Abnormal traffic detection method based on spectrum graph feature optimization for industrial control networks

Abstract

The present invention relates to the field of industrial control technology, specifically a method for detecting abnormal traffic in industrial control networks based on spectrum graph feature optimization. The method comprises the following steps: collecting an abnormal traffic data set from the industrial control network, converting the data set into a feature data set through encoding and normalization; performing sample amplification using an adaptive oversampling method; extracting features from the feature data set using an optimized pruning search method; converting traffic features into a spectrum image to form a spectrum graph feature data set; dividing the data set into a training set and a test set, and applying the data set to a convolutional neural network model to train a detection model. This method effectively reduces the number of searches and improves search efficiency. Furthermore, during the search process, the method optimizes features through the spectrum graph, increases feature weights, further improving anomaly detection accuracy and reducing false alarm rates.

Description

Technical Field

[0001] The present invention relates to the field of industrial control technology, and in particular to an abnormal traffic detection method applicable to an industrial control network based on spectrum graph feature optimization. Background Art

[0002] Industrial control systems (ICS) are control systems used in industrial manufacturing processes and are widely used in critical industrial infrastructure, such as nuclear power plants, thermal power plants, and hydropower plants. They have made significant contributions to the development of national critical infrastructure and have a profound impact on the national economy and people's livelihood. With the advancement of intelligent manufacturing, ICS are becoming increasingly information-based and complex, and the attack methods targeting ICS are also becoming more diverse. Although existing ICS are equipped with protection measures such as intrusion detection and security gateways, the current security service chain of ICS is relatively fragile, resulting in high false positive and false negative rates. Each false positive consumes a large amount of resources for meaningless security checks.

[0003] Existing relevant patents include patent number CN201910954339.8, publication date 2020-02-21, and a Chinese invention patent named "Distributed fiber optic intrusion detection method based on Mel spectrum". Its technical solution is: The present invention relates to the field of distributed fiber optic vibration monitoring and security technology in oil and gas pipelines. Specifically, it is a distributed fiber optic intrusion detection method based on Mel spectrum, which is characterized in that it includes the following steps: reading the original signal collected by the fiber optic vibration sensor to locate the location point where the suspected intrusion event occurred; extracting the signal at the location point where the suspected intrusion event occurred to generate multiple Mel spectrum graphs; multiple Mel spectrum graphs are formed into a one-dimensional feature vector through frequency mapping; the one-dimensional feature vector is input into a deep learning network to construct a training model, and the model is used for real-time detection of fiber optic intrusion events.

[0004] Reflecting data features through spectrum images is a commonly used method currently used in many fields, such as image recognition and sound recognition. A spectrum image is a visual representation of a signal, reflecting the characteristic details of frequency and energy hidden in the original data in the form of a color image. Because industrial control networks are gradually converging with the internet, there is a shortage of malicious traffic samples. This small sample size results in current abnormal traffic identification and intrusion detection methods still having a high false alarm rate when detecting new attacks. Furthermore, commonly used anomaly detection methods applicable to industrial control networks, such as the aforementioned comparative patents, have numerous performance deficiencies. Therefore, by improving feature optimization methods and converting spectrum images for convolutional neural network training, a method that can improve anomaly detection efficiency and reduce false alarm rates can be developed, which can greatly enhance the security effectiveness of industrial control systems. Summary of the Invention

[0005] In order to improve the defects of abnormal traffic detection in industrial control networks, the present invention proposes an abnormal traffic detection method suitable for industrial control networks based on spectrum graph feature optimization. This method can improve the accuracy of abnormal traffic detection in industrial control networks and reduce the false alarm rate to a certain extent.

[0006] To achieve the above technical effects, the technical solutions of this application are as follows:

[0007] A method for detecting abnormal traffic in industrial control networks based on spectrum graph feature optimization includes the following steps:

[0008] S1. Collect an abnormal traffic data set of the industrial control network and convert it into a feature data set through encoding and normalization.

[0009] S2, performing sample amplification on the processed feature dataset using an adaptive oversampling method;

[0010] S3, extracting features from the balanced feature dataset using an optimized pruning search method;

[0011] S4. For the extracted feature data set, the traffic features are converted into a spectrum image by using a multi-resolution analysis discrete wavelet transform method to form a spectrum feature data set;

[0012] S5. Divide the spectrum graph dataset into a training set and a test set in a ratio of 4:1, apply it to the training of the convolutional neural network model to obtain a detection model, and apply it to the verification iteration in step S3. The model that meets the termination condition is taken as the optimal detection model.

