An Intrusion Detection Method for Industrial Control Systems Based on Improved Genetic Algorithm Feature Selection

Abstract

This invention belongs to the fields of industrial control systems, network security, and artificial intelligence, and proposes an intrusion detection method for industrial control systems based on improved genetic algorithm feature selection. The method involves preprocessing traffic data for feature selection; generating a population based on the preprocessed traffic data; evaluating the chromosomes of each individual using a multi-dimensional chromosome evaluation method; merging and ranking the evaluation results using a feature ranking fusion method; calculating the individual fitness using an improved fitness evaluation function; performing crossover and mutation operations using a growing tree clustering algorithm to obtain a new population; performing evolution and elimination operations on individuals based on the feature ranking fusion results; outputting the individual with the highest fitness and establishing a classification model using a neural network model. Compared to traditional intrusion detection methods, this invention has higher classification accuracy, lower algorithm complexity, is more suitable for imbalanced industrial control data, and effectively reduces the number of features selected in the final step.

Description

Technical Field

[0001] This invention relates to the fields of industrial control systems, network security, and artificial intelligence, and in particular to an intrusion detection method for industrial control systems based on feature selection using an improved genetic algorithm. Background Technology

[0002] Industrial control systems (ICS) are capable of processing complex data and securely executing design tasks, with over 80% of them being critical infrastructure related to national welfare and people's livelihoods. With the rapid development of information and network technologies, and the widespread use of general-purpose hardware, software, and network infrastructure, the "physical isolation" between industrial control systems and information networks has been broken down. Attackers can inject false data and commands through the network, causing abnormal equipment operation and catastrophic consequences. These potential dangers make intrusion detection in industrial control networks particularly important. Currently, feature selection methods and classification models for intrusion detection are being applied.

[0003] The paper "Hadeel Alazzam, Ahmad Sharieh, and Khair Eddin Sabri. A feature selection algorithm for intrusion detection system based on pigeon-inspired optimizer. Expert Systems with Applications, 148:113249, 2020" proposes an intrusion detection feature selection method based on a wrapper approach, derived from a pigeon-inspired optimization algorithm. Combining a continuous meta-heuristic binary method, a cosine similarity-based feature selection method is proposed. The authors compare the proposed feature selection algorithm with six state-of-the-art algorithms on three datasets, demonstrating the superiority of the proposed algorithm.

[0004] The paper "Faezah Hamad Almasoudy, Wattiq Laftah Al-Yaseen, and Ali Kadhum Idrees. Differential evolution wrapper feature selection for intrusion detection system. Procedia Computer Science, 167:1230-1239, 2020" proposes a feature selection method based on differential evolution algorithm for intrusion detection. This method uses a differential evolution algorithm to iteratively search for the optimal feature subset and continuously removes features. The computational accuracy of these features is then evaluated using an extreme learning machine until the minimum feature that satisfies the highest accuracy is found. Results show that this method achieves high detection rates and low false alarm rates on the 5-class and 2-class NSL-KDD datasets.

[0005] The paper "Maryam Samadi Bonab, Ali Ghaffari, Farhad Soleimanian Gharehchopogh, and Payam Alemi. A wrapper-based feature selection for improving performance of intrusion detection systems. International Journal of Communication Systems, 33(12):e4434, 2020" proposes a two-stage feature selection and attack detection method. This method combines the features of Support Vector Machines (SVM) and Genetic Algorithms, employing multiple parental crossover and multiple parental mutation. In the attack detection stage, an Artificial Neural Network (ANN) is used to detect attacks. To improve the classifier's performance, a hybrid gravity search (HGS) and particle swarm optimization (PSO) approach is used to train the classifier. This method successfully reduces the feature dimension of NSL-KDD from 42 to 4, but the classification accuracy remains low.

[0006] The paper "Frans Hendrik Botes, Louise Leenen, and Retha De La Harpe. Antcolony-induced decision trees for intrusion detection. In 16th European Conference on Cyber ​​Warfare and Security, pages 53–62. ACPI, 2017" proposes a decision tree generation algorithm based on Ant Tree Mining (ATM) for intrusion detection systems. This algorithm performs feature selection on complex, multidimensional, and massive datasets, finding the minimum feature set from a large amount of data while maintaining high classification accuracy. While wrapping methods can often find the optimal feature subset for a classification algorithm, they have high time complexity, some algorithms struggle to effectively change the number of features, and are prone to getting trapped in local optima.

