An industrial control network anomaly detection method based on optimized random forest

Abstract

The application discloses an industrial control network anomaly detection method based on an optimized random forest, and relates to an industrial control network security detection method. The method extracts features from a data set, reduces dimensions by using principal component analysis, divides a training set and a test set, considers the problems of low anomaly detection efficiency and accuracy, and optimizes a random forest model by using an improved whale algorithm. The method combines Cauchy mutation and an adaptive dynamic inertia weight, on the one hand, uses the Cauchy mutation operator to increase population diversity and avoid the algorithm from falling into local optimization, and on the other hand, uses the adaptive dynamic inertia weight factor to improve the global search ability of the population and accelerate the convergence speed of the algorithm. The application has higher accuracy and stronger adaptability, and is more suitable for industrial environments. In addition, verification experiments are carried out on an oil and gas gathering and transportation whole-process industrial scene attack and defense target range of a domestic petrochemical industry information security key laboratory, and it is proved that the application has high detection precision in practical application.

Description

Technical Field

[0001] This invention relates to a method for detecting network security in industrial control systems, and more particularly to a method for detecting anomalies in industrial control systems based on optimized random forests. Background Technology

[0002] Industrial control networks (ICS) are a crucial component of critical national infrastructure such as energy, transportation, and urban utilities. With the integration of industrialization and informatization, while enhancing the applicability of ICS, they also introduce severe cybersecurity threats. As a vital part of ICS, the security of ICS protocols is a major focus of attention. Among them, the Modbus TCP protocol is currently the most widely used, enabling transparent connections between PLCs, I / O modules, and other devices. Like most ICS protocols, Modbus itself has numerous security vulnerabilities. When built on top of TCP / IP, it further exposes the inherent security problems of the TCP / IP protocol to ICS security.

[0003] Many scholars have made progress in Modbus TCP anomaly traffic detection, mainly employing machine learning techniques such as clustering, neural networks, support vector machines, and random forests. Among these, clustering algorithms are significantly affected by parameters, and their detection performance in anomaly detection heavily relies on subjective interpretation. Support vector machines, on the other hand, are difficult to train on large datasets of industrial traffic. Among numerous machine learning methods, random forests are favored due to their high accuracy and strong noise resistance. In anomaly detection, random forests can effectively handle large industrial datasets and, by introducing randomness, are less prone to overfitting, making them one of the most popular machine learning algorithms. However, because the classification accuracy of random forest models is greatly affected by parameters, and traditional parameter optimization methods struggle to avoid subjective factors, some scholars have used swarm intelligence optimization algorithms to improve the efficiency of parameter optimization.

[0004] Currently, research on swarm intelligence optimization algorithms for anomaly detection suffers from two shortcomings: First, the population's search ability is poor, and the convergence speed is slow; the population in swarm optimization algorithms struggles to possess balanced local and global search capabilities. Second, it is highly susceptible to getting trapped in local optima, causing the algorithm to converge prematurely to a local optimum, resulting in poor optimization performance. Summary of the Invention

[0005] The purpose of this invention is to provide an anomaly detection method for industrial control networks based on optimized random forests. This method improves the Optimization Algorithm-RandomForest (WOA) algorithm by combining mutation and adaptive dynamic inertia weights. It introduces the Cauchy mutation operator to increase population diversity and then employs an adaptive dynamic inertia weight factor to improve optimization accuracy. Using the improved system steps and methods, the number of decision trees and the number of features in the attribute feature subsets of the random forest model are optimized, thereby improving the model's classification prediction accuracy and enhancing anomaly detection performance.

[0006] The objective of this invention is achieved through the following technical solution:

[0007] An anomaly detection method for industrial control networks based on optimized random forests, the method comprising the following steps:

[0008] Step 1: Extract features from the raw industrial control data flow to form an original feature set, and perform principal component analysis on the original feature set to generate a new feature set. Then, perform sampling with replacement on the new feature set, and use the sampled samples as the training set and the unsampled samples as the validation set.

