Industrial internet intrusion detection method

Abstract

The application discloses an industrial internet intrusion detection method, comprising the following steps: acquiring feature data, cleaning the feature data to obtain cleaned data; pre-processing the cleaned data to obtain pre-processed data; constructing a convolutional neural network model for feature extraction based on the pre-processed data; and performing threshold optimization on the classified space linear transformation of the feature-extracted data to obtain a monitoring result. The application can realize real-time detection of network flow of an industrial control system by calling a trained model in real time, and realize situation awareness of network security.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of industrial internet and internet of things, and particularly relates to an industrial internet intrusion detection method. BACKGROUND

[0002] Industrial Control Systems (ICS) is a general term for a variety of control systems (such as PLC, RTU and special-purpose controllers, etc.) used in process control and related instruments and equipment. In the early stage, due to the limitation of production purposes, ICS existed as a relatively independent and isolated system, maintaining a separate relationship with the external Internet, and the network security and reliability of itself were rarely concerned by people. With the development of informatization, the original relatively independent and isolated operation mode of ICS has been difficult to meet the requirements of intelligent manufacturing today. Industrial Internet and Internet of Things connect people, machines and things comprehensively, deeply perceive industrial data, real-time transmit and exchange, and quickly process, so as to realize intelligent control, operation optimization and production organization mode change.

[0003] At present, due to the congenital deficiency of its own security protection, the ICS system exposed in the public industrial Internet has increasingly serious security problems. Under this background, high-profile network attacks on critical infrastructure and industrial enterprises have promoted the industrial control system intrusion detection problem to a mainstream problem.

[0004] The existing intrusion detection methods can be classified into misuse intrusion detection technology and anomaly intrusion detection technology according to the detection methods. Misuse detection is a network intrusion detection technology based on pattern matching. It is assumed that all network attack behaviors and methods have certain patterns or characteristics. If all the characteristics (‘abnormal’ characteristics) of the network attacks found in the past are summarized and an intrusion information library is established, and then the collected information is compared with the known network intrusion and system misuse pattern database, unknown network attack behaviors can be found. Anomaly intrusion detection refers to extracting ‘normal’ characteristics from the network traffic information or host device information of the normally running industrial control system, and constructing a feature model of the industrial control system, and then matching the feature model with the features of the industrial control system to be detected. When the deviation is large, it is judged that the industrial control system has been invaded.

[0005] Flow-based intrusion detection needs to capture the relevant information of network traffic in real time, such as connection times, connection times, ports, access system sensitive file permissions and other traffic characteristics, to build a database of traffic characteristics. The collected traffic is matched with the traffic in the existing feature library, and the matching result is used to judge whether the industrial control system has been intruded, and the traffic feature database is updated in real time according to data analysis. Protocol-based intrusion detection monitors and captures ICS network communication data through sensors, and after analysis, it is matched with the protocol field to achieve the goal of monitoring and protecting the ICS under test. Host-based intrusion detection mainly starts from business completion logic and system device operation, aiming to destroy the operation of the system. Each network device has its unique system "fingerprint", which identifies the physical characteristics of the system, network features and other device-related information. These information often serve as research marker information. At the same time, when the field device is intruded, it will affect network communication, which will change the signal input to the controlled object.

[0006] In view of the increasingly serious industrial control network security problem, a more intelligent method is needed to perceive, monitor, warn and dispose the network intrusion behavior of the industrial control system, and ensure the safe and smooth operation of the industrial control system. SUMMARY

[0007] The application provides an industrial internet intrusion detection method, which optimizes the threshold and improves the accuracy by data preprocessing and model training.

[0008] To achieve the above purpose, the application provides the following solutions.

[0009] An industrial internet intrusion detection method comprises the following steps:

[0010] Obtain feature data, clean the feature data, and obtain cleaned data;

[0011] Preprocess the cleaned data to obtain preprocessed data;

[0012] Construct features on the preprocessed data, establish a convolutional neural network model for feature extraction;

[0013] Optimize the threshold of the classification space linear transformation of the feature-extracted data to obtain a detection result.

