Anti-attack and defense method based on LSTM (Long Short Term Memory) detector

Abstract

The invention discloses an anti-attack and defense method based on an LSTM (Long Short Term Memory) detector. The method comprises the following steps that: 1) generating a candidate detector of an LSTM-FNN (Fuzzy Neural Network) structure, and asking the detector to detect abnormal samples as more as possible on a premise that the detector does not misjudge a normal sample; 2) storing the candidate detector into a register queue, detecting a training dataset by an abnormality detector taken out of the register queue, and deleting the detected abnormal sample to enable different abnormality detectors to cover different abnormal areas; and 3) in a detection stage, detecting a detected sample by all abnormality detectors, and comprehensively judging whether the sample is abnormal or not. Byuse of the method, a neural network is combined with a negative selection algorithm, each LSTM detector guarantees that the normal sample can not be misjudged, the abnormality detector set guaranteesthat the abnormal situation may be covered, and an algorithm detection effect is improved.

Description

technical field [0001] The invention belongs to the technical field of industrial control security, and in particular relates to an LSTM detector-based anti-attack defense method. Background technique [0002] Industrial Control System (ICS) is an integral part of the country's important infrastructure and is widely used in various fields, including chemical industry, pharmaceuticals, hydropower energy, natural gas, aerospace and other fields. However, with the combination of networking and automation with industrial control systems, the cyber attack surface of industrial control systems is gradually expanding, making it more important than ever to develop innovative solutions for ICS security. In view of the fact that the data acquired by the industrial control system through the sensor or the data transmitted in the network is mainly time-series data, the extraction of key information of the time-series data and the defense mechanism of hidden attacks have become the key t...

AI Technical Summary

Problems solved by technology

[0007] In order to overcome the disadvantages of poor detection effect and low security in the prior art, the present invention provides an LSTM detector-based adversarial attack defense method with high detection effect and high security, which combines the negative selection algorithm with the LSTM algorithm Combined to generate LSTM adversarial sample detectors, so that each adversarial sample detector has a better detection effect, and multiple LSTM adversarial sample detectors with simple structures are used to detect samples, increasing the overall detection rate of the experiment

Images