[0009] Step 2: Initialize the relevant parameters of the whale algorithm, including population size, maximum number of iterations, probability value, etc., and use the out-of-bag error of the random forest model as the fitness function to calculate the fitness value and mark the best whale individual;

[0010] Step 3: When the probability value p < 0.5 and the absolute value of the coefficient vector A, |A| ≤ 1, update the position of the whale by introducing the adaptive dynamic inertia weight factor ω into the position update formula;

[0011] Step 4: When the probability value p≥0.5, spiral predation is performed by introducing an adaptive dynamic inertia weight factor ω into the position update formula;

[0012] Step 5: When the probability value p < 0.5 and the absolute value of the coefficient vector A, |A| > 1, the position update formula after introducing the adaptive dynamic inertia weight factor ω shrinks the area surrounding the prey;

[0013] Step 6: Calculate the adaptive Cauchy mutation operator, update the position of the individual whale using the improved Cauchy mutation formula, and obtain the desired Cauchy mutant whale individual;

[0014] Step 7: When the number of iterations reaches a fixed value or a satisfactory solution is obtained, the algorithm ends, and the optimal parameters are substituted into the random forest model to output the classification result.

[0015] Furthermore, the raw data in step 1 is a dataset provided by Lemay, which includes attack samples with many different configuration parameters, providing malicious and non-malicious Modbus traffic packets and accompanying CSV tag files, allowing researchers to extract the required traffic features. This dataset is generated in a SCADA sandbox simulating a real network environment, and attacks are customized for the Modbus protocol to generate malicious traffic that conforms to current industrial realities.

[0016] Furthermore, the position update formulas in steps 3, 4, and 5 are set as follows:

[0017] To improve the whale's search capabilities, an adaptive dynamic inertia weighting factor is introduced into the whale position update method. The specific formula is as follows:

[0018]

[0019] The position update formula after introducing ω is as follows:

[0020] X(t+1)=ωX(t)-A·D,p<0.5,|A|≤1

[0021] X(t+1)=ωD·e ωt ·cos(2πl)+X * (t), p≥0.5

[0022] X(t+1)=ωX rand (t)-A·D, p<0.5, |A|>1

[0023] Furthermore, the improved Cauchy mutation formula in step 6 is set as follows:

[0024] The mutation parameter is changed from a fixed value to a dynamic parameter related to position and number of iterations. The improved Cauchy mutation formula is as follows. The desired Cauchy mutant whale individual can be obtained through the improved mutation formula.

[0025] X(t+1)=X(t)+X(t)·η·C(0,1)

[0026] in:

[0027] η = 1 - t / T max

[0028] The advantages and effects of this invention are:

[0029] Compared to other industrial anomaly detection methods, the innovation of this invention lies in its use of a swarm intelligence optimization algorithm to optimize the random forest model. It proposes a Cauchy mutation and Adaptive weighting factor Whale Optimization Algorithm-Random Forest (CAWOA-RF) model, addressing the problem of low classification accuracy caused by subjective factors in traditional parameter optimization methods. To address the poor search capability and susceptibility to local optima in the whale algorithm, Cauchy mutation and adaptive dynamic inertia weighting are combined. On the one hand, the Cauchy mutation operator increases population diversity, preventing the algorithm from getting trapped in local optima; on the other hand, the adaptive dynamic inertia weighting factor improves the global search capability of the population, accelerating the algorithm's convergence speed. Simulation results show that this invention has higher accuracy and stronger adaptability compared to other classification algorithms. Verification experiments were conducted on the oil and gas gathering and transportation industrial scenario attack and defense range of the Liaoning Provincial Key Laboratory of Information Security in the Petrochemical Industry, demonstrating that the model also has high detection accuracy in practical applications. Attached Figure Description

[0030] Figure 1 This is a diagram of the Modbus TCP packet structure.

[0031] Figure 2 The iterative curve for the adaptive dynamic inertia weight factor;

[0032] Figure 3 PCA dimensionality reduction curve;

[0033] Figure 4 The model convergence curve;

[0034] Figure 5 The accuracy of the algorithm based on different datasets;

[0035] Figure 6 Recall rates for algorithms based on different datasets;

[0036] Figure 7 The F1 scores of the algorithms are based on different datasets;

[0037] Figure 8 A physical image of an attack and defense test range for the entire industrial scenario of oil and gas gathering and transportation;

[0038] Figure 9 This is a diagram of the overall engine architecture;

[0039] Figure 10 This is a chart showing the results of abnormal data. Detailed Implementation

[0040] The present invention will now be described in detail with reference to the embodiments shown in the accompanying drawings.

