Industrial internet intrusion detection method based on multi-discriminator condition classification generative adversarial network

Abstract

The invention relates to an industrial internet intrusion detection method based on a multi-discriminator condition classification generative adversarial network, and belongs to the field of industrial internet security. The method comprises the steps that a class imbalance data set of intrusion detection is acquired, and the class imbalance data set comprises a plurality of normal samples, attack samples with the number smaller than that of the normal samples and labels corresponding to all the samples; preprocessing the class imbalance data set, and dividing the data set; establishing a multi-discriminator condition classification generative adversarial network, and performing pre-training based on the divided data set; generating various attack samples through a pre-trained multi-discriminator condition classification generative adversarial network to obtain a class balance data set; establishing an intrusion detection model, and training the intrusion detection model by adopting the class balance data set; the trained intrusion detection model is used for real-time intrusion detection. According to the method, the problem of low detection rate of minority class attacks caused by unbalanced data samples in traditional intrusion detection is solved.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet security and relates to an industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network. Background Art

[0002] With the expansion of internet technology applications, technological upgrades in traditional industrial manufacturing systems, and the vigorous development of industrial internet infrastructure and technologies such as 5G and IPv6, the industrial internet is moving towards larger-scale and deeper interconnected networks. Powered by the industrial internet, manufacturing companies can achieve higher levels of automation and intelligent production. The industrial internet also presents opportunities for digital transformation in traditional manufacturing, driving industry upgrades and innovation towards intelligent manufacturing. The primary value of the industrial internet lies in promoting efficient operations, low-cost production, and intelligent management in the manufacturing industry through intelligent connectivity, data analysis, and optimization, ultimately enhancing the competitiveness and sustainable development capabilities of enterprises. The industrial internet is playing an increasingly important role in the next generation of industrial reform. In this context, the industrial internet will serve as a bridge connecting traditional industrial systems with emerging internet industries, providing fundamental support for the upgrading of traditional industries.

[0003] The Industrial Internet is building a new manufacturing and service system while also breaking the relatively closed and trustworthy state of the traditional industrial environment. Due to its unique value, resources, and technology, the Industrial Internet is more vulnerable to internal and external attacks and faces more serious information security risks. Security incidents targeting the industrial sector are constantly emerging, and the harm is becoming increasingly serious. Cyberattacks have become a key factor restricting the development of the Industrial Internet. Therefore, research on intrusion detection is of great significance to the safe and stable operation of the network.

[0004] An intrusion detection system (IDS) is a key means of network security protection. Simply put, an IDS is a network security device that monitors network transmissions and systems in real time. When suspicious activity occurs, the system automatically issues an alarm or takes appropriate action, providing management with decision-making support. As an active defense technology that effectively protects network security, intrusion detection has been widely researched. In recent years, many innovative intrusion detection techniques have been proposed, and researchers typically categorize intrusion detection problems as either binary or multi-classification problems. Deep learning technology, thanks to its excellent performance in classification tasks, has been widely used in the field of intrusion detection.

[0005] At present, although deep learning has made great progress in the field of intrusion detection due to its powerful learning ability, it still has its shortcomings.

[0006] In real-world industrial internet network security defense scenarios, the majority of network traffic is normal, with relatively little attack traffic. This makes collecting a wide range of valid attack samples extremely difficult, leading to severe class imbalance in existing industrial internet intrusion detection datasets. However, deep learning technology relies heavily on the comprehensiveness and diversity of training datasets. Using class-imbalanced datasets severely limits the performance of deep learning models, resulting in low detection rates for minority attack samples within the dataset. Traditional oversampling methods, however, balance datasets due to their limitations. Simply replicating minority attack samples can lead to overfitting, similarly impacting the performance of deep learning models. Therefore, a new technical approach is urgently needed to address the class imbalance in training datasets and enhance the performance of intrusion detection models. Summary of the Invention

[0007] In view of this, the purpose of the present invention is to provide an industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network to solve the problem that the industrial Internet intrusion detection model has a low detection rate for minority class attack data due to data class imbalance. The MDCCGAN model proposed in the present invention is an improved conditional generative adversarial network (CGAN) model. The improved model adds multiple discriminators and independent classifiers on the basis of CGAN, and introduces Wasserstein distance as the loss function of the model to improve data generation quality and model stability.

