Malware in the network environment is a serious threat to the security of industrial control systems. With the gradual increase of malware variants, it brings great challenges to the detection and security protection of industrial control system malware. The existing detection methods have limitations such as low intelligence in adaptive detection and recognition. In response to this problem, this paper designs a detection application method framework by combining the use of reinforcement learning, an advanced machine learning algorithm, around the malware objects that threaten the network security of industrial control systems. In the implementation process, according to the actual needs of malware behavior detection, fully combined with intelligent features such as sequential decision-making and dynamic feedback learning of reinforcement learning, the key application modules such as feature extraction network, policy network and classification network are discussed and designed in detail. The application experiments based on the actual malware test data set verify the effectiveness of the method in this paper, which can provide an intelligent decision-making aid for general malware behavior detection.

With the great changes brought about by digitization, traditional security threat detection capabilities have been greatly challenged. Traditional threat detection technologies are based on signatures, rules and manual analysis, and there are serious lags and blind spots in security visibility. Unknown attacks cannot be detected and are easily bypassed. Multi-scale user behavior fusion analysis uses artificial intelligence methods and spatiotemporal feature engineering to associate multisource heterogeneous user behavior feature data to realize threat detection of multi-modal and multi-scale data.