Training method of intrusion detection model, intrusion detection method and device

Abstract

This application discloses a training method, intrusion detection method, and apparatus for an intrusion detection model. It involves collecting production process data from an industrial control system, using this data as training data. Feature extraction is performed on the production process data to obtain production process feature data. This feature data, along with random noise, is input into a generative adversarial network (GAN) to obtain adversarial example data. To further improve the quality of the adversarial example data, it undergoes weighting and random projection processing to obtain target adversarial example data. This target adversarial example data is then input into the intrusion detection model to obtain its predicted classification type. Subsequently, the intrusion detection model can be trained based on the predicted classification type and type label of the target adversarial example data. Thus, training the intrusion detection model with high-quality adversarial example data improves its robustness and accuracy.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a training method for an intrusion detection model, an intrusion detection method, and an apparatus. Background Technology

[0002] With the development of information technology, industrial control systems are adopting more open communication protocols instead of proprietary industrial protocols. This has led to the introduction of traditional information technology vulnerabilities into industrial control systems, making even relatively closed and secure systems targets for attacks. Therefore, it is essential to build secure and effective intrusion detection models for industrial control systems. Intrusion detection models can detect whether an industrial control system has been attacked by analyzing its production process data.

[0003] Current intrusion detection models are vulnerable to adversarial attacks. This means that attackers targeting industrial control systems can add subtle perturbations to the production process data, achieving only minor modifications. This makes intrusion detection models less robust and less accurate when detecting such perturbed data. Summary of the Invention

[0004] To address the aforementioned technical problems, this application provides a training method for an intrusion detection model, an intrusion detection method, and an apparatus, which can improve the detection accuracy of the intrusion detection model.

[0005] To achieve the above objectives, the technical solution provided in this application is as follows:

[0006] Firstly, this application provides a method for training an intrusion detection model, the method comprising:

[0007] Collect production process data from industrial control systems;

[0008] Feature extraction is performed on the production process data to obtain production process feature data;

[0009] The production process feature data and random noise are input into a generative adversarial network (GAN) to obtain adversarial sample data output by the GAN.

[0010] The adversarial sample data is weighted and randomly projected to obtain target adversarial sample data;

[0011] The target adversarial sample data is input into the intrusion detection model, and the predicted classification type of the target adversarial sample data output by the intrusion detection model is obtained.

[0012] Based on the predicted classification type and type label of the target adversarial sample data, a loss value is calculated, and the intrusion detection model is trained according to the loss value to obtain the trained intrusion detection model; the trained intrusion detection model is used to identify whether the current production process data of the industrial control system is abnormal data.

[0013] Secondly, this application provides an intrusion detection method, the method comprising:

[0014] Collect current production process data from industrial control systems;

[0015] Feature extraction is performed on the current production process data to obtain current production process feature data;

[0016] The current production process feature data is input into the intrusion detection model to obtain the predicted classification type of the current production process feature data output by the intrusion detection model; the intrusion detection model is trained based on the training method of the intrusion detection model.

[0017] Based on the predicted classification type of the current production process characteristic data, it is determined whether the industrial control system has been subjected to an intrusion attack.

[0018] Thirdly, this application provides a training apparatus for an intrusion detection model, the apparatus comprising:

[0019] The data acquisition unit is used to collect production process data from industrial control systems.

[0020] The feature extraction unit is used to extract features from the production process data to obtain production process feature data.

[0021] The input unit is used to input the production process feature data and random noise into the generative adversarial network and obtain the adversarial sample data output by the generative adversarial network.

[0022] The processing unit is used to perform weighted processing and random projection processing on the adversarial sample data to obtain target adversarial sample data;

[0023] The acquisition unit is used to input the target adversarial sample data into the intrusion detection model and acquire the predicted classification type of the target adversarial sample data output by the intrusion detection model.

[0024] The training unit is used to calculate a loss value based on the predicted classification type and type label of the target adversarial sample data, train the intrusion detection model according to the loss value, and obtain the trained intrusion detection model; the trained intrusion detection model is used to identify whether the current production process data of the industrial control system is abnormal data.

[0025] Fourthly, this application provides an intrusion detection device, the device comprising:

[0026] The data acquisition unit is used to collect current production process data from the industrial control system.

[0027] The feature extraction unit is used to extract features from the current production process data to obtain current production process feature data;

[0028] The input unit is used to input the current production process feature data into the intrusion detection model and obtain the predicted classification type of the current production process feature data output by the intrusion detection model; the intrusion detection model is trained based on the training method of the intrusion detection model.

[0029] The judgment unit is used to determine whether the industrial control system has been subjected to an intrusion attack based on the predicted classification type of the current production process feature data.

[0030] Fifthly, this application provides an electronic device, comprising:

[0031] One or more processors;

[0032] Storage device, on which one or more programs are stored,

[0033] When the one or more programs are executed by the one or more processors, the one or more processors implement the above-described training method for the intrusion detection model, or implement the above-described intrusion detection method.

[0034] As can be seen from the above technical solution, this application has the following beneficial effects:

[0035] This application provides a training method for an intrusion detection model. First, production process data from an industrial control system is collected and used as training data. Feature extraction is performed on the production process data to obtain production process feature data. The production process feature data and random noise are then input into a generative adversarial network (GAN) to obtain adversarial example data. To further improve the quality of the adversarial example data, weighted processing and random projection processing are applied to obtain target adversarial example data. This target adversarial example data is then input into the intrusion detection model to obtain the predicted classification type. Subsequently, the intrusion detection model can be trained based on the predicted classification type and type label of the target adversarial example data. Thus, training the intrusion detection model with high-quality adversarial example data improves the robustness and accuracy of the intrusion detection model. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 A flowchart illustrating a training method for an intrusion detection model provided in an embodiment of this application;

[0038] Figure 2 A flowchart illustrating the use of a generative adversarial network is provided in an embodiment of this application.