[0008] In order to achieve the above object, the present invention provides the following technical solutions:

[0009] An industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network, the method comprising:

[0010] S1. Obtain a class-imbalanced dataset for intrusion detection, where the class-imbalanced dataset includes a number of normal samples and attack samples whose number is smaller than that of normal samples, as well as labels corresponding to each sample;

[0011] S2. Preprocess the class-imbalanced dataset and divide the dataset;

[0012] S3. Establish a multi-discriminator conditional classification generative adversarial network and perform pre-training based on the divided dataset; generate various attack samples through the pre-trained multi-discriminator conditional classification generative adversarial network to obtain a class-balanced dataset;

[0013] S4. Establish an intrusion detection model and use a class-balanced data set to train the intrusion detection model; the trained intrusion detection model is used for real-time intrusion detection.

[0014] Furthermore, in step S1, the normal samples in the class-imbalanced dataset belong to the majority class samples, and the attack samples belong to the minority class samples. The ratio of the majority class samples to the minority class samples is called the imbalance rate. The imbalance degree of the class-imbalanced dataset is determined according to the imbalance rate.

[0015] The attack methods of the attack samples include DoS, Probe, R2L and U2R attacks.

[0016] Furthermore, in step S2, the preprocessing process is feature digitization and feature normalization. The sample feature types in the class imbalanced data set include: character features, discrete features and continuous features. First, the character features are digitized and label encoding is used to convert the character features into numerical features. Then, the maximum-minimum method is used to normalize all feature values ​​to [0, 1] for the converted numerical features, discrete features and continuous features. The formula is as follows:

[0017]

[0018] Among them, x * is the normalized data, x is the current original data, x min is the minimum data value in the current attribute, x max The maximum data value in the current attribute;

[0019] The process of data set division includes: using the holdout method to divide the normalized data set into training sample data sets D = (X i , Y i ) and test sample data set T=(X i , Y i ).

[0020] Furthermore, in step S3, the constructed multi-discriminator conditional classification generative adversarial network MDCCGAN model includes two discriminators D1 and D2 with different network architectures, a classifier C and a generator G;

[0021] Generator G learns the distribution of real sample data and fits the input random noise and label information to produce fake samples that match the distribution of real sample data. Generator G consists of a three-layer fully connected neural network. The given label information Y and random noise Z are concatenated and input into the generator. The generator generates attack samples of the label class based on the label information and controls the model to generate attack samples under specified conditions.

[0022] The inputs of the two discriminators are real attack samples of various types and fake samples generated by the generator. The output is the Wasserstein distance between the real samples and the fake samples. Discriminator D1 includes three layers of one-dimensional convolutional layers and three layers of fully connected layers; discriminator D2 includes three layers of fully connected layers. The discriminator determines whether the input sample is a real sample from the real sample space distribution or a production sample generated by the generator.

[0023] The input of the classifier is the fake samples generated by the generator and the class label information, and the output is the classification loss of the fake samples and the given label information; the classifier C consists of three fully connected layers; the classifier C is used to determine whether the fake samples generated by the generator match the label information;

[0024] Through adversarial training between the generator and the discriminator, the generator and the discriminator eventually reach a Nash equilibrium state.

[0025] Furthermore, the training sample dataset divided from the class imbalanced dataset is used to pre-train the multi-discriminator conditional classification generative adversarial network. The training process is as follows:

[0026] Step 1: Filter out the minority class data in the selected intrusion detection dataset from the training set, oversample the minority class data and input it into the classifier to train the classifier so that the classifier can learn the distribution of the minority class data type; oversample the minority class samples, and then the classifier determines whether the generated samples are label-specified samples;

[0027] Step 2: Train the discriminator: First, fix the generator parameters, then input the samples generated by the generator and the real samples into the discriminator. The discriminator calculates and maximizes the generation loss, and updates the model parameters through gradient descent and reverse methods.

[0028] Step 3: Train the generator: Fix the discriminator parameters, input random noise and label information into the generator, and the generator generates fake samples. Use the discriminator and classifier to calculate and minimize the generation loss and classification loss, and update the model parameters through gradient descent and back propagation.

[0029] Step 4: Repeat steps 2 and 3. Through multiple rounds of adversarial training, the losses of both the discriminator and the generator converge and reach the Nash equilibrium state, which means the training is finished.

[0030] Furthermore, in the above training process, the objective function of the training includes:

[0031]

[0032]

[0033]

[0034] Where: L D1 With L D2 The loss functions of the discriminator D1 and the discriminator D2 with the introduction of Wasserstein distance are L G Represents the generator G loss function; represents the expectation that sample x comes from the real sample space, D(x) represents the probability that the discriminator outputs sample x from the real sample space, Represents the expectation that sample x comes from the sample space generated by the generator, where P r ,P g are the real sample distribution and the sample distribution generated by the generator respectively; Indicates that the label information c output by the classifier for sample x is the true sample label information c g probability.