[0013] Furthermore, in step S1, one-hot encoding is used to convert the data into a feature dataset and normalize it.

[0014] Furthermore, the specific method of step S2 is:

[0015] (1) Assume that the number of small samples in the original data set is N minor , the number of multiple samples is N major , the number of sample features is m, then the sample imbalance can be calculated as If the imbalance is lower than the expected balance, the feature dataset is judged to be unbalanced, and sample augmentation is performed;

[0016] (2) According to formula G aug =(N major -N minor ) Calculate the number of overall samples that need to be increased;

[0017] (3) Finally, for each small sample x i , i∈(0, Nminor ], randomly select a small neighboring sample x from its K nearest neighboring samples ij j∈(0,K], according to the formula s i =x i +θ*(x ij -x i ) generates synthetic samples s i , where θ represents a random number in [0,1], (x ij -x i ) represents the difference vector between the neighboring small sample and the current small sample. According to the above method, the neighboring small samples in the K nearest neighbor samples are continuously selected and synthesized with the random number θ until g is generated. i The synthetic samples are merged into the original dataset to form a sample-balanced dataset.

[0018] Furthermore, the imbalance in step (1) is lower than the desired balance by 0.8, 0.9 or 0.95,

[0019] Furthermore, in step (2), for each small sample, its K nearest neighboring samples are calculated by Euclidean distance, and the proportion of multiple samples in its K nearest neighboring samples is calculated. According to the formula Regularize the proportion and obtain the density distribution of multiple samples in the K neighboring samples of the small sample. Finally, the number of samples that need to be increased for each small sample is calculated as

[0020] Furthermore, in step S3, the extracted features are converted into a spectrum graph dataset and applied to a convolutional neural network for training to obtain a detection model. The quality of the current detection model is then evaluated by the evaluation function of the optimized pruning search method until the termination condition of the optimized pruning search method is met, and finally a better detection model is obtained.

[0021] Furthermore, the optimized pruning search method in step S3 is specifically as follows:

[0022] S31. First, all features are selected as the initial solution. A round of iteration is performed through steps S4 and S5 to form a convolutional neural network model of the initial solution. The cost of the initial solution is calculated through the evaluation function f. The current solution is set as the global optimal solution, the expected index μ is initialized, and the pruning table is set to empty. The evaluation function is as follows:

[0023]

[0024] Assuming that the positive samples in the data set are P and the negative samples are N, FP is the ratio of negative samples predicted by the convolutional neural network model to positive samples, and FN is the ratio of positive samples predicted to negative samples. Assuming M fis the number of features after extraction, and m is the number of original features. is the ratio of the number of extracted features to the number of original features;

[0025] S32. Based on the current solution, according to the 0 / 1 situation of the binary bit of the random number, 1 is retained and 0 is deleted, forming t similar solutions to form a candidate set; where t is related to the number of features p of the current solution. To reduce the iteration time, t = log2 p is adopted in the present invention;

[0026] S33, based on the candidate set generated in the above steps, construct and maintain the latest r feature changes in the case of pruning set, used to avoid repeated feature changes; wherein r is related to the total number of features m, in order to ensure the efficiency of feature extraction, the present invention adopts For the similar solutions generated in the above steps, a corresponding feature dataset is formed, which is converted into a spectrum graph feature and trained in a convolutional neural network. The resulting detection model uses an evaluation function to calculate the cost of each similar solution, and each similar solution is traversed and processed according to the three pruning strategies.

[0027] S34, if the difference in the evaluation cost of the local optimal solution generated in the two search iterations is lower than the termination threshold, or after u rounds of iteration, the search is stopped; where u is related to the total number of features m. In order to reduce the iteration time, the present invention adopts

[0028] Furthermore, the three pruning strategies are as follows: first, if the change of the similar solution exists in the pruning set, it will be discarded; second, if the change of the similar solution is not in the pruning set and the cost is lower than the global optimal solution, the similar solution will be set as the global optimal solution; third, if the change of the similar solution exists in the pruning set but its cost is lower than the expected index u, the similar solution will still be set as the global optimal solution.