[0039] Figure 3 This is a schematic diagram of the structure of a generative adversarial network provided in an embodiment of this application;

[0040] Figure 4 A flowchart illustrating an intrusion detection method provided in this application embodiment;

[0041] Figure 5 A schematic diagram of the structure of a training device for an intrusion detection model provided in an embodiment of this application;

[0042] Figure 6 This is a schematic diagram of an intrusion detection device provided in an embodiment of this application. Detailed Implementation

[0043] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the embodiments of this application will be further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0044] To facilitate understanding and explanation of the technical solutions provided in the embodiments of this application, the background technology involved in the embodiments of this application will be introduced first.

[0045] With the development of information technology, industrial control systems are adopting more open communication protocols instead of proprietary industrial protocols. This has led to the introduction of traditional information technology vulnerabilities into industrial control systems, making even relatively closed and secure systems targets for attacks. The information security issues of industrial control systems are becoming more prominent; therefore, building secure and effective intrusion detection models for industrial control systems is essential. Intrusion detection models can detect whether an industrial control system has been attacked by analyzing its production process data.

[0046] Current intrusion detection models are vulnerable to adversarial attacks. This means that attackers targeting industrial control systems can add subtle perturbations to the production process data, achieving only minor modifications. This makes intrusion detection models less robust and less accurate when detecting such perturbed data.

[0047] Based on this, this application provides a training method for an intrusion detection model. First, production process data from an industrial control system is collected, and this collected data is used as training data. Feature extraction is performed on the production process data to obtain production process feature data. The production process feature data and random noise are input into a generative adversarial network (GAN) to obtain adversarial sample data. To further improve the quality of the adversarial sample data, weighted processing and random projection processing are applied to the adversarial sample data to obtain target adversarial sample data. The target adversarial sample data is input into the intrusion detection model to obtain the predicted classification type of the target adversarial sample data. Then, the intrusion detection model can be trained based on the predicted classification type and type label of the target adversarial sample data. Thus, training the intrusion detection model based on high-quality adversarial sample data can improve the robustness and accuracy of the intrusion detection model.

[0048] To facilitate understanding of this application, the following description, in conjunction with the accompanying drawings, illustrates a training method for an intrusion detection model provided in an embodiment of this application.

[0049] See Figure 1 As shown, this figure is a flowchart of a training method for an intrusion detection model provided in an embodiment of this application. As an optional example, this method can be applied to a terminal device or a server. Figure 1 As shown, the method may include S101-S106:

[0050] S101: Collects production process data from industrial control systems.

[0051] An industrial control system is an automated system used to provide control, manufacturing, and monitoring functions for industrial facilities. It generally includes sensors, controllers, control loops, and control networks. Taking the SWaT safe water treatment system as an example, this is a type of industrial control system used to implement water treatment. Specifically, the SWaT safe water treatment system is a safe water treatment system based on the SWaT model, where SWaT stands for Soil and Water Assessment Tool.

[0052] In this step, production process data of the industrial control system is collected. Production process data refers to data generated during the operation of the industrial control system. There are various types of production process data, and no specific type or number of types is limited here. As an optional example, the production process data of the simulated industrial control system can be collected based on a test platform. This production process data serves as training data for training the intrusion detection model.

[0053] For example, a SWaT-safe water treatment system can be simulated using a SWaT testing platform to obtain production process data. Understandably, the SWaT testing platform can simulate various cyberattacks against a real SWaT-safe water treatment system. Compared to data collected during the actual system's production process, the simulated cyberattacks are more diverse and varied, which helps in generating high-quality adversarial sample data with less model information.

[0054] In practical applications, the SWaT Safe Water Treatment System (SWaT system for short) comprises six different water treatment stages, from P1 to P6. Each water treatment stage of the SWaT system is controlled by an independent PLC controller, with the six PLCs working collaboratively to control the entire process. Stage P1 controls the flow rate of the raw water to be treated by opening or closing electric valves; Stage P2 pre-treats the raw water from P1 and assesses its quality; Stage P3 removes excess impurities through the UF (ultrafiltration) feed tank and delivers the water to the RO (reverse osmosis) feed tank in Stage P4. After passing through the RO feed tank, the water is sent to a PLC-controlled ultraviolet dechlorination unit to remove free chlorine. In Stage P5, the dechlorinated water passes through a two-stage RO filtration unit to reduce inorganic impurities. Stage P6 stores the water from the RO system and prepares it for distribution in the water distribution system, while simultaneously cleaning the ultrafiltration membrane using an ultrafiltration backwash pump (UF), which automatically starts every 30 minutes.

[0055] The attack points on a SWaT system can be physical devices or the connection points between the actuator and the PLC network communication layer. Based on the differences in the attack points, attacks on SWaT systems can be specifically divided into four types, as shown in Table 1. Among them, a single-level single-point (SSSP) attack primarily targets one point in the SWaT system; a single-level multi-point (SSMP) attack focuses on two or more attack points within the SWaT, but only targets one stage; a multi-level single-point (MSSP) attack is similar to an SSMP attack, except that SSMP attacks are executed across multiple levels; and a multi-level multi-point (MSMP) attack is an SSMP attack that executes two or more stages.

[0056] During the 11-day continuous operation of the simulated SWaT system, production process data of the SWaT system was collected. Among them, 7 days were recorded under the normal operation conditions of the simulated SWaT system, and 4 days were recorded under the attack conditions of the simulated SWaT system. The number of attacks for each category is shown in Table 1.

[0057] As an example, the SWaT testing platform simulated various cyberattack scenarios over 11 days, ultimately collecting a total of 946,722 production process data entries. Of these, 449,919 entries were physical attribute data, which could be used to analyze cyberattacks on industrial control systems. Approximately 44,992 production process data entries were evenly extracted and divided into training and testing data in a 2:8 ratio, with 35,996 training data entries and 8,996 testing data entries. The production process data contained a total of 51 characteristic attributes.