[0041] Using the Modbus TCP protocol, controllers can communicate with each other or with devices via Ethernet as the data transmission medium, enabling basic equipment in industrial production sites to perform corresponding operations. The Modbus TCP data frame structure is as follows: Figure 1 As shown, the protocol defines simple protocol data units and a dedicated header for identifying Modbus application data units, which is called the Modbus application protocol header.

[0042] Feature extraction

[0043] Before performing anomaly detection, it is necessary to extract relevant data feature fields to form a feature set. Similar to protocols in the traditional Internet, industrial control protocols also have their own proprietary fields. By parsing the fields of Modbus TCP packets, network attribute and communication attribute fields in the protocol are extracted. In addition to common fields such as destination IP, source IP, and data length, there are also some unique fields such as unit identifiers, function codes, and byte counts. A total of 13 features were extracted from the packet attributes, as detailed in Table 1.

[0044] Table 1 Data Packet Attribute Characteristics Table

[0045]

[0046] If relying solely on packet attribute characteristics is insufficient to identify anomalies caused by changes in packet frequency and packet intervals, for example, if the rate at which packet transmission commands doubles over a certain period, resulting in a halving of the entire production process and a significant periodic anomaly, or if the number of packets remains normal for a certain time but the intervals between packets change, resulting in an interval anomaly, then these issues can be addressed by introducing calculation features such as average time interval, average time interval variance, packets per second, and average number of packets. See Table 2 for details.

[0047] Table 2 Calculation Feature Table

[0048]

[0049]

[0050] Standard Whale Algorithm

[0051] The Whale Algorithm is a novel heuristic optimization algorithm that mimics the hunting behavior of humpback whales.

[0052] In the whale algorithm, each whale's position represents a feasible solution. During the whale hunting process, each whale exhibits two behaviors: one is to surround the prey, where all whales move towards each other; the other is to create a bubble web, where whales swim in a circle and expel bubbles to drive away the prey. The algorithm mainly consists of three stages: surrounding the prey, bubble web attack, and search and prey hunting.

[0053] (1) Encirclement and predation:

[0054] If the current optimal solution in n-dimensional space is the best individual whale in the population, then the whale population will move toward the best individual according to the following formula.

[0055] X(t+1)=X * (t)-A·D

[0056] D = |C·X * (t)-X(t)|

[0057] A = 2ar1-a

[0058] C = 2r²

[0059] a = 2 - 2t / T max

[0060] Among them, X * (t+1) =(X * 1,X * 2,…,X * n Let t be the position vector of the prey, t be the current iteration number, A and C be the coefficient vectors, r1 and r2 be random numbers distributed in the range (0,1), and a be the convergence factor, which decreases linearly from 2 to 0 as the iteration number increases. max This represents the maximum number of iterations.

[0061] (2) Bubble attack:

[0062] Bubble web attack is a unique predatory behavior of humpback whales, and two models are used to describe this behavior in order to simulate it.

[0063] a) Shrink the enclosure: Decrease the convergence factor a, causing the whale at the current position to move closer to the whale at the current optimal position.

[0064] b) Spiral Update: The current whale individual moves closer to the best whale individual in a spiral manner, as shown in the following formula.

[0065] X(t+1)=D′·e bt ·cos(2πl)+X * (t)

[0066] D′=|X*(t)-X(t)|

[0067] Where D' represents the distance between the prey and the individual whale, b is the logarithmic spiral shape constant, and l is a random number between -1 and 1.

[0068] When |A|≤1, a bubble net attack is used. In this case, not only does the encirclement shrink, but the prey also moves in a spiral shape. Therefore, each has a 50% probability, as shown in the following formula.

[0069]

[0070] (3) Searching for prey:

[0071] When |A|>1, the current whale individual will not move closer to the best whale individual, but will randomly select a whale individual to move closer to. Although this will cause the current whale individual to deviate from the target prey, it will enhance the global search capability of the whale group, as shown in the following formula.

[0072] X(t+1)=X rand (t)-A·D

[0073] D = |C·X rand (t)-X(t)|

[0074] Among them, X rand The position vector of a randomly selected individual.