[0035] Furthermore, in step S4, the intrusion detection model adopts a DNN classification model, which includes a hidden layer consisting of three fully connected layers, and the hidden layer uses a LeakyReLU activation function;

[0036] The training process for the DNN classification model is:

[0037] Step 1: Initialize model parameters; set input and output dimensions; set learning rate and training batch; set model loss function to cross entropy loss function; select Adam as the network optimizer to update network weights;

[0038] Step 2: Input the balanced training set into the DNN classification model for model training, calculate the model classification loss, and use gradient descent and backpropagation methods to let the model learn the distribution space information of the data samples;

[0039] Step 3: Fix the parameters of the trained DNN classification model, input the test dataset into the DNN classification model, and test the classification performance of the DNN model.

[0040] The beneficial effects of the present invention are:

[0041] This paper proposes an industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network, which can not only effectively detect known network attack types, but also has good generalization performance for unknown attacks.

[0042] First, the MDCCGAN model is used to globally fit the distribution of the original data to solve the single replication of the original data by traditional oversampling technology and avoid overfitting of the model.

[0043] Secondly, in the MDCCGAN model, compared with the original CGAN, multiple discriminators and an independent classifier are designed, and the Wasserstein distance is introduced, which effectively improves the quality of sample generation and solves problems such as unstable training and easy model crash of the original CGAN model.

[0044] Finally, based on the trained MDCCGAN model, by generating several fitted attack samples in the unbalanced training dataset, the unbalanced training dataset is converted into a balanced training dataset. The balanced training dataset is used to train the DNN classification model, which effectively improves the detection rate of DNN for network attack data and solves the problem of low detection rate of minority attacks caused by imbalanced data samples in traditional intrusion detection.

[0045] Other advantages, objects, and features of the present invention will be described in part in the following description and, in part, will be apparent to those skilled in the art upon examination of the following description or may be learned from practice of the present invention. The objects and other advantages of the present invention may be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below with reference to the accompanying drawings, in which:

[0047] Figure 1 A flow chart of an industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network provided by an embodiment of the present invention;

[0048] Figure 2 : is a structural diagram of the MDCCGAN model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The following describes the embodiments of the present invention by means of specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0050] Among them, the accompanying drawings are only for illustrative purposes and represent only schematic diagrams rather than actual pictures, and should not be understood as limiting the present invention. In order to better illustrate the embodiments of the present invention, some parts of the accompanying drawings may be omitted, enlarged or reduced, and do not represent the dimensions of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions may be omitted in the accompanying drawings.

[0051] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if there are terms such as "upper", "lower", "left", "right", "front", "back", etc. indicating directions or positional relationships, they are based on the directions or positional relationships shown in the drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operate in a specific direction. Therefore, the terms describing the positional relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0052] See also Figures 1 and 2 , which is an industrial Internet intrusion detection method based on multi-discriminator conditional classification generative adversarial network.

[0053] This embodiment provides a detailed description of an industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network. Figure 1 As shown, it specifically includes the following steps:

[0054] S1. Obtain a class-imbalanced dataset for intrusion detection, where the class-imbalanced dataset includes a number of normal samples and attack samples whose number is smaller than that of normal samples, as well as labels corresponding to each sample;

[0055] S2. Preprocess the class-imbalanced dataset and divide the dataset;

[0056] S3. Establish a multi-discriminator conditional classification generative adversarial network and perform pre-training based on the divided dataset; generate various attack samples through the pre-trained multi-discriminator conditional classification generative adversarial network to obtain a class-balanced dataset;

[0057] S4. Establish a DNN intrusion detection model and use a class-balanced dataset to train the DNN intrusion detection model; the trained DNN intrusion detection model is used for real-time intrusion detection.

[0058] In step S1 of this embodiment, the class-imbalanced dataset includes several normal samples and a small number of attack samples. The attack samples include common network attack traffic such as DoS, Probe, R2L, and U2R. The normal traffic in the class-imbalanced dataset is much larger than the network attack traffic.

[0059] The ratio of majority class samples to minority class samples is called the imbalance rate (IR). If a dataset contains 10,000 normal traffic samples and only 100 attack samples, the imbalance rate between normal and attack samples is 100. Using a supervised classification algorithm to classify unbalanced data significantly increases the difficulty of classifying minority class samples, resulting in an extremely low detection rate for attack-type data. Furthermore, when faced with a very small number of samples, supervised classifiers often tend to misidentify minority attack samples as normal samples.