[0058] Table 1 Number of attacks for each category

[0059] Attack type Number of attacks SSSP 26 MSSP 4 MSMP 2 SSMP 4

[0060] It is understandable that the collected production process data includes two types of data: normal data and attack data. That is, the training data includes both normal and attack data, and the test data also includes both types of data. Each piece of collected production process data has a corresponding type label; for example, when the production process data is normal data, the type label is 0, and when the production process data is attack data, the type label is 1.

[0061] S102: Extract features from production process data to obtain production process feature data.

[0062] Feature extraction is performed on the acquired production process data to obtain production process feature data. It should be understood that the production process data here is training data.

[0063] Furthermore, after acquiring the production process feature data, the production process feature data is standardized, and duplicate feature data is removed while all feature data is mapped to the vicinity of [0,1] to avoid affecting the training and prediction of the subsequent intrusion detection model.

[0064] In one possible implementation, this application provides a specific method for extracting features from production process data to obtain production process feature data, including:

[0065] Feature extraction of production process data is performed based on stacked autoencoders to obtain production process feature data.

[0066] Among these methods, using stacked autoencoders for feature extraction can effectively reduce the dimensionality of production process data. For example, if the production process data before feature extraction is 51-dimensional, it can be reduced to 32-dimensional after feature extraction. This demonstrates that the extracted production process feature data can capture valuable information about the production process, effectively reducing data dimensionality and complexity while maintaining detection accuracy, thus shortening the training time for subsequent intrusion detection models.

[0067] Understandably, production process data corresponds to type labels, which are either 0 or 1. 0 indicates normal production process data, while 1 indicates attack data. Production process feature data includes both normal and attack feature data. After obtaining production process feature data from the production process data, the type label for the feature data is the same as the corresponding production process data, both being 0 (representing normal feature data) or 1 (representing attack feature data). That is, when the type label for a piece of production process data is 0, the type label for the production process feature data obtained from its feature extraction will also be 0.

[0068] S103: Input the production process feature data and random noise into the generative adversarial network to obtain the adversarial sample data output by the generative adversarial network.

[0069] Generative Adversarial Networks (GANs) primarily consist of a generator network and a discriminator network. The generator network generates fake sample data based on random noise, and this fake sample data, along with production process feature data, is then input into the discriminator network. The production process data serves as the real sample data, corresponding to the fake sample data. The discriminator network determines the authenticity of the input data, calculating the probability that the input data is production process feature data; a higher probability indicates a greater likelihood that the input data is indeed production process feature data. The generator network continuously strengthens its capabilities, making the generated fake sample data closely resemble the production process feature data. The discriminator network strives to distinguish the authenticity of the input data as closely as possible.

[0070] The generator and discriminator networks undergo iterative training. When they reach Nash equilibrium, the generative adversarial network outputs the optimal adversarial sample. This optimal adversarial sample consists of forged sample data generated by the generator network at Nash equilibrium and production process feature data. Understandably, when the generator and discriminator networks reach Nash equilibrium, the distribution of the forged sample data and the production process feature data generated by the generator network is identical, and the forged sample data generated by the generator network is infinitely close to the production process feature data, making it impossible for the discriminator network to identify the forged sample data.

[0071] It should be noted that the acquired adversarial sample data also has corresponding type labels. The type labels corresponding to the production process feature data in the adversarial sample data are described in S102. The type labels corresponding to the forged sample data and the production process feature data in the adversarial sample data are the same, also 0 or 1. For example, when the label corresponding to the abnormal feature data in the production process feature data is 1, the type label corresponding to the data in the forged sample data that is infinitely close to that abnormal feature data is also 1. When the label corresponding to the normal feature data in the production process feature data is 0, the type label corresponding to the data in the forged sample data that is infinitely close to that normal feature data is also 0.

[0072] In practical applications, adversarial sample data refers to data generated by attackers in adversarial environments by adding slight perturbations to the normal training dataset, resulting in inconspicuous modifications and causing intrusion detection systems to misclassify the data. The act of damaging the detection capabilities of an intrusion detection model by generating adversarial sample data is called an adversarial attack. It can be understood that the adversarial sample data obtained through the Generative Adversarial Network (GAN) in this step can be interpreted as simulating adversarial sample data in real-world applications. The adversarial sample data obtained through the GAN can generate adversarial attacks against the intrusion detection model. In this embodiment, the adversarial sample data obtained through the GAN is of high quality, resulting in high prediction accuracy for the intrusion detection model subsequently trained based on this adversarial sample data.

[0073] In one possible implementation, this application provides a specific method for inputting production process feature data and random noise into a generative adversarial network (GAN) to obtain adversarial sample data output by the GAN, as detailed below.

[0074] S104: Perform weighted processing and random projection processing on the adversarial sample data to obtain the target adversarial sample data.

[0075] After acquiring adversarial sample data, it undergoes weighting and random projection processing to obtain target adversarial sample data. The weighting process makes it more difficult to identify forged samples within the weighted adversarial sample data, thereby further improving the quality of the adversarial sample data.

[0076] Further random projection processing of the weighted adversarial sample data to obtain target adversarial sample data can map the data distribution of the weighted adversarial sample data to other low-dimensional spaces, reduce the impact of data noise, reduce the computational complexity of subsequent calculation processes, and maintain the approximate high-probability distance of the original adversarial sample data.

[0077] This results in intrusion detection models trained on target adversarial sample data achieving higher detection accuracy for nonlinear and high-dimensional industrial control data, as well as complex attack types such as deception attacks and adversarial attacks.

[0078] It should be noted that the type labels of the target adversarial sample data obtained after processing are the same as those of the adversarial sample data before processing.

[0079] In one possible implementation, this application provides a specific method for obtaining target adversarial sample data by weighting and randomizing adversarial sample data, as detailed below.

[0080] S105: Input the target adversarial sample data into the intrusion detection model and obtain the predicted classification type of the target adversarial sample data output by the intrusion detection model.