[0007] In summary, most existing intrusion detection methods are not designed for industrial control systems (ICS). Firstly, these methods cannot effectively reduce the number of redundant features, while ICS features exhibit high redundancy. Secondly, existing feature selection methods do not consider the data imbalance problem in ICS, leading to low accuracy and high false positives when implemented. Furthermore, ICS require real-time analysis of data streams and decision-making, necessitating a low-complexity classifier, which existing feature selection methods rarely consider the time complexity of building classification models. Summary of the Invention

[0008] To address the aforementioned problems, this invention proposes an intrusion detection method for industrial control systems based on improved genetic algorithm feature selection. This method is more suitable for intrusion detection in industrial control systems, effectively selecting meaningful features, improving model classification accuracy, and reducing algorithm complexity. It efficiently detects intrusion behaviors in industrial control networks, ensuring the stable operation of these networks.

[0009] To achieve the above objectives, the technical solution of the present invention is as follows:

[0010] An intrusion detection method for industrial control systems based on feature selection using an improved genetic algorithm includes the following steps:

[0011] Step 1: Obtain the traffic data to be selected for feature selection; the traffic data includes N features, and the traffic data set is U(f1,f2,…f…). i …,f N );

[0012] Step 2: Traffic data preprocessing; Select the preprocessing method based on the characteristics of the traffic data;

[0013] Step 3: Randomly generate an initial population based on the preprocessed traffic data, with a population size of M individuals;

[0014] Step 4: Evaluate the chromosomes of each individual in the population using a multi-dimensional chromosome assessment method; chromosomes are the characteristics of the flow data.

[0015] Step 5: Use a feature ranking and fusion method based on robust rank aggregation to perform feature ranking and fusion on the multi-dimensional chromosome evaluation results, and save the best and worst chromosomes;

[0016] Step 6: Calculate the fitness of each individual using the improved fitness evaluation function;

[0017] Step 7: Use the growing tree clustering algorithm to perform crossover and mutation operations on the current population to obtain a new population;

[0018] Step 8: Perform evolutionary and elimination operations on individuals in the new population based on the feature ranking and fusion results;

[0019] Step 9: Output the individual with the highest fitness obtained in Step 8 to the selected classifier to determine whether there is intrusion behavior in the industrial control network and classify the intrusion behavior.

[0020] The specific preprocessing of traffic data in step 2 is as follows: when the characteristics f of the traffic data i When the feature is non-numerical, the one-hot encoding method is used to encode the traffic data, and then the encoded traffic data is normalized; when the feature f of the traffic data... i When the feature is numerical, normalization is performed directly.

[0021] The normalization operation is as follows:

[0022]

[0023] Among them, (f i ) min This represents the minimum value corresponding to this traffic data characteristic, (f i ) max This indicates the maximum value corresponding to this traffic data characteristic.

[0024] The specific process of step 4 is as follows: For each individual Inv k Perform the following operations:

[0025] The chromosomes of each individual were scored using L1 regularization, L2 regularization, linear regression, stability selection, random forest, correlation coefficient, and mutual information methods, respectively, resulting in chromosome score lists {e1,e2,…,e7} for each method. The chromosome score lists were then re-ranked according to the scores to obtain the corresponding chromosome ranking list {r1,r2,…,r7}.

[0026] In step 5, the robust rank aggregation method is used to aggregate the chromosome ranking list {r1,r2,…,r7} to obtain a unified chromosome ranking list R; based on the unified chromosome ranking list R, the chromosome with the best ranking is marked as Best, and the chromosome with the worst ranking is marked as Worst.

[0027] The individual fitness is calculated according to the following formula:

[0028] Fitness = γ (max,min) *(acc+f1)+(1-γ (max,min) *corr)

[0029] Where, γ (max,min) To evaluate the random perturbation of the metrics, random numbers from min to max are generated to ensure the randomness of the search process. acc is the five-fold cross-validation classification accuracy of the selected classifier. The mean F1 is obtained by weighted averaging of the sample size for each class. corr is the average of the sum of Pearson correlation coefficients among all features of an individual.