[0075] For swarm intelligence optimization algorithms, the quality of the initial population has a significant impact on the global convergence speed and the quality of the optimal solution.

[0076] The whale population is initialized using Tent chaotic mapping to compensate for the shortcomings of the basic whale algorithm, as shown in the following equation.

[0077]

[0078] z i =(x0-l b ) / (u b -l b )

[0079] x i =l b +(u b -l b )z i

[0080] Among them, l b and u b To optimize the maximum and minimum values ​​of the interval, x i For the location of an individual whale, z i It is a chaotic variable.

[0081] Adaptive dynamic inertia weight

[0082] In the standard WOA global search, the iterative process does not consider the difference in guiding force that causes the prey to guide the whale to update its position. To prevent the algorithm from maturing prematurely, an adaptive inertial dynamic weight factor ω is introduced into the position update formula and incorporated into the whale position update method. The specific formula is as follows:

[0083]

[0084] The position update formula after introducing ω is as follows:

[0085] X(t+1)=ωX(t)-A·D,p<0.5,|A|≤1

[0086] X(t+1)=ωD·e ωt ·cos(2πl)+X * (t), p≥0.5

[0087] X(t+1)=ωX rand (t)-A·D, p<0.5, |A|>1

[0088] Depend on Figure 2 The iterative curve of the adaptive inertial dynamic weight factor shows that the adaptive inertial dynamic weight factor has a large value in the early stage of iteration, which is beneficial to global search. After the iteration ends, the curve descent rate slows down, the weight value decreases, the local search capability is enhanced, and the search accuracy is improved.

[0089] Cauchy mutation

[0090] Cauchy mutation is a mutation operator with stronger mutation capabilities than Gaussian mutation because the Cauchy density function has elongated ends, making it more likely for the population to escape local optima. The stronger mutation capability in the later stages can partially compensate for previously lost population diversity, and the significant difference before and after mutation can enhance the population's search capabilities.

[0091] The probability density function of the Cauchy distribution:

[0092] f t (x)=(1 / π)·t / t 2 +x 2 -∞ < x < +∞

[0093] Cauchy's variation formula:

[0094] X(t+1)=X(t)+η·C(0,1)

[0095] In the formula: x is the position parameter, η is the parameter that controls the variable asynchronous length, and C(0,1) is a random number that follows a Cauchy distribution with t=1.

[0096] To avoid the algorithm getting trapped in local optima during the iteration process, a Cauchy mutation operator was introduced to improve population diversity. The mutation parameter was changed to be related to position and iteration number. The improved Cauchy mutation formula is shown below. The desired Cauchy mutant whale individuals were obtained using this improved mutation formula.

[0097] X(t+1)=X(t)+X(t)·η·C(0,1)

[0098] η = 1 - t / T max

[0099] In the formula: when η is 1, the mutation effect is most significant, while when η is 0, there is almost no mutation.

[0100] The following is the experimental section:

[0101] Dataset Description

[0102] The experiment used the dataset provided by Lemay. In the attack experiment, the actual attack was carried out through the SCADA network. The timing between data packets was very strict, which increased the fidelity of the experiment.

[0103] After analyzing the complete data, the following dataset was selected for the experiment.

[0104] (1)Modbus-data1: "Exploit_ms08_netapi_Modbus_6RTU_with_operate", "Run1_6RTU";

[0105] (2)Modbus-data2: "Moving_two_files_Modbus_6RTU", "Run11";

[0106] (3)Modbus-data3: "CnC_uploading_exe_Modbus_6RTU_with_operate", "Run8".

[0107] The subsets selected in the above mixed datasets all have a polling period of 10 seconds. See Table 3 for a detailed description of the datasets.

[0108] Table 3. Description of the Lemay dataset

[0109]

[0110]

[0111] Data preprocessing

[0112] Industrial control data is characterized by large volume, high collection frequency, and complex structure, which significantly increases model training time during anomaly detection. Therefore, Principal Components Analysis (PCA) is used to preprocess the extracted mixed feature set, reducing its complexity and shortening model training time.

