关键词: SCADA系统, 高级持续性攻击（APT）, 行为模式, 矩阵相似度

Abstract: Advanced persistent threat (APT) as a new attack, has become a major threat to the security of SCADA (supervisory control and data acquisition) systems, while the existing intrusion detection technology can not effectively deal with this type of attack, so the research on valid APT detection model is very significant. This paper proposes a new APT attack detection method. In this method, behavior patterns of the logging behavior are characterized by characteristic substring sequences of different lengths, and sequence supports are employed to construct the normal behavior profiles. Considering the complex characteristics of APT attack, this paper proposes a detection model based on similarity matrix matching and preset threshold to determine that the logging behavior is normal or anomalous. Through the comparative analysis, the detection method proposed in this paper shows good detection performance.

Key words: SCADA system, advanced persistent threat (APT), behavior pattern, matrix similarity