[0081] Intrusion detection technology is used to detect malicious network activity on a single host or throughout a network. The intrusion detection model constructed in this application is a specific implementation of intrusion detection technology, used to identify whether input data is attack data, and can be applied to industrial control systems in specific industrial environments. Detection based on the intrusion detection model can reduce the risk of production interruptions in industrial control systems caused by network anomalies.

[0082] The acquired adversarial sample data is input into the intrusion detection model to obtain the predicted classification type of the adversarial sample data output by the intrusion detection model.

[0083] As an optional example, the intrusion detection model is a support vector machine (SVM)-based model. SVM treats the classification problem as a quadratic optimization problem, using statistical theory to find the optimal hyperplane in a high-dimensional feature space, maximizing the distance between the two classes. SVM exhibits good generalization ability in handling nonlinear and high-dimensional data. Therefore, for nonlinear and high-dimensional industrial control system data, this embodiment can use an SVM-based intrusion detection model for training, resulting in a well-trained intrusion detection model with improved detection performance, accuracy, and stability.

[0084] Furthermore, the intrusion detection model provided in this application embodiment can be called the RW-SVM intrusion detection model, where R refers to weighted processing, W refers to random projection processing, and SVM refers to support vector machine. The RW-SVM intrusion detection model represents the processing of target adversarial sample data obtained through weighted processing and random projection processing based on support vector machine.

[0085] S106: Based on the predicted classification type and type label of the target adversarial sample data, calculate the loss value, train the intrusion detection model according to the loss value, and obtain the trained intrusion detection model; the trained intrusion detection model is used to identify whether the current production process data of the industrial control system is abnormal data.

[0086] After obtaining the predicted classification type of the target adversarial sample data output by the intrusion detection model, a loss value is calculated based on the predicted classification type and type label of the target adversarial sample data. The model parameters are then adjusted based on the loss value to train the intrusion detection model. When the training cutoff condition is met, the trained intrusion detection model is obtained. Furthermore, the trained intrusion detection model can be tested online using test data to evaluate its detection accuracy.

[0087] It can be seen that the trained intrusion detection model can be used to identify whether the current production process data of an industrial control system is abnormal. Here, the current production process data refers to the real-time production process data generated by the industrial control system during actual operation.

[0088] Based on the aforementioned S101-S106, this application provides a training method for an intrusion detection model. First, production process data from an industrial control system is collected, and this collected data serves as training data. Feature extraction is performed on the production process data to obtain production process feature data. The production process feature data and random noise are input into a generative adversarial network (GAN) to obtain adversarial sample data. To further improve the quality of the adversarial sample data, weighted processing and random projection processing are applied to the adversarial sample data to obtain target adversarial sample data. The target adversarial sample data is input into the intrusion detection model to obtain the predicted classification type of the target adversarial sample data. Then, the intrusion detection model can be trained based on the predicted classification type and type label of the target adversarial sample data. Thus, training the intrusion detection model based on high-quality adversarial sample data can improve the robustness and accuracy of the intrusion detection model.

[0089] See Figure 2 , Figure 2 This is a flowchart illustrating the use of a generative adversarial network (GAN) as provided in an embodiment of this application. Figure 2 As shown, in one possible implementation, this application embodiment provides a specific implementation method for inputting production process feature data and random noise into a generative adversarial network (GAN) in step S103 to obtain adversarial sample data output by the GAN, including steps S201-S204:

[0090] S201: Input random noise into the generator network and obtain fake sample data output by the generator network.

[0091] See Figure 3 , Figure 3 This is a schematic diagram of a generative adversarial network structure provided in an embodiment of this application. Figure 3 As shown, the generator network can be represented by G, and the discriminator network by D. The network parameters, weights, and bias parameters of the generator and discriminator networks are initialized. Random noise is input into the generator network to obtain fake sample data output by the generator network. As an optional example, the random noise follows a normal distribution N(0,1).

[0092] It should be noted that the goal of the generator network G is to make the generated fake sample data infinitely close to the production process feature data that is the real sample data, so that the discriminator network D cannot accurately identify the source of the data.

[0093] S202: The forged sample data and production process feature data are combined to form adversarial sample data, which is then input into the discriminant network so that the discriminant network can discriminate the adversarial sample data and obtain the prediction and discrimination results corresponding to the adversarial sample data.

[0094] like Figure 3As shown, forged sample data and production process feature data together constitute adversarial sample data, which serves as the input data for discriminant network D. Discriminant network D is used to distinguish between forged sample data and production process feature data, obtaining the predicted discrimination results corresponding to the adversarial sample data.

[0095] In practice, after receiving adversarial sample data, the discriminant network D outputs a set of probability values ​​corresponding to the adversarial sample data. The predicted discrimination result for the adversarial sample data can be obtained from this set of probability values. The set of probability values ​​for the adversarial sample data consists of the probability values ​​corresponding to each data point in the adversarial sample data, and the predicted discrimination result for the adversarial sample data is composed of the predicted discrimination results corresponding to each data point in the adversarial sample data. Specifically, when the probability value corresponding to a data point in the adversarial sample data is 1, the data is determined to be production process feature data that serves as genuine sample data; when the probability value is not 1 (i.e., less than 1), the data is determined to be fake sample data.

[0096] S203: Calculate the error between the predicted discrimination result corresponding to the adversarial sample data and the actual discrimination result corresponding to the adversarial sample data, and update the network parameters of the generation network and the discrimination network based on the error.

[0097] After obtaining the predicted discrimination results corresponding to the adversarial sample data, the error between the predicted discrimination results corresponding to the adversarial sample data and the actual discrimination results corresponding to the adversarial sample data is calculated, and the network parameters of the generation network and the discrimination network are updated based on the error.

[0098] S204: Reduce random noise, re-execute the process of inputting random noise into the generator network, obtain the fake sample data output by the generator network and subsequent steps, until the predicted discrimination result corresponding to the adversarial sample data and the actual discrimination result corresponding to the adversarial sample data meet the preset conditions, and output the adversarial sample data.