[0113] The final dimensionality reduction result is as follows Figure 3 As shown, when the number of principal components selected is 12, the cumulative contribution rate reaches 92.9482%, which means that using the first 12 dimensions of data features can reduce the dimensionality with a small loss of the original 17 dimensions of data features. Subsequent experimental data all use the feature set after dimensionality reduction.

[0114] To verify the training speed and detection accuracy of the algorithm before and after dimensionality reduction, a comparative experiment was designed using the feature sets before and after dimensionality reduction to compare the training time and accuracy. The comparison results are shown in Tables 4 and 5.

[0115] Table 4 Accuracy

[0116]

[0117] Table 5 Training Time

[0118]

[0119] As can be seen from Table 4 (accuracy) and Table 5 (training time), although the detection accuracy slightly decreased after training the model on the feature set after PCA dimensionality reduction, the training time was significantly shortened. This fully demonstrates that the training speed of the model is greatly improved while meeting the detection accuracy requirements.

[0120] Evaluation indicators

[0121] To objectively evaluate the performance of the D-IDS model, we use the accuracy (ACC), precision (P), recall (R), and F1-Measure (F1), which are commonly used in the field of intrusion detection, to evaluate the classification results.

[0122]

[0123]

[0124]

[0125]

[0126] In the formula: TP indicates that the prediction is an attack category and the prediction is correct; FP indicates that the normal category is predicted as an attack category; FN indicates that the attack category is predicted as a normal category; and TN indicates that the prediction is a normal category and the prediction is correct.

[0127] Parameter settings

[0128] The specific parameters for the experiment were set as follows: the maximum number of iterations was 500; the population size was 30; and the probability p was 0.5.

[0129] Figure 4 The graph shows the convergence curves of the CAWOA-RF and WOA-RF models. It's clear that the WOA-RF algorithm gets completely stuck in a fixed value after 246 iterations, unable to escape local optima. In contrast, the optimized CAWOA-RF model escapes local optima multiple times throughout the iteration process, eventually reaching a stable value after 177 iterations. The time difference demonstrates that the CAWOA-RF model finds the optimal solution much faster. This verifies that the optimized whale algorithm has the ability to escape local optima and converges faster.

[0130] CAWOA-RF model experiment

[0131] The final output results are the average of 30 independent and repeated experiments. Support Vector Machine (SVM), C4.5, and Random Forest (RF) algorithms were selected and tested with the CAWOA-RF model on three different datasets for anomaly detection. The performance was analyzed from the perspectives of precision, recall, and F1 score. Experimental results are shown in the figure below. Figure 5 , Figure 6 and Figure 7 As shown.

[0132] As can be seen, all algorithms exhibit high detection accuracy on the Modbus-data1 and Modbus-data3 datasets. Among them, the CAWOA-RF model significantly outperforms other classification algorithms in terms of detection precision, recall, and F1 score. Even on Modbus-data2, which has the worst overall detection performance, it still achieves the highest precision (98.01%), recall (97.97%), and F1 score (98.12%).

[0133] The Modbus-data2 dataset, which exhibits the worst overall detection performance, is analyzed in detail. Specifically, the RF algorithm has 1.3% lower precision, 1.24% lower recall, and 1.11% lower F1 score than the CAWOA-RF model. This is because the parameter selection in the RF algorithm is highly subjective, leading to poor detection performance and decreased accuracy. The SVM algorithm has 0.89% lower precision, 0.65% lower recall, and 1.15% lower F1 score than the CAWOA-RF model. This is because the SVM algorithm performs poorly in classifying large datasets and its parameter selection is difficult, resulting in suboptimal classification performance. The C4.5 algorithm has 1.53% lower precision, 1.14% lower recall, and 1.52% lower F1 score than the CAWOA-RF model. This is because the C4.5 algorithm requires multiple sequential scans and sorting of the dataset, leading to low efficiency and a high susceptibility to overfitting, making it the worst performing algorithm among the three. The above analysis shows that the CAWOA-RF model outperforms other traditional classification algorithms on various datasets, demonstrating that the present invention can significantly improve anomaly detection performance and has strong applicability.

[0134] To further verify the effectiveness of the CAWOA-RF model, experiments were conducted to compare WOA-RF algorithms with different improvement methods.