[0014] Preferably, the cleaned data includes TCP connection basic features, TCP connection content features, time-based network traffic statistical features, and host-based network traffic statistical features.

[0015] Preferably, the preprocessing method of the cleaned data includes data normalization processing and data resampling processing.

[0016] Preferably, the data normalization processing method comprises: the cleaned data is reduced in high dispersion characteristic data by a normalization method, and a formula is as follows:

[0017]

[0018] wherein q i,min represents a minimum value in a column vector q, q i,max represents a maximum value in the column vector q.

[0019] Preferably, the data resampling processing method comprises:

[0020] Firstly, the cleaned data is subjected to SMOTE sampling by a single sampling algorithm, and secondly, a dynamic strategy of a data set is performed on the basis of the single sampling.

[0021] Preferably, the method for performing feature construction on the preprocessed data and establishing a convolutional neural network model for feature extraction comprises: performing feature construction on the preprocessed data, and a formula for establishing a recombined feature data set is as follows:

[0022]

[0023] On this basis, a convolutional neural network model is established for feature extraction.

[0024] Preferably, the threshold optimization method for performing linear transformation in a classification space on the data after feature extraction comprises: obtaining a Youden coefficient based on ROC and performing multi-classification optimization based on the Youden coefficient.

[0025] Preferably, the method for obtaining a Youden coefficient based on ROC comprises: firstly testing model accuracy by an ROC curve, and measuring accuracy by AUC, which is expressed by a formula as follows:

[0026]

[0027] In the above formula, represents a serial number of the ith sample, represents a serial number of only positive class samples.

[0028] AUC represents an area under an ROC curve, and a best threshold value of AUC is obtained by a Youden coefficient, which is expressed by a formula as follows:

[0029] J = TPR-FPR

[0030] wherein TPR represents an abscissa of a point on an ROC curve closest to the upper left corner, FPR represents an ordinate of the point on the ROC curve closest to the upper left corner, and J represents a best threshold value.

[0031] Preferably, the multi-classification optimization based on the Youden coefficient comprises:

[0032] Using a linear transformation method of the classification space:

[0033] P new = P · diag(J)

[0034] That is

[0035]

[0036] The judgment of the classifier on the result is as follows

[0037]

[0038] The result is the detection result.

[0039] The application has the beneficial effects that: the application discloses a TanhMinMax normalization method and a dynamic data set strategy to effectively improve the data discrimination and effectively utilize the data information, aims to solve the problem of high redundancy of the existing processing method and easy loss of data information, effectively utilize the existing data, and overcome the influence of data imbalance on the classifier; the model training method used in the application aims to effectively extract data features. Based on the data constructed based on the features, the CNN network can effectively understand the data, and realize the corresponding relationship from the data to the classification; the threshold optimization method based on the linear transformation of the classification space proposed in the application realizes the automatic selection of the classification threshold and the automatic optimization of the classification space under the unbalanced data set, improves the overall accuracy and the minority class F1 value, and significantly reduces the influence of the unbalanced data set on the classifier. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the application, the following briefly introduces the drawings needed to be used in the embodiments. Obviously, the drawings in the following description only some embodiments of the application, and for those skilled in the art, on the premise of not paying the creative labor, can also obtain other drawings according to these drawings.

[0041] Figure 1 It is an industrial internet intrusion detection method flowchart of the embodiment of the application.

[0042] Figure 2 It is a dynamic sampling strategy process schematic diagram of the embodiment of the application.

[0043] Figure 3 It is a feature construction data process schematic diagram of the embodiment of the application.

[0044] Figure 4 A convolutional neural network model structure diagram is constructed for the embodiment of the present application. DETAILED DESCRIPTION

[0045] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0046] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0047] In the embodiment, as shown in the figure, Figure 1 An industrial internet intrusion detection method is provided, including the following steps:

[0048] Firstly, feature data is acquired, and the feature data is cleaned to obtain cleaned data.