[0029] Furthermore, the specific method of wavelet transformation in step S4 is as follows:

[0030] (1) If the processed data set W contains n samples, each sample covers m features, that is, W = {W1, W2, ..., W i ,…,W n}, W i ={w i1 ,w i2 ,…,w ij ,…w im}, i = 1, 2, ..., n, j = 1, 2, ..., m; for each sample W k , perform wavelet transform on them respectively to generate time-frequency data sets. The wavelet transform formula is as follows:

[0031]

[0032] Where N represents the number of samples in the dataset W, and W k is the feature vector set of the kth data sample {w k1 ,w k2 ,…w im}, represents the characteristics of the original data set to be converted; ψ m,n Represents the wavelet function used in wavelet transform, which is used to convert the original data set into spectral information through wavelet analysis; Z represents a set of integers, and m and n represent integers specified in different wavelet functions, which are used to control the translation and scale of the changes;

[0033] (2) For each sample of time-frequency data generated in (1), convert it into a spectrum image by taking the square of the absolute value to form the final spectrum graph dataset. The spectrum graph conversion formula is as follows:

[0034]

[0035] The advantages of this application are:

[0036] This method addresses security issues such as low efficiency in detecting abnormal traffic in industrial control systems by proposing an abnormal traffic detection method based on spectral graph feature optimization. This method first uses adaptive oversampling to amplify the original dataset, addressing the imbalance of abnormal samples in industrial control networks that leads to low detection accuracy. It then optimizes the pruning search method to effectively reduce the number of searches and improve search efficiency. During the search process, spectral graphs are used to optimize features and increase feature weights, further improving anomaly detection accuracy and reducing false positive rates. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 Flow chart of the method of the present invention.

[0038] Figure 2 Flowchart of the optimized pruning search algorithm. DETAILED DESCRIPTION

[0039] The following is a detailed description of an embodiment of the present invention. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process. However, the protection scope of the present invention is not limited to the following embodiment.

[0040] It should be pointed out that all directional indications in the embodiments of the present invention (such as both sides, edges, up, down, left, right, front, back, middle, top, bottom, tail, axial, radial...) are only used to explain the relative position relationship, movement state, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0041] Example 1

[0042] like Figure 1 As shown, a method for detecting abnormal traffic based on spectrum graph feature optimization applicable to industrial control networks includes the following steps:

[0043] S1. Collect an abnormal traffic data set of the industrial control network and convert it into a feature data set through encoding and normalization.

[0044] S2. For the processed feature data set, the sample is amplified by the adaptive oversampling method, thereby optimizing the problem of data imbalance in the industrial control network caused by the small number of abnormal samples and the large number of normal samples, which affects the performance degradation of abnormal traffic detection;

[0045] S3, extracting features from the balanced feature dataset using an optimized pruning search method;

[0046] S4. For the extracted feature data set, the traffic features are converted into a spectrum image by using a multi-resolution analysis discrete wavelet transform method to form a spectrum feature data set;

[0047] S5. Divide the spectrum graph dataset into a training set and a test set in a ratio of 4:1, apply it to the training of the convolutional neural network model to obtain a detection model, and apply it to the verification iteration in step S3. The model that meets the termination condition is taken as the optimal detection model.

[0048] This method addresses security issues such as low efficiency in detecting abnormal traffic in industrial control systems by proposing an abnormal traffic detection method based on spectral graph feature optimization. This method first uses adaptive oversampling to amplify the original dataset, addressing the imbalance of abnormal samples in industrial control networks that leads to low detection accuracy. It then optimizes the pruning search method to effectively reduce the number of searches and improve search efficiency. During the search process, spectral graphs are used to optimize features and increase feature weights, further improving anomaly detection accuracy and reducing false positive rates.

[0049] Example 2

[0050] The present invention specifically comprises the following steps:

[0051] S1. Data Processing. The traffic dataset is converted into a feature dataset using one-hot encoding and normalized. Adaptive oversampling is also used to address the data imbalance in the industrial control network, which results in a large number of normal samples and a small number of abnormal samples, thus reducing anomaly detection performance. This results in a balanced dataset.