[0135] Depend on Figure 5 , Figure 6 , Figure 7The experimental results show that, compared with the WOA-RF and AWOA-RF algorithms, after introducing an adaptive inertial dynamic weight factor, the detection precision on the three datasets improved by 0.97%, 0.64%, and 0.84%, respectively; the recall improved by 0.36%, 0.32%, and 0.21%, respectively; and the F1 score improved by 0.61%, 0.57%, and 0.53%, respectively. The improved WOA algorithm effectively enhances the search ability of the population, accelerating algorithm convergence while also improving search accuracy. Optimizing the parameters of the random forest model further improved the algorithm's detection accuracy. Compared with the WOA-RF and CWOA-RF algorithms, the detection precision improved significantly after only introducing the Cauchy mutation operator. The accuracy improved by 0.33%, 0.51%, and 0.69%, respectively; the recall improved by 0.08%, 0.17%, and 0.09%, respectively; and the F1 score improved by 0.23%, 0.34%, and 0.33%, respectively. The algorithm is more likely to escape local optima and finds the optimal solution better during iteration compared to the standard WOA algorithm, resulting in higher classification accuracy for the Random Forest classification algorithm. Compared to the other three algorithms, CAWOA-RF, by combining the advantages of Cauchy mutation and adaptive inertial dynamic weighting factors, improved detection precision by 1.91% compared to WOA-RF, 0.66% compared to AWOA-RF, and 0.87% compared to CWOA-RF, while recall and F1 score also showed varying degrees of improvement. It can be seen that compared to using a single improvement, the CAWOA-RF model not only solves the problem of local optima in the algorithm but also improves the convergence speed, verifying the effectiveness of the improved model in anomaly detection.

[0136] CAWOA-RF model validation experiment

[0137] Verification experiments were conducted at the attack and defense range of the entire oil and gas gathering and transportation industrial scenario in the key laboratory of information security in China's petrochemical industry. The entire range consists of an operator station, a control station, a communication network, and a sand table model. A physical image of the range is shown below. Figure 8 As shown.

[0138] The test range operator station, running on a virtual machine, implements functions such as a human-machine interface, alarm logging, and historical data recording. It is also compatible with relevant configuration software for the development and debugging of the control system. The sand table model simulates the process environment of a natural gas transmission terminal in winter. The test range incorporates an open-source industrial protocol parsing engine, utilizing a switch mirror port to connect to a Suricata-based intrusion detection system. It collects and analyzes bypass traffic, and currently supports deep parsing of multiple protocols including ENIP, MODBUS_TCP, S7, CIP, and UMAS. Detailed descriptions of each module are shown in Table 6, and the overall engine architecture is as follows: Figure 9 As shown.

[0139] Table 6 Module Description

[0140]

[0141]

[0142] This verification involves sending 1000 data packets, including 10 Modbus_TCP attack packets for anomaly detection. The attack method involves writing data packets via Metasploit. After detection, the results are displayed on the front-end browser page. The results are as follows: Figure 10 As shown.

[0143] The abnormal data display shows that 10 data entries were detected. The first three entries represent the TCP connection establishment process before the attack, the fourth and fifth entries are Modbus TCP messages, and the subsequent entries represent the TCP connection termination process. The Modbus TCP message function code 5 indicates writing to a single coil, representing both a write request message and a response request message. This demonstrates that the system has effectively detected and displayed all abnormal data. By constructing a controllable and realistic simulation environment for attack and defense exercises, and mapping attack tests to real industrial scenarios, the feasibility of this invention for abnormal traffic detection has been proven.