[0060] In step S2 of this embodiment, preprocessing includes feature digitization and feature normalization; the sample feature types in the class-imbalanced dataset include: character features, discrete features, and continuous features; for character features, digitization processing is used to convert character features into numerical features, wherein label encoding is used as a specific data method; for the converted numerical features, discrete features, and continuous features, the maximum-minimum method is used to normalize all feature values ​​to between [0, 1], and the formula is as follows:

[0061]

[0062] Among them, x * is the normalized data, x is the current original data, x min is the minimum data value in the current attribute, x max The maximum data value in the current attribute.

[0063] The process of data set division includes: using the holdout method to determine 80% of the normalized data set as the training sample data set and 20% as the test sample data set, and constructing the training sample set D = (X i , Y i ) and the test sample set T=(X i , Y i ).

[0064] In step S3 of this embodiment, the constructed multi-discriminator conditional classification generative adversarial network MDCCGAN model includes two discriminators with different network architectures, a classifier and a generator.

[0065] Specifically, the MDCCGAN model is a generative model that can be trained using attack samples from a minority class. After training, the model can be used to generate new attack samples to balance the unbalanced dataset. The structure of the MDCCGAN model in this embodiment is as follows: Figure 2As shown in Figure 2, the MDCCGAN model consists of a generator (G), two discriminators with different network architectures (Discriminator1, D1 and Discriminator2, D2), and a classifier (Classifier, C).

[0066] The inputs to the MDCCGAN model generator are random noise sampled from a Gaussian distribution and class label information, and the output is fake samples that match the label information. The network architecture of the generator G in the MDCCGAN model consists of a three-layer fully connected neural network. The given label information Y is concatenated with random noise Z and then input into the generator. The generator generates attack samples for the label class based on the label information, controlling the model to generate attack samples that meet the specified conditions.

[0067] The inputs to both discriminators are real attack samples of various types and fake samples generated by the generator. The output is the Wasserstein distance between real and fake samples. The network architecture of discriminator D1 consists of three one-dimensional convolutional layers and three fully connected layers, while the network architecture of discriminator D2 consists of three fully connected layers.

[0068] The input of the classifier is the fake samples generated by the generator and the class label information, and the output is the classification loss of the fake samples and the given label information. The network architecture of classifier C consists of three fully connected layers.

[0069] The generator G learns the distribution of real sample data and fits the input random noise and label information to produce fake samples that match the real sample data distribution. The discriminator D determines whether the input sample is a real sample from the real sample space distribution or a production sample generated by the generator. The classifier C determines whether the fake sample generated by the generator matches the label information. The generator training goal is to generate fake samples that correspond to the input label category and fit the real sample distribution, thereby misleading the discriminator into making incorrect judgments about fake samples. The discriminator training goal is to accurately distinguish whether the input sample is a real sample from the real space distribution or a fake sample generated by the generator. The classifier training goal is to accurately classify the input sample category. Through adversarial training between the generator and the discriminator, the generator and the discriminator eventually reach a Nash equilibrium state. The generator can generate fake samples that are indistinguishable from real samples, and the discriminator determines that the probability of the input sample coming from the real sample space distribution is 0.5, indicating that training is complete. After the MDCCGAN training is completed, the generator is used to generate various imbalanced attack samples to amplify the original attack samples, so that the attack samples and normal samples in the original training set reach a balance.

[0070] The training sample dataset divided from the class imbalanced dataset is used to pre-train the multi-discriminator conditional classification generative adversarial network. The training process is as follows:

[0071] Step 1: Filter out the minority class data from the selected intrusion detection dataset from the training set. Oversample the minority class data and input it into the MDCCGAN model classifier to train the classifier, allowing it to learn the distribution of the minority class data type. Since the selected minority class samples are themselves class-imbalanced datasets, oversampling the minority class samples is performed. At this point, the classifier's role is to determine whether the generated samples are label-specified samples. The classifier's performance depends on learning the classification boundaries of real samples. The higher the degree of overfitting, the better the classifier's performance in determining the category of generated samples. Therefore, unlike other classifiers, this model classifier does not suffer from overfitting. Oversampling can, to a certain extent, ensure that the classifier can learn the distribution of various types of data in the minority class samples, thereby improving classifier performance.