[0030] The value of max is 0.6, the value of min is 0, and the selected classifier is a neural network classifier.

[0031] The specific process of step 7 is as follows: using the growing tree clustering algorithm, the individuals in the population are clustered into m clusters according to the individual similarity, and each cluster is a family.

[0032] Individuals with the highest fitness from different families are cross-crossed, and the newly generated cross-crossed individuals are used as parent individuals.

[0033] Select several individuals from the same family and cross them; the newly generated individual becomes the parent individual.

[0034] Perform mutation operations on the population; retain the top M individuals in terms of fitness among the mutated individuals and the newly generated parent individuals;

[0035] Determine whether the set number of iterations L for the growth tree clustering algorithm is met. If the termination condition is met, the algorithm ends and a new population is formed; otherwise, the crossover and mutation operations are repeated.

[0036] The specific process of step 8 is as follows: For each individual in the new population obtained in step 7, perform the following operations:

[0037] Determine whether Rand(0,1) is greater than p, where Rand(0,1) represents a randomly generated number between 0 and 1, and p is the set dynamic evolution probability;

[0038] If Rand(0,1)>p, then the chromosome corresponding to the best-ranked chromosome (Best) will be set to 1.

[0039] Determine if Rand(0,1) is greater than q, where q is the set dynamic elimination probability.

[0040] If Rand(0,1)>q, then the chromosome corresponding to Worst, the worst-ranked chromosome, is set to 0.

[0041] Output the population composed of individuals after evolution and elimination, and determine whether the current iteration has reached the total number of iterations G;

[0042] If the total number of iterations G has not been reached, continue with steps 4-8 for feature selection.

[0043] Once the total number of iterations G is reached, output the individual with the highest fitness in the population formed after evolution and elimination.

[0044] The p = Rand(0, 0.5) * (1 - g / G) is given by p, where g is the current iteration number and G is the total iteration number; q = Rand(0.5, 1) * (1 - g / G).

[0045] Steps 4-8 constitute the improved genetic algorithm.

[0046] Step 4 uses a multi-dimensional chromosome assessment method to evaluate the chromosome performance of the current individual. Compared with the method that only relies on fitness to judge chromosome performance, multi-dimensional assessment can obtain chromosome ranking more comprehensively.

[0047] Step 5 generates a unified chromosome ranking by using a feature ranking fusion method based on robust rank aggregation to evaluate the multi-dimensional chromosomes. It also obtains the globally optimal chromosome and the globally worst chromosome to guide the algorithm evolution and eliminate chromosomes, which can accelerate the algorithm convergence and reduce the final number of features.

[0048] Step 6 uses an improved fitness function to calculate the fitness of each individual. This fitness function considers both the feature autocorrelation coefficient and the f1 value, which can more comprehensively evaluate individual performance and is more suitable for imbalanced datasets.

[0049] Step 8 adds a dynamic evolution and dynamic elimination mechanism to the genetic algorithm. This mechanism dynamically evolves and eliminates the population based on the feature sorting and fusion results, which accelerates the optimization process of the algorithm and can effectively reduce the final number of features.

[0050] The beneficial effects of this invention are as follows: This invention employs an improved genetic algorithm and a feature ranking fusion algorithm. The feature ranking fusion algorithm is used to fuse the rankings of multi-dimensional chromosome evaluation methods to generate a unified ranking list, obtaining the globally optimal and globally worst chromosomes. The improved genetic algorithm adopts an evolutionary and elimination mechanism, and uses a crossover and mutation method based on growing tree clustering to accelerate algorithm convergence and significantly reduce the number of features, ultimately achieving feature selection. This method achieves faster and more accurate detection of intrusion behavior in industrial control networks through feature selection and a neural network classification model. The industrial control system intrusion detection method based on improved genetic algorithm feature selection described in this invention has high classification accuracy and low algorithm complexity, which can meet the actual needs of industrial control networks. Attached Figure Description

[0051] Figure 1 This is an overall flowchart of the industrial control system intrusion detection method based on improved genetic algorithm feature selection as described in this invention;

[0052] Figure 2 This is a flowchart of the improved genetic algorithm and feature sorting fusion method in this invention;

[0053] Figure 3 This is a distribution diagram of the features selected by the industrial control system intrusion detection method based on improved genetic algorithm feature selection in different samples of industrial control flow data SWAT according to the present invention; (a) is feature FIT101, (b) is feature P101, (c) is feature FIT201, (d) is feature MV304, (e) is feature FIT501, and (f) is feature PIT501.