[0049] The feature data of the embodiment includes 9 kinds of TCP connection basic features, 13 kinds of TCP connection content features, 9 kinds of network traffic statistics based on time, and 10 kinds of network traffic statistics based on host.

[0050] The 9 kinds of TCP connection basic features include TCP basic connection features containing some basic attributes of TCP connection, such as continuous time, protocol type, number of transmitted bytes, protocol features, etc. The 13 kinds of TCP connection content features include: for U2R and R2L attacks, since they do not have frequent sequence patterns in data records like DoS attacks, but are generally embedded in the data load of data packets, the content features of TCP connection are captured from the message content. The 9 kinds of network traffic statistics based on time include: since network attack events have strong correlation in time, some connections between the current connection record and the connection record in the previous period of time are counted, which can better reflect the relationship between the connections. The 10 kinds of network traffic statistics based on host include: some probing attacks use slow attack mode to scan hosts or ports, and the information is counted according to the classification of target hosts, which can find such attacks.

[0051] We subdivide network attacks into 4 categories and 39 attack types. The 4 categories are: DoS attack, U2R attack, R2L attack, and Probe attack.

[0052] The feature data is cleaned, incomplete traffic data and repeated traffic data are deleted, invalid values and missing values are filled with 0, and the cleaned data is obtained. The data set obtained based on the cleaned data is denoted as n, and the total data number of the data set is denoted as x i,j is the jth feature of the ith data.

[0053] Each data has 41-dimensional features, which can be regarded as a row vector

[0054]

[0055] Where i is the number of current data.

[0056] For the entire data set, all data of each feature can be regarded as a column vector

[0057]

[0058] Where j is the number of data features.

[0059] According to the above definition, the original data set X can be represented as a two-dimensional matrix as shown below.

[0060]

[0061] The second step is to preprocess the cleaned data, including data normalization and data resampling.

[0062] Data normalization processing:

[0063] The cleaned data obtained in the first step still has high dispersion feature data. The feature with a standard deviation greater than 1 is defined as a high dispersion feature, which means that the value of a certain feature dimension in the data set has a very large standard deviation. This means that the distribution of the data is extremely unbalanced.

[0064] The normalization method reduces the high dispersion characteristics of the features by nonlinear hyperbolic tangent of the original data changes, better preserves the discrimination of the data, and q i,min represents the minimum value in the column vector q, q i,max represents the maximum value in the column vector q. The normalization method is as follows:

[0065]

[0066] Where q i,min represents the minimum value in the column vector q, q i,max represents the maximum value in the column vector q.

[0067] Data resampling processing:

[0068] In real network traffic, normal traffic accounts for the vast majority, while for attack traffic, due to the characteristics of DoS attacks, the vast majority of attack traffic, so for network traffic, its imbalance is inevitable and unavoidable. This feature is manifested in the dataset as the Normal classification and the DoS classification account for the vast majority.

[0069] As shown in Figure 2 , after cleaning the data, there is data imbalance. The meaning of imbalance is that there are obvious minority and majority classes in the dataset. In this embodiment, first, the original industrial control traffic dataset is sampled by SMOTE and random undersampling by single sampling algorithm, the number of minority class samples is increased, then the dataset is down-sampled to reduce the number of majority classes, and finally the balance of the dataset is achieved; in order to overcome the error and information redundancy and information loss brought by the single sampling algorithm, on the basis of single sampling, the dynamic strategy of the dataset is carried out, and the dataset is sampled before each training, and the data is regenerated before each training to ensure the robustness of the model.

[0070] The third step is to construct features for the preprocessed data and establish a convolutional neural network model for feature extraction, as shown in Figure 3 .