[0099] As an optional example, the preset condition is that the predicted discrimination result corresponding to the adversarial sample data is the same as the actual discrimination result corresponding to the adversarial sample data, or the error between the predicted discrimination result corresponding to the adversarial sample data and the actual discrimination result corresponding to the adversarial sample data meets the preset threshold.

[0100] When the predicted and actual results corresponding to the adversarial sample data do not meet the preset conditions, the random noise is reduced, and steps S201 and subsequent steps are re-executed until the predicted and actual results corresponding to the adversarial sample data meet the preset conditions, at which point the adversarial sample data is output. The data distribution of the adversarial sample data is similar to the data distribution of the production process feature data, which serves as the real sample data.

[0101] Understandably, when the predicted and actual judgment results corresponding to the adversarial sample data meet preset conditions, it indicates that the forged sample data generated by the generator network has successfully deceived the discriminator network D. At this point, the obtained adversarial sample data is considered the optimal adversarial sample data.

[0102] Based on S201-S204, it can be seen that under different perturbations, the generator network and the discriminator network continuously engage in a game, and the optimal perturbation point is found when Nash equilibrium is reached. The adversarial sample data at this point is the optimal adversarial sample data, possessing strong attack capabilities and being difficult for intrusion detection models to detect. This results in high accuracy for subsequent intrusion detection models trained based on this adversarial sample data.

[0103] In one possible implementation, this application provides a specific implementation method for performing weighted processing and random projection processing on adversarial sample data in S104 to obtain target adversarial sample data, including A1-A2:

[0104] A1: Weight the adversarial sample data to obtain the weighted adversarial sample data.

[0105] As an optional example, this application provides a specific implementation of A1, including A101-A103:

[0106] A101: Based on the adversarial sample data, its type label, and the conditional formula, obtain the range of values ​​for the first parameter and the corresponding relaxation value of the adversarial sample data; the conditional formula is:

[0107]

[0108] Where i is a positive integer, n is the amount of adversarial sample data, and x i For the i-th adversarial example data, y i Let Φ(x) be the type label corresponding to the i-th adversarial sample data. i ) is x i The activation function, Φ(x) i ) = w T x i b1 is a constant, w is the first parameter, and ξ i Let be the relaxation value corresponding to the i-th adversarial sample data.

[0109] Based on the above formula, the first parameter w and the relaxation value ξ can be obtained. i The range of values ​​for .

[0110] A102: Based on the first parameter, the relaxation value corresponding to the adversarial example data, and the first formula, the weights corresponding to the adversarial example data are calculated; the first formula is:

[0111]

[0112] Where C is the regularization constant, β i Let β be the weight corresponding to the i-th adversarial example data. Based on the first formula, β can be calculated. i .

[0113] Understandably, this is to penalize larger relaxation values ​​ξ. i A regularization constant C is introduced to penalize all adversarial sample data equally. To reduce the impact of adversarial sample data, it is selectively penalized by introducing a weight β for each adversarial sample data. i Smaller β i The value will allow for a larger ξ i At this value, slight perturbations in the adversarial example data will no longer be easily detected, thus improving the quality of the adversarial example data. Conversely, a large β value... i The value will force ξ i The sample size is relatively small, so the effect on a specific sample will be emphasized.

[0114] The first formula above can also be transformed into the following formula for processing:

[0115]

[0116] st0≤α i ≤Cβ i i = 1, ..., n

[0117]

[0118] Where, α i Let α be the target parameter corresponding to the i-th adversarial example data. j Let x be the target parameter corresponding to the j-th adversarial sample data, and k be a multiple. j is a positive integer, x j For the j-th adversarial example data, y j Let be the type label corresponding to the j-th adversarial sample data.

[0119] A103: Weight the adversarial sample data based on the weights corresponding to the adversarial sample data to obtain the weighted adversarial sample data.

[0120] By multiplying the adversarial sample data by the corresponding weights, we can achieve weighted processing of the adversarial sample data and obtain the weighted adversarial sample data.

[0121] A2: Perform random projection processing on the weighted adversarial sample data to obtain the target adversarial sample data.

[0122] Performing random projection processing on the adversarial sample data after weighted processing can map the adversarial sample data after weighted processing into a low-dimensional space, reduce the influence of data noise, reduce the computational complexity of the algorithm, and maintain the approximate high-probability distance of the original data.

[0123] As an optional example, the embodiment of the present application provides a specific implementation manner of A2, including A201 - A204:

[0124] A201: Construct a random projection matrix.

[0125] Random projection processing is to map the adversarial sample data after weighted processing into a low-dimensional space through a random projection matrix A. Among them, the random projection matrix A should ensure that the attribute information of the adversarial sample data after weighted processing is retained in the subspace Z with high probability. Suppose A is a transformation matrix with K rows and M columns, and the rank of A satisfies K < M, then the element a of the random projection matrix A km should satisfy:

[0126]

[0127] where k represents the k-th row and m represents the m-th column. The random projection matrix A is a d×r-dimensional random matrix, the random projection matrix A follows a Gaussian distribution of N(0, 1), or the elements in the random projection matrix A are all +1 or -1 with equal probability.

[0128] A202: Based on the random projection matrix, the adversarial sample data after weighted processing, and the first projection mapping formula, obtain the projection data mapped to the adversarial sample data after weighted processing; the first projection mapping formula is:

[0129]

[0130] where x i ' is the i-th adversarial sample data after weighted processing, g i is the projection data mapped to the i-th adversarial sample data after weighted processing, A is a d×r-dimensional random projection matrix, d represents the space dimension of the adversarial sample data after weighted processing, and r represents the space dimension of the projection data mapped to the adversarial sample data after weighted processing.

[0131] It can be understood that the projection data g mapped to the adversarial sample data after weighted processing can be calculated through the above first projection mapping formula i . It should be noted that this projection data is only one kind of projection data mapped to the adversarial sample data after weighted processing, not the low-dimensional data obtained based on the random projection matrix.