[0054] Figure 4 This is a graph showing the correlation results of the selected features in the industrial control flow data SWaT using the industrial control system intrusion detection method based on improved genetic algorithm feature selection as described in this invention.

[0055] Figure 5 This image shows a comparison of the algorithm consumption time of the industrial control system intrusion detection method based on improved genetic algorithm feature selection in the present invention on different classification models after feature selection on industrial control flow data SWAT; RF is the random forest classifier; LR is the logistic regression classifier; NN is the neural network classifier; DT is the decision tree classifier; NB is the Bayesian classifier.

[0056] Figure 6The graphs show the convergence curves and feature number changes of the binary genetic algorithm and the method described in this invention; (a) is the traditional binary genetic algorithm; (b) is the industrial control system intrusion detection method based on improved genetic algorithm feature selection described in this invention. Detailed Implementation

[0057] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0058] Figure 1 This invention relates to an intrusion detection method for industrial control systems based on improved genetic algorithm feature selection, comprising:

[0059] S11: Read industrial control flow data;

[0060] S12: Normalize industrial control flow data, specifically including:

[0061] Assuming that traffic data contains N features, the traffic data set can be represented as U(f1,f2,…,f…). N For each traffic data feature f i Perform the following operations:

[0062] If f i This is a non-numerical feature, which is encoded using one-hot coding; the flow data feature is then normalized using the following formula;

[0063]

[0064] Where (f i ) min This represents the minimum value corresponding to this traffic data characteristic, (f i ) max This indicates the maximum value corresponding to this traffic data characteristic.

[0065] If f i It is a numerical feature, and the traffic data feature is normalized using the following formula;

[0066]

[0067] Where (f i ) min This represents the minimum value corresponding to this traffic data characteristic, (f i ) max This indicates the maximum value corresponding to this traffic data characteristic.

[0068] S13: Randomly generate an initial population based on the normalized flow data, with a population size of M individuals;

[0069] S14: Each individual is evaluated using a multi-dimensional chromosome assessment algorithm, and each individual's Inv... k The ranking of each individual's chromosome-corresponding features is evaluated using L1 regularization, L2 regularization, linear regression, stability selection, random forest, correlation coefficient, and mutual information methods, and the corresponding chromosome ranking list {r1,r2,…,r7} is saved.

[0070] S15: The evaluation results are fused using a feature ranking fusion method, specifically including:

[0071] The robust rank aggregation method is used to aggregate the chromosome ranking lists {r1, r2, ..., r7} to obtain a unified chromosome ranking list R. k .

[0072] The chromosome with the best ranking is marked as Best, and the chromosome with the worst ranking is marked as Worst;

[0073] S16: Calculate individual fitness, specifically including:

[0074] The fitness of each individual in the population is calculated using the following formula;

[0075] Fitness = γ (max,min) *(acc+f1)+(1-γ (max,min) *corr)

[0076] Where γ (max,min) To evaluate the random perturbation of the metrics, random numbers from min to max are generated to ensure the randomness of the search process. The default value for max is 0.6 and the default value for min is 0. acc is the average classification accuracy of the five-fold cross-validation of the given classifier. The default classifier is a neural network classifier. The mean F1 is obtained by weighted averaging of the number of samples in each class. corr is the average of the sum of the Pearson correlation coefficients among all features of an individual.

[0077] S17: Perform crossover and mutation operations using the growing tree clustering algorithm, specifically including:

[0078] The growing tree clustering algorithm is used to cluster individuals in the population into m clusters based on individual similarity, with each cluster forming a family.

