN Xiao-fang.The research on data storage and traffic modeling in IP network measurement[D].Changsha:Institute of Computer Science and Communication,Hunan University,2010.(in Chinese)
[6]张宾,杨家海,吴建平.Internet流量模型分析与评述[J].软件学报,2011,22(1):115-131.ZHANG Bin,YANG Jia-hai,WU Jian-ping.Survey and analysis on the Internet traffic model[J].Journal of Software,2011,22(1):115-131.(in Chinese)
[7]KARAGIANNIS T,MOLLE M,FALOUTSOS M,et al.A nonstationary poisson view of Internet traffic[C]∥23rd Annual Joint Conference of the IEEE Computer and Communications Societies.Hong Kong:IEEE,2004,3:1558-1569.
[8]LELAND W E,TAQQU M S,WILLINGER W,et al.On the self-similar nature of Ethernet traffic[C]∥ACM SIGCOMM Computer Communication Review.New York:ACM,1993,23(4):183-193.
[9]韩忠玲.分形高斯噪声Hurst参数估计的实验评价[D].上海:华东师范大学信息学院,2008.HAN Zhong-ling.Experimental evaluation on methods of the Hurst parameter estimation using fractional Gaussian noise[D].Shanghai:Institute of Information,East China Normal University,2008.(in Chinese)
[10]WILLINGER W,TAQQU M S,SHERMAN R,et al.Self-similarity through high-variability:statistical analysis of Ethernet LAN traffic at the source level[J].IEEE Transaction on Networking,1997,5(1):71-86.
[11]SHUMMAP R H.Time series analysis and its applications[M].2nd ed.New York:Springer,2009:42-56.
[12]王燕.应用时间序列分析[M].3版.北京:中国人民大学出版社,2012:68-87.