[0071] Based on the preprocessed data, a redundant dimension all of which are 0 is deleted, and the feature string is one-hot encoded, one-hot encoding, that is, a hot code, mainly using N-bit state registers to encode N states, each state has its own independent register bit, and only one bit is valid at any time. As shown in the following data vector, the original feature protocol_type has three values, TCP, UDP, and ICMP, which are mapped to [1, 0, 0], [0, 1, 0] and [0, 0, 1]; therefore, the following data vector is obtained:

[0072]

[0073] On this basis, the formula for establishing the recombined feature dataset is:

[0074]

[0075] Thus, a convolutional neural network model is established for feature extraction.

[0076] Convolutional Neural Networks (CNN) is widely used due to its good feature extraction performance. A typical network structure consists of five layers: input layer, convolutional layer, pooling layer, fully connected layer and output layer. The present application takes CNN network as the core and constructs as shown in Figure 4The neural network shown extracts features of network traffic. Among them, the figure

?

[0077] The first layer network is the input layer, which converts the original two-dimensional array into the form of a tensor and inputs the neural network;

[0078] The second layer is the convolutional layer, which uses 32 convolutional kernels to preliminarily extract features, uses same-padding to ensure edge effects, and uses a linear rectification function (ReLU) function for activation processing;

[0079]

[0080] The third layer is the pooling layer, which uses a maximum pooling with a step of 2 to process the output results of convolution;

[0081] The fourth layer is the convolutional layer, which uses 64 convolutional kernels to further extract features. At this time, the receptive field of the convolutional kernel is larger than that of the first layer network, and the features can be extracted at a deeper level. Like the first layer network, same-padding is used to ensure edge effects, and ReLU function is used for activation;

[0082] The fifth layer is the pooling layer, which has the same effect as the second layer;

[0083] The sixth layer is Flatten, which performs dimension transformation on the pooling results to obtain a one-dimensional vector;

[0084] The seventh layer is dropout, which randomly interrupts the connection of some neurons during training. This method can effectively prevent model overfitting and improve robustness;

[0085] The eighth layer is fully connected, which preliminarily refines the results obtained by the neural network;

[0086] The ninth layer is the fully connected layer, which outputs the one-hot encoding result using the softmax activation function shown in the following formula;

[0087]

[0088] During training, the adam optimizer is used for training, and the categorical_crossentropy shown in the following formula is used as the loss function.

[0089]

[0090] In the above formula, x represents the input sample, C is the total number of classes to be classified, y i is the true label corresponding to the i-th data, fi (x) is the output value of the model to the i th data.

[0091] The fourth step is threshold optimization of the linear transformation of the classification space of the data after feature extraction, including: obtaining Youden coefficient based on ROC and multi-classification optimization based on Youden coefficient.

[0092] Obtaining Youden coefficient based on ROC:

[0093] The ROC curve is the receiver operating characteristic curve, the horizontal coordinate is FPR, and the vertical coordinate is TPR, which respectively represents the specificity and sensitivity of the model. Each point on the ROC curve reflects the same sensitivity, which is the reaction to the same signal stimulus, and describes the curve drawn by the different results of the subjects under the condition of different judgment standards.

[0094] In the ROC curve, the closer the TPR is to 1 and the closer the FPR is to 0, the closer the classification of positive and negative samples is to complete correctness, and the better the performance of the classifier. In other words, the closer to the upper left corner, the higher the accuracy of the test. This accuracy is measured by AUC, which represents the area under the ROC curve, as shown in the following formula:

[0095]

[0096] In the above formula, represents the serial number of the i th sample, represents only the serial number of the positive class sample.

[0097] In order to find the classification threshold value corresponding to the maximum AUC more conveniently, we use Youden coefficient for evaluation, which means the best threshold value of binary classification. When FN and FP have the same harm, Youden coefficient can be expressed as the following formula:

[0098] J = TPR - FPR

[0099] Where, TPR represents the horizontal coordinate of the point on the ROC curve closest to the upper left corner, FPR represents the vertical coordinate of the point on the ROC curve closest to the upper left corner, and J represents the best threshold value. That is, the difference between the horizontal and vertical coordinates of the point on the ROC curve closest to the upper left corner.