[0132] A203: Based on the projection data, the weighted adversarial sample data, and the second formula, calculate the second parameter; the second parameter is greater than zero; the second formula is:

[0133]

[0134] Where P is the event probability, γ is the second parameter, x1' is the weighted first adversarial sample data, x'2 is the weighted second adversarial sample data, g1 is the projection data mapped to the weighted first adversarial sample data, and g2 is the projection data mapped to the weighted second adversarial sample data.

[0135] Based on the second formula, the second parameter γ can be calculated, and the second parameter γ is greater than zero.

[0136] A204: Based on the second parameter, the random projection matrix, the weighted adversarial sample data, and the second projection mapping formula, calculate the target adversarial sample data after random projection processing; the second projection mapping formula is:

[0137]

[0138] Where X represents the weighted production process feature data, T represents the weighted fake sample data, X+T represents the weighted adversarial sample data, and (X+T) represents the weighted adversarial sample data. i Let (X+T) be the i-th data point in the weighted adversarial sample data. i =x i b2 is an r-dimensional vector, z((X+T)) i ) represents the target adversarial sample data after random projection processing.

[0139] In this way, the weighted adversarial sample data (X+T) can be processed. i This is mapped to the low-dimensional space z((X+T)). i ).

[0140] As can be seen from A1-A2 above, the embodiments of this application use penalized weighting of adversarial sample data, making slight perturbations in the adversarial sample data less likely to be detected, thus improving the quality of the adversarial sample data. Simultaneously, a random projection mechanism is used to map high-dimensional data to a low-dimensional space. In this way, after training the intrusion detection model with the obtained high-quality target adversarial sample data, the trained intrusion detection model can achieve higher detection accuracy for complex attack types such as nonlinear and high-dimensional industrial control data, deception attacks, and adversarial attacks.

[0141] See Figure 4 , Figure 4 This is a flowchart illustrating an intrusion detection method provided in an embodiment of this application. Figure 4 As shown, the intrusion detection method may include S401-S404:

[0142] S401: Collects current production process data from the industrial control system.

[0143] S402: Extract features from the current production process data to obtain the current production process feature data.

[0144] S403: Input the current production process feature data into the intrusion detection model and obtain the predicted classification type of the current production process feature data output by the intrusion detection model.

[0145] The intrusion detection model is trained using the training method of the intrusion detection model based on any of the above embodiments.

[0146] S404: Determine whether the industrial control system is under attack based on the predicted classification type of the current production process characteristic data.

[0147] When the predicted classification type is 1, it indicates that the current production process data is attack data, and the industrial control system has suffered an intrusion attack. When the predicted classification type is 0, it indicates that the current production process data is normal data, and the industrial control system has not suffered an intrusion attack.

[0148] It is understandable that the technical details of S401-S404 can be found in the above implementation, and will not be repeated here.

[0149] Based on the training method for an intrusion detection model provided in the above-described embodiments, this application also provides a training device for an intrusion detection model. The training device for the intrusion detection model will be described below with reference to the accompanying drawings.

[0150] See Figure 5 This figure is a schematic diagram of the structure of a training device for an intrusion detection model provided in an embodiment of this application. Figure 5 As shown, the training device for this intrusion detection model includes:

[0151] The data acquisition unit 501 is used to acquire production process data from the industrial control system.

[0152] Feature extraction unit 502 is used to extract features from the production process data to obtain production process feature data;

[0153] The input unit 503 is used to input the production process feature data and random noise into the generative adversarial network and obtain the adversarial sample data output by the generative adversarial network.

[0154] Processing unit 504 is used to perform weighted processing and random projection processing on the adversarial sample data to obtain target adversarial sample data;

[0155] The acquisition unit 505 is used to input the target adversarial sample data into the intrusion detection model and acquire the predicted classification type of the target adversarial sample data output by the intrusion detection model.

[0156] Training unit 506 is used to calculate a loss value based on the predicted classification type and type label of the target adversarial sample data, train the intrusion detection model according to the loss value, and obtain the trained intrusion detection model; the trained intrusion detection model is used to identify whether the current production process data of the industrial control system is abnormal data.

[0157] In one possible implementation, the feature extraction unit 502 is specifically used for:

[0158] Feature extraction is performed on the production process data based on a stacked autoencoder to obtain production process feature data.

[0159] In one possible implementation, the generative adversarial network includes a generator network and a discriminator network, and the input unit 503 includes:

[0160] The first input subunit is used to input the random noise into the generator network and obtain the fake sample data output by the generator network;

[0161] The second input subunit is used to input the forged sample data and the production process feature data into the discriminant network to form adversarial sample data, so that the discriminant network can discriminate the adversarial sample data and obtain the prediction and discrimination result corresponding to the adversarial sample data;

[0162] The first computational subunit is used to calculate the error between the predicted discrimination result corresponding to the adversarial sample data and the actual discrimination result corresponding to the adversarial sample data, and update the network parameters of the generator network and the discriminator network based on the error;

[0163] An execution subunit is used to reduce the random noise, re-execute the steps of inputting the random noise into the generator network, obtaining the fake sample data output by the generator network, and subsequent steps, until the prediction and discrimination results corresponding to the adversarial sample data and the actual discrimination results corresponding to the adversarial sample data meet preset conditions, and then output the adversarial sample data.

[0164] In one possible implementation, the processing unit 504 includes:

[0165] The first processing subunit is used to perform weighted processing on the adversarial sample data to obtain weighted adversarial sample data.

[0166] The second processing subunit is used to perform random projection processing on the weighted adversarial sample data to obtain target adversarial sample data.