[0072] Step 2: Train the discriminator in the MDCCGAN model: Since the discriminator loss function is the Wasserstein distance between real samples and fake samples, when training the discriminator, it is necessary to first fix the generator parameters. Then, the samples generated by the generator and the real samples are input to the discriminator. The discriminator calculates and maximizes the generation loss and updates the model parameters through gradient descent and reverse methods.

[0073] Step 3: Train the generator in the MDCCGAN model: Since the generator's loss and gradient come from the discriminator and classifier, the discriminator parameters need to be fixed when training the generator, while the classifier parameters have been fixed in training step 1. Random noise and label information are input into the generator, and the generator generates fake samples. The generation loss and classification loss are calculated and minimized with the help of the discriminator and classifier, and the model parameters are updated through gradient descent and backpropagation.

[0074] Step 4: Repeat steps 2 and 3. Through multiple adversarial training, the losses of both the discriminator and the generator converge to 0 and reach the Nash equilibrium state, which means the training is completed. The trained generator is then used to generate unbalanced attack samples in the dataset, so that the attack samples and normal samples in the original training set reach a balanced state.

[0075] The objective function of the MDCCWGAN model is expressed as follows:

[0076]

[0077] Where: L D1 With L D2 The loss functions of the discriminator D1 and the discriminator D2 with the introduction of Wasserstein distance are LG Represents the generator G loss function; represents the expectation that sample x comes from the real sample space, D(x) represents the probability that the discriminator outputs sample x from the real sample space, Represents the expectation that sample x comes from the sample space generated by the generator, where P r ,P g are the real sample distribution and the sample distribution generated by the generator respectively; P(c=c g |x) indicates that the label information c output by the classifier for sample x is the true sample label information c g probability.

[0078] In step S4 of this embodiment, a DNN classification model is used as the intrusion detection model. Its hidden layer consists of three fully connected layers. The hidden layer uses the LeakyReLU activation function, and the model uses the Adam optimizer to update the network weights. The training process for the DNN classification model is as follows:

[0079] Step 1: Initialize the model parameters; set the input and output dimensions; set the learning rate to 0.001; set the training batch size to 50 times; set the model loss function to the cross entropy loss function; select Adam as the network optimizer to update the network weights;

[0080] Step 2: Input the balanced training set into the DNN classification model for model training, calculate the model classification loss, and use gradient descent and backpropagation methods to let the model learn the distribution space information of the data samples;

[0081] Step 3: Fix the parameters of the trained DNN classification model, input the test dataset into the DNN classification model, and test the classification performance of the DNN model.

[0082] It should be noted that the training sample set is used for training the MDCC GAN model and includes, but is not limited to, the DNN detection model. The test sample set includes, but is not limited to, testing the final DNN detection model. It can also be used for training or testing the CNN classification model. The selection of subsequent test models can be customized based on actual needs. In this example, the DNN detection model is used as an example.

[0083] The present invention is applicable to the field of industrial internet intrusion detection. The disclosed industrial internet intrusion detection method integrates multiple algorithms and performs them sequentially. Data preprocessing, including digitization and normalization, is beneficial for improving the accuracy of the detection model. Because intrusion detection datasets suffer from class imbalance, which seriously affects the performance of the detection model, balancing the imbalanced dataset using the MDCCGAN model and then training the detection model with the balanced dataset can effectively improve the performance of the detection model, as well as enhance its robustness and generalization capabilities.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions, which should all be included in the scope of the claims of the present invention.

Claims

1. An industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network, characterized by: The method comprises: S1. Obtain a class-imbalanced dataset for intrusion detection, where the class-imbalanced dataset includes a number of normal samples and attack samples whose number is smaller than that of normal samples, as well as labels corresponding to each sample; S2. Preprocess the class-imbalanced dataset and divide the dataset; S3. Establish a multi-discriminator conditional classification generative adversarial network and perform pre-training based on the divided dataset; generate various attack samples through the pre-trained multi-discriminator conditional classification generative adversarial network to obtain a class-balanced dataset; S4. Establish an intrusion detection model and use a class-balanced data set to train the intrusion detection model; the trained intrusion detection model is used for real-time intrusion detection.

2. The industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network according to claim 1 is characterized by: In step S1, the normal samples in the class-imbalanced dataset belong to the majority class samples, and the attack samples belong to the minority class samples. The ratio of the majority class samples to the minority class samples is called the imbalance rate. The imbalance degree of the class-imbalanced dataset is determined according to the imbalance rate. The attack methods of the attack samples include DoS, Probe, R2L and U2R attacks.