[0079] The individuals with the highest fitness from different families are cross-crossed, and the newly generated individuals are used as parent individuals.

[0080] Select several individuals from the same family and cross them; the newly generated individual becomes the parent individual.

[0081] Perform mutation operations on the population, and retain the top M individuals with the highest fitness among the mutated individuals and the newly generated parent individuals;

[0082] Determine whether the set number of iterations L for the growing tree clustering algorithm is met. If the termination condition is met, the algorithm ends; otherwise, the crossover and mutation operations are repeated.

[0083] S18: Perform evolution and elimination operations, specifically including:

[0084] For each individual, perform the following operation:

[0085] Determine if Rand(0,1) > p?, where Rand(0,1) represents a randomly generated number between 0 and 1, and p is the dynamic evolution probability set. The default p = Rand(0,0.5)*(1-g / G), where g is the current iteration number and G is the total number of iterations.

[0086] If the condition is met, the chromosome corresponding to the best-ranked chromosome will be set to 1.

[0087] Determine if Rand(0,1)>q?, where q is the dynamic elimination probability set, and the default q = Rand(0.5,1)*(1-g / G);

[0088] If the condition is met, the chromosome corresponding to Worst, the worst-ranked chromosome, will be set to 0.

[0089] Output the population composed of individuals after evolution and elimination, and determine whether the current iteration has reached the total number of iterations G;

[0090] If the total number of iterations G has not been reached, the improved genetic algorithm is used for feature selection.

[0091] If the total number of iterations G is reached, output the individual with the highest fitness in the population formed after evolution and elimination.

[0092] S19: The individual with the highest fitness is put into the neural network classification model to determine whether there is intrusion behavior in the industrial control network and classify the intrusion behavior.

[0093] To verify the effectiveness of the proposed method, we performed feature selection on the SWaT dataset using the proposed method and presented the results.

[0094] Figure 3The diagram shows the distribution of the six features 'FIT101', 'P101', 'FIT201', 'MV304', 'FIT501', and 'PIT501' selected from the industrial control flow data SWAT using the method described in this invention across different samples. It can be seen that the distribution of all features across different samples shows significant differences, demonstrating the statistical differences of these selected features across different samples and enabling better sample classification.

[0095] Figure 4 This image shows the correlation results of six features 'FIT101', 'P101', 'FIT201', 'MV304', 'FIT501', and 'PIT501' selected from the industrial control flow data SWAT using the method described in this invention. We analyzed the feature correlation within the feature subset using the Pearson correlation coefficient as the evaluation criterion. Different color depths were used to quantify different degrees of lower correlation coefficients. It can be seen that none of the selected features showed strong correlation; only 13.33% (2 / 15) of the features had moderate correlation, and 86.67% (13 / 15) of the features showed weak correlation, demonstrating that the feature subset selected by the method described in this invention has low redundancy.

[0096] Figure 5 The graph shows a comparison of the algorithmic time consumption of the method described in this invention on different classification models after feature selection on industrial control flow data SWAT. It can be seen that the time complexity of different classifiers is significantly reduced after feature selection. Specifically, the algorithmic complexity of the Random Forest classifier (RF) decreased by 55.27%, the Logistic Regression classifier (LR) by 8.36%, the Neural Network classifier (NN) by 28.96%, the Decision Tree classifier (DT) by 92.09%, and the Bayesian classifier (NB) by 87.37%. Among all classifiers, the average time complexity of the algorithm decreased by 54.41% after feature selection. Therefore, the method described in this invention can effectively reduce the time complexity of the algorithm.

[0097] Figure 6The convergence curves and feature number changes of the traditional binary genetic algorithm and the method described in this invention are compared: (a) shows the traditional binary genetic algorithm, and (b) shows the method described in this invention. The traditional binary genetic algorithm has a slower convergence speed; however, it has the ability to escape local optima and search for the global optimum, demonstrating the advantages of genetic algorithms. However, the traditional binary genetic algorithm struggles to effectively reduce the number of features. Although the classification accuracy is relatively stable, it is difficult to remove redundant features to further improve classification accuracy. In contrast, the method described in this invention, due to its evolutionary and elimination strategy, has a faster convergence speed and also possesses the ability to escape local optima. Most importantly, the method described in this invention can effectively remove redundant features, ensuring a continuous reduction in the number of features, thereby enabling the discovery of better feature subsets.