[0167] In one possible implementation, the first processing subunit includes:

[0168] The first acquisition subunit is configured to acquire, based on the adversarial sample data, the type label of the adversarial sample data, and a conditional formula, a first parameter and the range of values ​​for the relaxation value corresponding to the adversarial sample data; the conditional formula is:

[0169]

[0170] Where i is a positive integer, n is the amount of data in the adversarial sample data, and x i For the i-th adversarial example data, y i Let Φ(x) be the type label corresponding to the i-th adversarial sample data. i ) is x i The activation function, where b1 is a constant, w is the first parameter, and ξ... i The relaxation value corresponding to the i-th adversarial sample data;

[0171] The second calculation subunit is used to calculate the weights corresponding to the adversarial sample data based on the first parameter, the relaxation value corresponding to the adversarial sample data, and the first formula; the first formula is:

[0172]

[0173] Where C is the regularization constant, β i The weights corresponding to the i-th adversarial sample data;

[0174] The second acquisition subunit is used to perform weighted processing on the adversarial sample data based on the weights corresponding to the adversarial sample data, and to acquire the weighted adversarial sample data.

[0175] In one possible implementation, the second processing subunit includes:

[0176] Construct sub-units to construct random projection matrices;

[0177] The third acquisition subunit is used to acquire projection data that maps to the weighted adversarial sample data based on the random projection matrix, the weighted adversarial sample data, and the first projection mapping formula; the first projection mapping formula is:

[0178]

[0179] Where, x i ' represents the adversarial sample data after the i-th weighted processing, where g... i Let A be the projection data mapped to the i-th weighted adversarial sample data, where A is a d×r dimensional random projection matrix, d is the spatial dimension of the weighted adversarial sample data, and r is the spatial dimension of the projection data mapped to the weighted adversarial sample data.

[0180] The third calculation subunit is used to calculate the second parameter based on the projection data, the weighted adversarial sample data, and the second formula; the second parameter is greater than zero; the second formula is:

[0181]

[0182] Where P is the event probability, γ is the second parameter, x1' is the weighted first adversarial sample data, x'2 is the weighted second adversarial sample data, g1 is the projection data mapped to the weighted first adversarial sample data, and g2 is the projection data mapped to the weighted second adversarial sample data.

[0183] The fourth calculation subunit is used to calculate the target adversarial sample data after random projection processing based on the second parameter, the random projection matrix, the weighted adversarial sample data, and the second projection mapping formula; the second projection mapping formula is:

[0184]

[0185] Where, (X+T) i For the weighted adversarial sample data, (X+T) i =x i b2 is an r-dimensional vector, z((X+T)) i ) represents the target adversarial sample data after random projection processing.

[0186] Based on the intrusion detection method provided in the above-described embodiments, this application also provides an intrusion detection device, which will be described below with reference to the accompanying drawings.

[0187] See Figure 6 , Figure 6 This is a schematic diagram of an intrusion detection device provided in an embodiment of this application. Figure 6 As shown, the intrusion detection device includes:

[0188] The acquisition unit 601 is used to acquire current production process data of the industrial control system;

[0189] Feature extraction unit 602 is used to extract features from the current production process data to obtain current production process feature data;

[0190] The input unit 603 is used to input the current production process feature data into the intrusion detection model and obtain the predicted classification type of the current production process feature data output by the intrusion detection model; the intrusion detection model is trained based on the training method of the intrusion detection model described in any of the above embodiments;

[0191] The judgment unit 604 is used to determine whether the industrial control system has been subjected to an intrusion attack based on the predicted classification type of the current production process feature data.

[0192] In addition, embodiments of this application also provide an electronic device, including:

[0193] One or more processors;

[0194] Storage device, on which one or more programs are stored,

[0195] When the one or more programs are executed by the one or more processors, the one or more processors implement the training method for the intrusion detection model as described in any of the above embodiments, or implement the intrusion detection method as described above.

[0196] In addition, embodiments of this application also provide a computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the training method for the intrusion detection model as described in any of the above embodiments, or implements the intrusion detection method as described above.

[0197] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that all or part of the steps in the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network communication device such as a media gateway, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0198] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. Regarding the methods disclosed in the embodiments, since they correspond to the systems disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the system section description.

[0199] It should also be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0200] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for training an intrusion detection model, characterized in that, The method comprises: Collecting production process data of an industrial control system; Feature extraction is performed on the production process data to obtain production process feature data; The production process feature data and random noise are input into a generative adversarial network to obtain adversarial sample data output by the generative adversarial network; Based on the adversarial sample data, a type label of the adversarial sample data, and a conditional formula, a first parameter and a value range of a relaxation value corresponding to the adversarial sample data are obtained; the conditional formula is: ； in, It is a positive integer. The amount of data in the adversarial sample data. For the first One adversarial example data, For the first Type labels corresponding to each adversarial sample data for activation function, , It is a constant. As the first parameter, For the first The relaxation value corresponding to each adversarial sample data; Based on the first parameter, the relaxation value corresponding to the adversarial sample data, and a first formula, a weight corresponding to the adversarial sample data is calculated; the first formula is: ； in, Here is the regularization constant. For the first The weights corresponding to each adversarial sample data; The adversarial sample data is weighted based on the weight corresponding to the adversarial sample data to obtain adversarial sample data after weighting processing; A random projection matrix is constructed; Based on the random projection matrix, the adversarial sample data after weighting processing, and a first projection mapping formula, projection data mapped with the adversarial sample data after weighting processing is obtained; the first projection mapping formula is: ； wherein, is the adversarial sample data after the first weighting process, is the adversarial sample data after the second weighting process, is the projection data mapped from the adversarial sample data after the second weighting process, is a random projection matrix of dimensionality is the spatial dimensionality of the adversarial sample data after the second weighting process, and Based on the projection data, the adversarial sample data after weighting processing, and a second formula, a second parameter is calculated; the second parameter is greater than zero; the second formula is: ； wherein, is an event probability, is a second parameter, is the first adversarial sample data after the weighting processing, is the second adversarial sample data after the weighting processing, is the projection data mapped by the first adversarial sample data after the weighting processing, is the projection data mapped by the second adversarial sample data after the weighting processing; Based on the second parameter, the random projection matrix, the adversarial sample data after weighting processing, and a second projection mapping formula, target adversarial sample data after random projection processing is calculated; the second projection mapping formula is: ； wherein, is the adversarial sample data after the weighted processing, , is the dimensional vector, is the target adversarial sample data after the random projection processing; The target adversarial sample data is input into an intrusion detection model to obtain a predicted classification type of the target adversarial sample data output by the intrusion detection model; Based on the predicted classification type of the target adversarial sample data and a type label of the target adversarial sample data, a loss value is calculated, the intrusion detection model is trained according to the loss value, and a trained intrusion detection model is obtained; the trained intrusion detection model is used to identify whether current production process data of the industrial control system is abnormal data.