[0052] S2. Feature selection and model optimization. For the dataset processed in the above steps, we use optimized pruning search to extract weighted abnormal industrial control traffic features, reduce interference and redundant information, convert them into spectrum graph features, and apply them to convolutional neural network training. The results are verified by the evaluation function of the optimized pruning algorithm until the termination conditions of the optimized pruning search method are met, ultimately obtaining the optimal model. The specific steps are as follows:

[0053] S21. First, all features are selected as the initial solution. Steps S4 and S5 are iterated for one round to form a convolutional neural network model of the initial solution. The cost of the initial solution is calculated using the evaluation function f. The current solution is set as the global optimal solution, the expected index μ is initialized, and the pruning table is set to empty. The evaluation function is as follows:

[0054]

[0055] Assuming that the positive samples in the data set are P and the negative samples are N, FP is the ratio of negative samples predicted as positive samples by the convolutional neural network model, and FN is the ratio of positive samples predicted as negative samples. Assuming M f is the number of features after extraction, and m is the number of original features. is the ratio of the number of extracted features to the number of original features.

[0056] S22. Based on the current solution, according to the 0 / 1 status of the binary bit of the random number, retain the corresponding bit of the current solution if 1 and delete the corresponding bit of 0, to form t similar solutions, which constitute the candidate set. Where t is related to the number of features p of the current solution. To reduce the iteration time, the present invention adopts t = log2p;

[0057] S23, based on the candidate set generated in the above steps, construct and maintain the latest r feature changes in the case of pruning set, used to avoid repeated feature changes. Among them, r is related to the total number of features m. In order to ensure the efficiency of feature extraction, the present invention adopts For the similar solutions generated in the above steps, a corresponding feature dataset is formed, which is converted into spectrogram features and trained in a convolutional neural network. The resulting detection model uses an evaluation function to calculate the cost of each similar solution. Each similar solution is traversed and processed according to three pruning strategies: First, if the change of the similar solution exists in the pruned set, it is discarded; second, if the change of the similar solution is not in the pruned set and the cost is lower than the global optimal solution, the similar solution is set as the global optimal solution; third, if the change of the similar solution exists in the pruned set but its cost is lower than the expected index u, the similar solution is still set as the global optimal solution. Finally.

[0058] S24, if the difference between the evaluation costs of the local optimal solutions generated in the two search iterations is lower than the termination threshold, or after u rounds of iteration, the search is stopped. Wherein, u is related to the total number of features m. In order to reduce the iteration time, the present invention adopts

[0059] S3. Feature conversion. Based on the feature dataset generated by the similar solution selection, the traffic features are converted into spectrum images through the multi-resolution analysis discrete wavelet transform method. The generated spectrum image is used as a new feature dataset and as the input of the training sample. If the processed dataset W contains n samples, each sample covers m features, that is, W = {W1, W2, ..., W i ,…,W n}, W i ={w i1 ,w i2 ,…,w ij ,…w im}, i = 1, 2, ..., n, j = 1, 2, ..., m, then the method of obtaining a spectrum diagram from wavelet transform includes the following steps:

[0060] S31, convert the original feature data set into the time-frequency domain. For each sample W k , perform wavelet transform on them respectively to generate time-frequency data sets. The continuous wavelet transform formula is as follows:

[0061]

[0062] In order to adapt to the discrete samples in the industrial control network, the present invention discretizes the translation degree a and the scale b, so a=a0 m ,b=nb0a0 m , then use multi-resolution analysis to select the translation and scale according to the power of 2, and finally perform downsampling optimization to form a more efficient and accurate discrete wavelet change. The formula is as follows:

[0063]

[0064] Where N represents the number of samples in the dataset W, and W k is the feature vector set of the kth data sample {w k1 ,w k2 ,…w im}, represents the characteristics of the original data set to be converted. m,n Represents the wavelet function used in wavelet transform, which is used to convert the original data set into spectral information through wavelet analysis. Z represents a set of integers, and m and n represent integers specified in different wavelet functions, which are used to control the translation and scale of the changes.

[0065] S32. Convert the one-dimensional feature time-frequency information data converted in S41 into a two-dimensional spectrum image by taking the square of the absolute value to form the final spectrum graph dataset as the new input sample set. The spectrum graph generation formula is as follows:

[0066]

[0067] S4. Divide the spectrum atlas generated in the above steps into a training set and a test set in a ratio of 4:1, and apply them to the training of the convolutional neural network model and the verification iteration in step S3. The convolutional neural network model that meets the termination condition of S34 is taken as the optimal result.