[0144] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. An industrial control network anomaly detection method based on an optimized random forest, characterized in that, The method comprises the following steps: Step 1: feature extraction is performed on original industrial control data traffic to form an original feature set, and principal component analysis is performed on the original feature set to generate a new feature set, the original feature set is obtained by analyzing the fields of the extracted Moudbus TCP data packet, extracting the network attribute and communication attribute fields in the protocol, the features include source IP, destination IP, source port, destination port, IP packet length, transmission layer protocol name, transaction identifier, protocol identifier, length, unit identifier, function code, starting address of coil or register, byte number; the extracted samples are taken as a training set, and the unextracted samples are taken as a verification set; Step 2: the related parameters of the whale algorithm are initialized, including the population size, the maximum number of iterations, the probability value and the like, the out-of-bag error of the random forest model is taken as the fitness function to calculate the fitness value, and the optimal whale individual is marked; Step 3: when the probability value p<0.5 and the absolute value |A| of the coefficient vector A is less than or equal to 1, the position of the whale is updated through a position update formula after introducing an adaptive dynamic inertia weight factor ω; Step 4: when the probability value p is greater than or equal to 0.5, spiral predation is performed through a position update formula after introducing the adaptive dynamic inertia weight factor ω; Step 5: when the probability value p<0.5 and the absolute value |A| of the coefficient vector A is greater than 1, the prey is contracted and surrounded through a position update formula after introducing the adaptive dynamic inertia weight factor ω; Step 6: an adaptive Cauchy mutation operator is calculated, the position of the whale individual is updated through an improved Cauchy mutation formula, and a required Cauchy mutant whale individual is obtained; Step 7: when the number of iterations reaches a fixed value or a satisfactory solution is obtained, the algorithm is ended, and the optimal parameters are substituted into the random forest model to output a classification result.

2. The industrial control network anomaly detection method based on an optimized random forest according to claim 1, characterized in that, The surrounding predation position update in step 3: In an n-dimensional space, when the optimal solution is the best whale individual in the population, the whale population will approach the optimal individual according to the following formula: X(t+1) = X * (t) - A - D D = |C - X * (t) - X(t) | A = 2ar1-a C＝2r2 a = 2 - 2t / T max wherein X * (t+1) = (X * 1, X * 2,..., X * n ) is the position vector of the prey, t is the current iteration number, A, C are coefficient vectors, r1, r2 are random numbers distributed in the range (0, 1), a is a convergence factor, which linearly decreases from 2 to 0 with the increase of the iteration number, T max is the maximum iteration number; An adaptive inertia dynamic weight factor ω is introduced in the position update formula: The position update formula after introducing ω is as follows: X(t+1) = ωX(t)-A·D, p<0.5, |A|≤1 3.The industrial control network anomaly detection method based on optimized random forest of claim 1, wherein, The spiral predation position update in step 4: The whale individual approaches the best whale individual in a spiral manner, as shown in the following formula: X(t + 1) = D' - e bt cos(2πl) + X * (t) D' = |X*(t)-X(t)| Wherein D' represents the distance between the prey and the whale individual, b is a logarithmic spiral shape constant, and l is a random number between-1 and 1; An adaptive inertia dynamic weight factor ω is introduced in the position update formula: The position update formula after introducing ω is as follows: X(t + 1) = ωD e ωt cos(2πl) + X * (t), p > 0.

5.

4. The industrial control network anomaly detection method based on an optimized random forest of claim 1, wherein, The contraction and surrounding position update in step 5: The whale individual will not approach the best whale individual, but will randomly select a whale individual to approach, although it will deviate from the target prey, but it will enhance the global search ability of the whale population, as shown below: X(t+1) = X rand (t) - A - D D = |C - X rand (t) - X(t) | where X rand is a randomly chosen position vector for the individual; An adaptive inertia dynamic weight factor ω is introduced in the position update formula: The position update formula after introducing ω is as follows: X(t + 1) = ωX rand (t) - A - D, p < 0.5, |A| > 1.

5. The industrial control network anomaly detection method based on an optimized random forest according to claim 1, characterized in that, The Cauchy mutation formula in step 6: The probability density function of the Cauchy distribution: f t (x) = (1 / π) · t / t 2 +x 2 ,-∞<x<+∞ Cauchy mutation formula: X(t+1) = X(t) + η·C(0,1) Where x is the position parameter, η is the parameter that controls the step size of mutation, C(0,1) is the random number that obeys Cauchy distribution t = 1; In the iteration process, in order to avoid the algorithm may appear in the optimization process of local optimal solution, the introduction of Cauchy mutation operator to improve the population diversity; The mutation parameter is changed to the parameter related to the position and the number of iterations, and the improved Cauchy mutation formula is as follows, and the required Cauchy mutation whale individual is obtained through the improved mutation formula; X(t+1) = X(t) + X(t)·η·C(0,1) η = 1 - t / T max When η value is 1, the mutation effect is most obvious, and when η value is 0, there is almost no mutation phenomenon.

Images