2. The method of claim 1, wherein, The feature extraction is performed on the production process data to obtain production process feature data, comprising: Feature extraction is performed on the production process data based on a stacked autoencoder to obtain production process feature data.

3. The method of claim 1, wherein, The generative adversarial network comprises a generation network and a discrimination network, and the production process feature data and random noise are input into the generative adversarial network to obtain adversarial sample data output by the generative adversarial network, comprising: The random noise is input into the generation network to obtain fake sample data output by the generation network; The fake sample data and the production process feature data are combined to form adversarial sample data which is input into the discrimination network, so that the discrimination network discriminates the adversarial sample data to obtain a predicted discrimination result corresponding to the adversarial sample data; An error between the predicted discrimination result corresponding to the adversarial sample data and an actual discrimination result corresponding to the adversarial sample data is calculated, and network parameters of the generation network and the discrimination network are updated based on the error; The method comprises:

4. An intrusion detection method characterized by, The method comprises: Collecting current production process data of an industrial control system; Performing feature extraction on the current production process data to obtain current production process feature data; Inputting the current production process feature data into an intrusion detection model to obtain a predicted classification type of the current production process feature data output by the intrusion detection model; the intrusion detection model is trained based on the training method of the intrusion detection model in any one of claims 1-3; Determining whether the industrial control system is subjected to an intrusion attack behavior according to the predicted classification type of the current production process feature data.

5. A training device for an intrusion detection model, characterized in that, The device comprises: A collection unit configured to collect production process data of an industrial control system; A feature extraction unit configured to perform feature extraction on the production process data to obtain production process feature data; An input unit configured to input the production process feature data and random noise into a generative adversarial network to obtain adversarial sample data output by the generative adversarial network; A processing unit configured to perform weighted processing and random projection processing on the adversarial sample data to obtain target adversarial sample data; The processing unit comprises: a first obtaining subunit configured to obtain a first parameter and a value range of a relaxation value corresponding to the adversarial sample data based on the adversarial sample data, a type label of the adversarial sample data, and a conditional formula; the conditional formula is: ； in, It is a positive integer. The amount of data in the adversarial sample data. For the first One adversarial example data, For the first Type labels corresponding to each adversarial sample data for activation function, , It is a constant. As the first parameter, For the first The relaxation value corresponding to each adversarial sample data; A second calculation subunit configured to calculate a weight corresponding to the adversarial sample data based on the first parameter, the relaxation value corresponding to the adversarial sample data, and a first formula; the first formula is: ； in, Here is the regularization constant. For the first The weights corresponding to each adversarial sample data; A second obtaining subunit configured to perform weighted processing on the adversarial sample data based on the weight corresponding to the adversarial sample data to obtain adversarial sample data after weighted processing; A construction subunit configured to construct a random projection matrix; A third obtaining subunit configured to obtain projection data mapped from the adversarial sample data after weighted processing based on the random projection matrix, the adversarial sample data after weighted processing, and a first projection mapping formula; the first projection mapping formula is: ； in, For the first The weighted adversarial sample data, the For the first Projected data mapped to the weighted adversarial sample data. for A dimensional random projection matrix, The spatial dimension of the weighted adversarial sample data is... The spatial dimension of the projected data mapped to the weighted adversarial sample data; A third calculation subunit configured to calculate a second parameter based on the projection data, the adversarial sample data after weighted processing, and a second formula; the second parameter is greater than zero; the second formula is: ； wherein, is an event probability, is a second parameter, is the first adversarial sample data after the weighting processing, is the second adversarial sample data after the weighting processing, is the projection data mapped by the first adversarial sample data after the weighting processing, is the projection data mapped by the second adversarial sample data after the weighting processing; A fourth calculation subunit configured to calculate target adversarial sample data after random projection processing based on the second parameter, the random projection matrix, the adversarial sample data after weighted processing, and a second projection mapping formula; the second projection mapping formula is: ； wherein, is the adversarial sample data after the weighted processing, , is the adversarial sample data after the weighted processing, is a vector, is the target adversarial sample data after the random projection processing; An obtaining unit configured to input the target adversarial sample data into an intrusion detection model to obtain a predicted classification type of the target adversarial sample data output by the intrusion detection model. The training unit is configured to calculate a loss value based on a predicted classification type of the target adversarial sample data and a type label of the target adversarial sample data, train the intrusion detection model according to the loss value, and obtain the trained intrusion detection model; and the trained intrusion detection model is configured to identify whether the current production process data of the industrial control system is abnormal data.

6. An intrusion detection apparatus characterized by comprising: The apparatus comprises: The acquisition unit is configured to acquire current production process data of an industrial control system; The feature extraction unit is configured to perform feature extraction on the current production process data to obtain current production process feature data; The input unit is configured to input the current production process feature data into an intrusion detection model to obtain a predicted classification type of the current production process feature data output by the intrusion detection model; the intrusion detection model is trained based on the training method of the intrusion detection model according to any one of claims 1-3; The judgment unit is configured to determine whether the industrial control system is subjected to an intrusion attack behavior according to the predicted classification type of the current production process feature data.

7. An electronic device, comprising: The apparatus comprises: One or more processors; A storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the training method of the intrusion detection model according to any one of claims 1-3, or implement the intrusion detection method according to claim 4.

Images