[0068] Example 3

[0069] like Figure 1 As shown, the present invention proposes a method for detecting abnormal traffic based on feature-optimized spectrum graphs in industrial control networks. The method is implemented by improving pruning search combined with spectrum graphs, and specifically includes the following steps:

[0070] S1. Collect the abnormal traffic data set of the industrial control network and convert it into a feature data set through encoding and normalization.

[0071] S2. The processed feature data set is amplified by the adaptive oversampling method, thereby optimizing the problem of data imbalance caused by too many normal samples and too few abnormal samples in the industrial control network, which affects the performance of abnormal traffic detection.

[0072] S3. For the balanced feature data set, the optimized pruning search method is used to extract features from the feature data set, and the extracted features are converted into a spectrum graph data set and applied to the convolutional neural network for training to obtain a detection model. The evaluation function of the optimized pruning search method is then used to evaluate the quality of the current detection model until the termination condition of the optimized pruning search method is met. Finally, a better detection model is obtained, thereby improving the accuracy and reducing the false alarm rate.

[0073] S4. For the extracted feature data set, the traffic features are converted into a spectrum image through a multi-resolution analysis discrete wavelet transform method to form a spectrum map feature data set.

[0074] S5. Divide the spectrum graph dataset into a training set and a test set in a ratio of 4:1, apply it to the training of the convolutional neural network model to obtain a detection model, and apply it to the verification iteration in step S3. The model that meets the termination condition is taken as the optimal detection model.

[0075] The specific method of step S1 is: converting the traffic data set into a feature data set through one-hot encoding and normalizing it.

[0076] The specific method of step S2 is: according to the adaptive oversampling method, the number of small samples in the feature data set is amplified to improve the sample balance. The specific implementation method of adaptive oversampling is as follows:

[0077] (1) Assume that the number of small samples in the original data set is N minor , the number of multiple samples is N major If the number of sample features is m, the sample imbalance can be calculated as If the imbalance is lower than the expected balance, which can generally be 0.8, 0.9, or 0.95, the feature dataset is judged to be unbalanced, and sample augmentation is performed.

[0078] (2) According to formula G aug =(N maj o r -N min o r ) Calculate the number of total samples that need to be increased. For each small sample, calculate its K nearest neighboring samples through Euclidean distance, and calculate the proportion of multiple samples in its K nearest neighboring samples According to the formula Regularize the proportion and obtain the density distribution of multiple samples in the K neighboring samples of the small sample. Finally, the number of samples that need to be increased for each small sample is calculated as

[0079] (3) Finally, for each small sample x i ii∈(0,N minor ], randomly select a small neighboring sample x from its K nearest neighboring samples ij j∈(0,K], according to the formula s i =x i +θ*(x ij -x i ) generates synthetic samples s i , where θ represents a random number in [0,1], (x ij -x i ) represents the difference vector between the neighboring small sample and the current small sample. According to the above method, neighboring small samples from the K nearest neighbor samples are continuously selected and synthesized with the random number θ until g synthetic samples are generated. These synthetic samples are then merged into the original dataset to form a sample-balanced dataset.

[0080] The specific method of step S3 is: all samples of the sample balanced data set are used as the initial solution, converted into a spectrum graph data set and applied to the convolutional neural network for training, and the obtained detection model is evaluated by the evaluation function Calculate the cost, where, assuming that the positive samples in the data set are P and the negative samples are N, then FP is the proportion of negative samples predicted as positive samples by the convolutional neural network model, and FN is the proportion of positive samples predicted as negative samples. Assume M f is the number of features after extraction, and m is the number of original features. is the ratio of the number of extracted features to the number of original features. Finally, it is taken as the global optimal solution, the expected index μ is initialized, and the pruning table is set to empty.

[0081] For the current optimal solution, randomly select a positive integer with a binary length equal to the number of features. Based on the 0 / 1 status of the binary bits of the random number, add or delete any feature of the current solution, for example, retain if it is 1 and invert if it is 0, etc., to form t = log2p similar solutions to form a candidate set. Where p is the number of features of the current solution.

