Industrial control system intrusion detection method based on small sample learning

Abstract

The invention discloses an industrial control system intrusion detection method based on small sample learning. The method comprises the following steps: dividing an original data set extracted from industrial control system network traffic into a detection model training set and a basic model training set; performing dimension reduction on continuous data matrixes in the basic model training setand the detection model training set by using a principal component analysis method; encoding discrete data matrixes in the basic model training set and the detection model training set by using a one-hot encoding method; constructing a small sample training task required by basic model training by using the processed basic model training set; training a basic model based on a convolutional neuralnetwork by means of the constructed small sample training task; based on the trained basic model, using the processed detection model training set for further training, and obtaining a detection model. By means of the center vectors of three different types of samples of the original data set, real-time and effective detection of potential attacks in the network data flow is achieved.

Description

technical field [0001] The invention relates to the technical field of intrusion detection for industrial control systems, in particular to an intrusion detection method for industrial control systems based on small sample learning. Background technique [0002] The industrial control system is used to support the interconnection and communication between the various components in the industrial production process, and to ensure the stable and orderly progress of the industrial production process. Most of the early industrial production processes only involved communication between small-scale and dedicated hardware. Therefore, traditional industrial control systems are naturally closed. Except for internal system failures, there is no need to worry about large-scale network attacks. However, with the development of Internet information technology, technologies such as Information and Communications Technology (ICT), automation, distributed control, wide-area monitoring and ...

AI Technical Summary

Problems solved by technology

[0005] (1) Long-term training is required before detecting a specific attack, and it is difficult to cope with the real-time changing industrial control system environment;

[0006] (2) It can only effectively detect attack types with a large number of malicious samples for training, and it is difficult to detect those attack types with only a small number of samples;

[0007] (3) It can only distinguish between normal samples and abnormal samples, and cannot further distinguish new attack samples

[0009] 1. The detection method using traditional machine learning technology needs to be trained with a large number of similar samples to learn the potential characteristics of this type of attack, and due to the huge number of samples in the training phase, it takes a long time

[0010] 2. In order to learn the potential features in the attack data, traditional machine learning methods usually use unimproved deep neural networks with complex structures. When the sample size is small, traditional machine learning methods tend to overfit. Therefore, small sample attacks cannot be effectively detected;

[0011] 3. The traditional detection method does not consider the acquisition of new attack samples. Therefore, it is usually a binary classification model, that is, only normal samples and abnormal samples are distinguished, and abnormal samples are not further classified.

Images