3. The industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network according to claim 1 is characterized by: In step S2, the preprocessing process is feature digitization and feature normalization. The sample feature types in the class imbalanced dataset include: character features, discrete features and continuous features. First, the character features are digitized and label encoding is used to convert the character features into numerical features. Then, the maximum-minimum method is used to normalize all feature values ​​to [0, 1] for the converted numerical features, discrete features and continuous features. The formula is as follows: Among them, x * is the normalized data, x is the current original data, x min is the minimum data value in the current attribute, x max The maximum data value in the current attribute; The process of data set division includes: using the holdout method to divide the normalized data set into training sample data sets D = (X i , Y i ) and test sample data set T=(X i , Y i ).

4. The industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network according to claim 1 is characterized by: In step S3, the constructed multi-discriminator conditional classification generative adversarial network MDCCGAN model includes two discriminators D1 and D2 with different network architectures, a classifier C and a generator G; Generator G learns the distribution of real sample data and fits the input random noise and label information to produce fake samples that match the distribution of real sample data. Generator G consists of a three-layer fully connected neural network. The given label information Y and random noise Z are concatenated and input into the generator. The generator generates attack samples of the label class based on the label information and controls the model to generate attack samples under specified conditions. The inputs of the two discriminators are real attack samples of various types and fake samples generated by the generator. The output is the Wasserstein distance between the real samples and the fake samples. Discriminator D1 includes three layers of one-dimensional convolutional layers and three layers of fully connected layers; discriminator D2 includes three layers of fully connected layers. The discriminator determines whether the input sample is a real sample from the real sample space distribution or a production sample generated by the generator. The input of the classifier is the fake samples generated by the generator and the class label information, and the output is the classification loss of the fake samples and the given label information; the classifier C consists of three fully connected layers; the classifier C is used to determine whether the fake samples generated by the generator match the label information; Through adversarial training between the generator and the discriminator, the generator and the discriminator eventually reach a Nash equilibrium state.

5. The industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network according to claim 4 is characterized by: The training sample dataset divided from the class imbalanced dataset is used to pre-train the multi-discriminator conditional classification generative adversarial network. The training process is as follows: Step 1: Filter out the minority class data in the selected intrusion detection dataset from the training set, oversample the minority class data and input it into the classifier to train the classifier so that the classifier can learn the distribution of the minority class data type; oversample the minority class samples, and then the classifier determines whether the generated samples are label-specified samples; Step 2: Train the discriminator: First, fix the generator parameters, then input the samples generated by the generator and the real samples into the discriminator. The discriminator calculates and maximizes the generation loss, and updates the model parameters through gradient descent and reverse methods. Step 3: Train the generator: Fix the discriminator parameters, input random noise and label information into the generator, and the generator generates fake samples. Use the discriminator and classifier to calculate and minimize the generation loss and classification loss, and update the model parameters through gradient descent and back propagation. Step 4: Repeat steps 2 and 3. Through multiple rounds of adversarial training, the losses of both the discriminator and the generator converge and reach the Nash equilibrium state, which means the training is finished.

6. The industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network according to claim 5 is characterized by: In the above training process, the objective functions of the training include: Where: L D1 With L D2 The loss functions of the discriminator D1 and the discriminator D2 with the introduction of Wasserstein distance are L C is the cross entropy loss function between the classifier's predicted label and the true label for the generated sample, and is the generator loss function; L G Represents the generator G loss function; represents the expectation that sample x comes from the real sample space, D(x) represents the probability that the discriminator outputs sample x from the real sample space, Represents the expectation that sample x comes from the sample space generated by the generator, where P r ,P g are the real sample distribution and the sample distribution generated by the generator respectively; P(c=c g |x) indicates that the label information c output by the classifier for sample x is the true sample label information c g probability.

7. The industrial Internet intrusion detection method based on a multi-discriminator conditional classification generative adversarial network according to claim 1 is characterized by: In step S4, the intrusion detection model adopts a DNN classification model, which includes a hidden layer consisting of three fully connected layers, and the hidden layer uses a LeakyReLU activation function; The training process for the DNN classification model is: Step 1: Initialize model parameters; set input and output dimensions; set learning rate and training batch; set model loss function to cross entropy loss function; select Adam as the network optimizer to update network weights; Step 2: Input the balanced training set into the DNN classification model for model training, calculate the model classification loss, and use gradient descent and backpropagation methods to let the model learn the distribution space information of the data samples; Step 3: Fix the parameters of the trained DNN classification model, input the test dataset into the DNN classification model, and test the classification performance of the DNN model.

Images