[0098] Table 1 shows the comparison of classification accuracy between the method described in this invention and traditional feature selection methods on industrial control flow data SWAT. These compared feature selection methods include correlation coefficient (Corr), decision tree (DT), limit tree (ET), L1 regularization (Lasso), logistic regression (LR), L2 regularization (Ridge), stability selection (Stab), and random forest. The experiment used a neural network as the classifier. To ensure fairness in the comparison, all methods retained six features. We calculated the average classification accuracy of each method using five-fold cross-validation. It can be seen that the classification accuracy of the method described in this invention (0.987) is superior to all compared traditional feature selection methods, with an average improvement of 6.4%. This demonstrates that the proposed method can effectively select meaningful features, improve the accuracy of industrial control intrusion detection, and achieve stable intrusion detection.

[0099] Table 1. Comparison of classification accuracy of the present invention with traditional feature selection methods on SWAT industrial control flow data.

[0100]

[0101] This invention proposes an intrusion detection method for industrial control systems based on improved genetic algorithm feature selection. This method is more suitable for intrusion detection in industrial control systems, can effectively select meaningful features, improve model classification accuracy and reduce algorithm complexity, so as to efficiently detect intrusion behavior in industrial control networks. (1) This method comprehensively considers the feature autocorrelation coefficient and F1 value as the fitness of individuals. This fitness function can more comprehensively evaluate individual performance and is more suitable for imbalanced datasets such as industrial control flow data, making the intrusion detection method more compatible with industrial control systems. (2) This method uses a multi-dimensional chromosome evaluation method to evaluate the chromosome performance corresponding to the current individual. Compared with the method that only relies on fitness to judge chromosome performance, multi-dimensional evaluation can obtain chromosome ranking more comprehensively. (3) This method uses a feature ranking fusion algorithm based on robust rank aggregation to fuse the ranking of the multi-dimensional chromosome evaluation method, generate a unified ranking list, and obtain the globally optimal chromosome and the globally worst chromosome. (4) This method adopts an evolution and elimination mechanism and uses a crossover and mutation method based on growth tree clustering to accelerate algorithm convergence and significantly reduce the number of features, ultimately achieving feature selection. (5) This method achieves faster and more accurate detection of intrusion behavior in industrial control networks through feature selection and neural network classification models. This method has high classification accuracy and low algorithm complexity, which can meet the actual needs of industrial control networks.

[0102] The above preferred embodiments are only for illustrating the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it. They should not be used to limit the scope of protection of the present invention. All equivalent changes or modifications made in accordance with the essence of the present invention shall fall within the scope of protection of the present invention.