[0100] Multi-classification optimization based on Youden coefficient:

[0101] For multi-classification problems, the prediction probability of each result of the classifier is expressed by the following formula:

[0102] P = [p1 p2…p n ] T

[0103] The judgment of the classifier on the result is as follows

[0104]

[0105] In this embodiment, for the multi-classification problem, there is a Youden coefficient for each classification item

[0106] J = [J1 J2…J n ]

[0107] This embodiment uses the linear change method of the classification space

[0108] P new = P·diag(J)

[0109] That is

[0110]

[0111] The judgment of the classifier on the result is as follows

[0112]

[0113] result is the detection result.

[0114] The above-described embodiments are merely descriptions of the preferred modes of the present application, and are not intended to limit the scope of the present application. Various modifications and improvements to the technical solutions of the present application made by those of ordinary skill in the art without departing from the design spirit of the present application shall fall within the protection scope of the present application defined by the claims.

Claims

1. An industrial internet intrusion detection method, characterized in that, Includes the following steps: Acquire feature data, clean the feature data, and obtain cleaned data; The cleaned data is preprocessed to obtain preprocessed data; The preprocessed data is used to construct features, and a convolutional neural network model is established for feature extraction. Threshold optimization of the linear transformation of the classification space is performed on the data after feature extraction to obtain the detection results; The method for constructing features from the preprocessed data and establishing a convolutional neural network model for feature extraction includes: constructing features from the preprocessed data, and establishing a reconstructed feature dataset using the following formula: Based on this, a convolutional neural network model is established for feature extraction; Threshold optimization methods for performing linear transformation of the classification space on the data after feature extraction include: obtaining the Youden coefficient based on ROC and performing multi-class optimization based on the Youden coefficient; The method for obtaining the Youden coefficient based on ROC includes: firstly, testing the model accuracy using the ROC curve, and secondly, measuring accuracy using AUC, expressed by the following formula: ； In the above formula, Indicates the first i The serial number of the sample. This means adding only the indices of the positive class samples; AUC represents the area under the ROC curve. ， The optimal threshold for AUC is obtained using the Youden coefficient, as shown in the following formula: Where TPR represents the ordinate of the point on the ROC curve closest to the top left corner, FPR represents the abscissa of the point on the ROC curve closest to the top left corner, and J represents the optimal threshold. The multi-class classification optimization based on the Youden coefficient includes: Using a linear transformation method of the classification space: The classifier then judges the result as follows: Where i = 1, 2, ..., n; result is the detection result; The cleaned data includes basic characteristics of TCP connections, content characteristics of TCP connections, time-based network traffic statistics, and host-based network traffic statistics. The methods for preprocessing the cleaned data include: data normalization and data resampling. The data normalization processing method includes: reducing high-discrepancy characteristic data by normalizing the cleaned data, as shown in the following formula: in, Represents column vectors q The minimum value in, Represents column vectors q The maximum value in; The data resampling processing method includes: First, the cleaned data is sampled using a single sampling algorithm (SMOTE). Second, based on the single sampling, a dynamic strategy for the dataset is implemented. The structure of a convolutional neural network model includes: The first layer of the network is the input layer, which converts the original two-dimensional array into tensor form and inputs it into the neural network; The second layer is a convolutional layer, which uses 32 convolutional kernels to perform initial feature extraction, uses same-padding to ensure edge effects, and uses a linear rectified function for activation processing. The third layer is a pooling layer, which uses max pooling with a stride of 2 to process the output of the convolution. The fourth layer is a convolutional layer, which uses 64 convolutional kernels to further extract features; The fifth layer is the pooling layer; The sixth layer is Flatten, which transforms the dimensions of the pooling results to obtain a one-dimensional vector; The seventh layer is dropout; The eighth layer is fully connected, which performs preliminary refinement of the results obtained from the neural network; The ninth layer is a fully connected layer that uses the softmax activation function to output the one-hot encoded result.

Images