[0082] Each round of candidate set verification will maintain a length of The pruned set is used to prune t similar solutions according to the pruning strategy, thereby reducing search time. Then, based on the selection of each similar solution, a corresponding feature dataset is formed, which is converted into a spectrogram and applied to the convolutional neural network for training. The resulting detection model uses an evaluation function to calculate the cost of each similar solution. Here, m is the total number of features. The pruning strategy is as follows: First, if the change of a similar solution exists in the pruned set, it is discarded. Second, if the change of a similar solution does not exist in the pruned set and its cost is lower than the global optimal solution, the similar solution is set as the global optimal solution. Third, if the change of a similar solution exists in the pruned set but its cost is lower than the expected index u, the similar solution is still set as the global optimal solution.

[0083] If the difference in the evaluation cost of the local optimal solution generated in the two searches is lower than the termination threshold, or if the local optimal solution has been searched, After the round, the search stops and the current global optimal solution is used as the final detection model. Where u is the total number of features m.

[0084] The specific method of step S4 is: construct the corresponding feature data set based on the similarity solution generated in S3, convert the traffic characteristics into a spectrum image through the multi-resolution analysis discrete wavelet transform method, and use the generated spectrum image as a new feature data set as the input of the training sample. The specific implementation method of wavelet transformation is as follows:

[0085] (1) If the processed data set W contains n samples, each sample covers m features, that is, W = {W1, W2, ..., W i ,…,W n}, W i ={w i1 ,w i2,…,w ij ,…w im}, i = 1, 2, ..., n, j = 1, 2, ..., m. For each sample W k , perform wavelet transform on them respectively to generate time-frequency data sets. The wavelet transform formula is as follows:

[0086]

[0087] Where N represents the number of samples in the dataset W, and W k is the feature vector set of the kth data sample {w k1 ,w k2 ,…w im}, represents the characteristics of the original data set to be converted. m,n Represents the wavelet function used in wavelet transform, which is used to convert the original data set into spectral information through wavelet analysis. Z represents a set of integers, and m and n represent integers specified in different wavelet functions, which are used to control the translation and scale of the changes.

[0088] (2) For each sample of time-frequency data generated in (1), convert it into a spectrum image by taking the square of the absolute value to form the final spectrum graph dataset. The spectrum graph conversion formula is as follows:

[0089]

[0090] The specific method of step S5 is: divide the generated spectrum graph dataset into training set and test set in a ratio of 4:1, apply it to the training of the convolutional neural network model, apply the obtained detection model to S3 to continue searching, and finally take the convolutional neural network model that meets the termination conditions as the optimal result.

[0091] In the specific implementation process, the core idea of ​​the present invention is to first solve the sample imbalance problem through sample amplification, and then obtain the optimal features by converting the features into a spectrum graph and applying it to the optimized pruning search, and further reflect the feature details through the spectrum graph, thereby reducing the search time while improving the accuracy and reducing the false alarm rate.

[0092] The above embodiment is only one of the preferred embodiments of the present invention and is only used to illustrate the present invention and is not intended to limit the present invention. Other embodiments generated by ordinary technicians in this field based on this embodiment may be changed, modified and transformed in accordance with the original idea of ​​the present invention.

Claims

1. A method for detecting abnormal traffic in industrial control networks based on spectrum feature optimization, characterized by: The steps include: S1. Collect an abnormal traffic data set of the industrial control network and convert it into a feature data set through encoding and normalization. S2, performing sample amplification on the processed feature dataset using an adaptive oversampling method; S3, extracting features from the balanced feature dataset using an optimized pruning search method; S4. For the extracted feature data set, the traffic features are converted into a spectrum image by using a multi-resolution analysis discrete wavelet transform method to form a spectrum feature data set; S5. Divide the spectrogram dataset into a training set and a test set in a ratio of 4:1, apply the training of the convolutional neural network model to obtain a detection model, and apply the verification iteration in step S3. The model that meets the termination condition is selected as the optimal detection model. In step S3, the extracted features are converted into a spectrum graph dataset and applied to a convolutional neural network for training to obtain a detection model. The quality of the current detection model is then evaluated using the evaluation function of the optimized pruning search method until the termination condition of the optimized pruning search method is met, and finally a better detection model is obtained; The optimized pruning search method in step S3 is specifically as follows: S31, first select all features as the initial solution, perform a round of iteration through steps S4 and S5, form a convolutional neural network model of the initial solution, and pass the evaluation function Calculate the cost of the initial solution, set the current solution as the global optimal solution, and initialize the expected index , and set the pruning table to empty. The evaluation function is as follows: Assuming that the positive samples in the data set are P and the negative samples are N, then is the ratio of negative samples predicted as positive samples by the convolutional neural network model, For the ratio of positive samples predicted as negative samples, assume is the number of features after extraction, The number of original features, is the ratio of the number of extracted features to the number of original features; S32. Based on the current solution, according to the 0 / 1 situation of the binary bit of the random number, 1 is retained and 0 is deleted, forming t similar solutions to form a candidate set; where t is related to the number of features p of the current solution. In order to reduce the iteration time, ; S33, based on the candidate set generated in the above steps, construct and maintain the latest r feature changes in the pruning set to avoid repeated feature changes; where r is related to the total number of features m, in order to ensure the efficiency of feature extraction, For the similar solutions generated in the above steps, a corresponding feature dataset is formed, which is converted into a spectrum graph feature and trained in a convolutional neural network. The resulting detection model uses an evaluation function to calculate the cost of each similar solution, and each similar solution is traversed and processed according to the three pruning strategies. S34. If the difference in the evaluation cost of the local optimal solution generated in the two search iterations is lower than the termination threshold, or after u rounds of iteration, the search is stopped; where u is related to the total number of features m. In order to reduce the iteration time, .