[0103] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. An intrusion detection method for industrial control systems based on feature selection using an improved genetic algorithm, characterized in that, Includes the following steps: Step 1: Obtain the traffic data to be selected for feature selection; the traffic data includes N features, and the traffic data set is U(f1,f2,…f…). i …,f N ); Step 2: Traffic data preprocessing; Select the preprocessing method based on the characteristics of the traffic data; Step 3: Randomly generate an initial population based on the preprocessed traffic data, with a population size of M individuals; Step 4: Evaluate the chromosomes of each individual in the population using a multi-dimensional chromosome assessment method; chromosomes are the characteristics of the flow data. Step 5: Use a feature ranking and fusion method based on robust rank aggregation to perform feature ranking and fusion on the multi-dimensional chromosome evaluation results, and save the best and worst chromosomes; Step 6: Calculate the fitness of each individual using the improved fitness evaluation function; the individual fitness is calculated according to the following formula: Fitness=c (max,min) *(acc+f1)+(1-γ (max,min) *corr) Where, γ (max,min) To evaluate the random perturbation of the metrics, random numbers from min to max are generated to ensure the randomness of the search process. acc is the five-fold cross-validation classification accuracy of the selected classifier. The mean F1 is obtained by weighted averaging of the sample size for each class. corr is the average of the sum of Pearson correlation coefficients among all features of an individual. Step 7: Use the growing tree clustering algorithm to perform crossover and mutation operations on the current population to obtain a new population; The growing tree clustering algorithm is used to cluster individuals in the population into m clusters based on individual similarity, with each cluster forming a family. Individuals with the highest fitness from different families are cross-crossed, and the newly generated cross-crossed individuals are used as parent individuals. Select several individuals from the same family and cross them; the newly generated individual becomes the parent individual. Perform mutation operations on the population; retain the top M individuals in terms of fitness among the mutated individuals and the newly generated parent individuals; Determine whether the set number of iterations L for the growing tree clustering algorithm is met. If the termination condition is met, the algorithm ends and a new population is formed; otherwise, crossover and mutation operations are repeated. Step 8: Perform evolutionary and elimination operations on individuals in the new population based on the feature ranking and fusion results; the specific process of step 8 is as follows: For each individual in the new population obtained in step 7, perform the following operations: Determine whether Rand(0,1) is greater than p, where Rand(0,1) represents a randomly generated number between 0 and 1, and p is the set dynamic evolution probability; If Rand(0,1)>p, then the chromosome corresponding to the best-ranked chromosome (Best) will be set to 1. Determine if Rand(0,1) is greater than q, where q is the set dynamic elimination probability; If Rand(0,1)>q, then the chromosome corresponding to Worst, the worst-ranked chromosome, is set to 0. Output the population composed of individuals after evolution and elimination, and determine whether the current iteration has reached the total number of iterations G; If the total number of iterations G has not been reached, continue with steps 4-8 for feature selection. Once the total number of iterations G is reached, output the individual with the highest fitness in the population formed after evolution and elimination. Step 9: Output the individual with the highest fitness obtained in Step 8 to the selected classifier to determine whether there is intrusion behavior in the industrial control network and classify the intrusion behavior.

2. The intrusion detection method for industrial control systems based on improved genetic algorithm and feature ranking fusion feature selection as described in claim 1, characterized in that, The specific preprocessing of traffic data in step 2 is as follows: when the characteristics f of the traffic data i When the feature is non-numerical, the one-hot encoding method is used to encode the traffic data, and then the encoded traffic data is normalized; when the feature f of the traffic data... i When the feature is numerical, normalization is performed directly.

3. The intrusion detection method for industrial control systems based on improved genetic algorithm and feature ranking fusion feature selection as described in claim 2, characterized in that, The normalization operation is as follows: Among them, (f i ) min This represents the minimum value corresponding to this traffic data characteristic, (f i ) max This indicates the maximum value corresponding to this traffic data characteristic.

4. The intrusion detection method for industrial control systems based on improved genetic algorithm and feature ranking fusion feature selection as described in claim 2, characterized in that, The specific process of step 4 is as follows: For each individual Inv k Perform the following operations: The chromosomes of each individual were scored using L1 regularization, L2 regularization, linear regression, stability selection, random forest, correlation coefficient, and mutual information methods, respectively, resulting in chromosome score lists {e1,e2,…,e7} for each method. The chromosome score lists were then re-ranked according to the scores to obtain the corresponding chromosome ranking list {r1,r2,…,r7}.

5. The intrusion detection method for industrial control systems based on improved genetic algorithm and feature sorting fusion feature selection according to claim 4, characterized in that, In step 5, the robust rank aggregation method is used to aggregate the chromosome ranking list {r1,r2,…,r7} to obtain a unified chromosome ranking list R; based on the unified chromosome ranking list R, the chromosome with the best ranking is marked as Best, and the chromosome with the worst ranking is marked as Worst.

6. The intrusion detection method for industrial control systems based on improved genetic algorithm and feature ranking fusion feature selection according to claim 1, characterized in that, The value of max is 0.6, the value of min is 0, and the selected classifier is a neural network classifier.

7. The intrusion detection method for industrial control systems based on improved genetic algorithm and feature ranking fusion feature selection according to claim 1, characterized in that, The p = Rand(0, 0.5) * (1 - g / G) is given by p, where g is the current iteration number and G is the total iteration number; q = Rand(0.5, 1) * (1 - g / G).

Images