2. The abnormal traffic detection method based on spectrum feature optimization for industrial control networks according to claim 1 is characterized in that: In step S1, one-hot encoding is used to convert the data into a feature dataset and normalize it.

3. The abnormal traffic detection method based on spectrum feature optimization applicable to industrial control networks according to claim 1 is characterized in that: The specific method of step S2 is: (1) Assume that the number of small samples in the original data set is , the number of multiple samples is , the number of sample features is m, then the sample imbalance can be calculated as If the imbalance is lower than the expected balance, the feature dataset is judged to be unbalanced, and sample amplification is performed; (2) According to the formula Calculate the number of overall samples that need to be increased; (3) Finally, for each small sample , randomly select a small neighboring sample from its K nearest neighbor samples , according to the formula Generate synthetic samples ,in, represents a random number in [0,1], Represents the difference vector between the neighboring small sample and the current small sample, and continuously selects the neighboring small samples and random numbers in the K nearest neighbor samples according to the above method Synthesize samples until The synthetic samples are merged into the original dataset to form a sample-balanced dataset.

4. The abnormal traffic detection method based on spectrum feature optimization applicable to industrial control networks according to claim 3 is characterized by: The unbalance in step (1) is lower than the desired balance of 0.8, 0.9 or 0.

95.

5. The abnormal traffic detection method based on spectrum feature optimization applicable to industrial control networks according to claim 3 is characterized by: In step (2), for each small sample, calculate its K nearest neighboring samples through Euclidean distance, and calculate the proportion of multiple samples in its K nearest neighboring samples. , according to the formula Regularize the proportion and obtain the density distribution of multiple samples in the K neighboring samples of the small sample. Finally, the number of samples that need to be increased for each small sample is calculated as .

6. The abnormal traffic detection method based on spectrum feature optimization applicable to industrial control networks according to claim 1 is characterized in that: The three pruning strategies in step S33 are as follows: first, if the change of the similar solution exists in the pruning set, it is discarded; second, if the change of the similar solution is not in the pruning set and the cost is lower than the global optimal solution, the similar solution is set as the global optimal solution; third, if the change of the similar solution exists in the pruning set but its cost is lower than the expected index u, the similar solution is still set as the global optimal solution.

7. The abnormal traffic detection method based on spectrum feature optimization applicable to industrial control networks according to claim 1 is characterized in that: The specific method of wavelet transformation in step S4 is as follows: (1) If the processed data set Contains n samples, each sample covers m features, that is, , , , ; For each sample , perform wavelet transform on them respectively to generate time-frequency data sets. The wavelet transform formula is as follows: Where N represents the number of samples in the dataset W. is the set of feature vectors of the kth data sample , represents the characteristics of the original data set to be converted; Represents the wavelet function used in wavelet transform, which is used to convert the original data set into spectral information through wavelet analysis; Z represents a set of integers, and m and n represent integers specified in different wavelet functions, which are used to control the translation and scale of the changes; (2) For the time-frequency data of each sample generated in (1), the absolute value square is taken to convert it into a spectrum image to form the final spectrum graph dataset. The spectrum graph conversion formula is as follows: 。

Images