Lightweight general anomaly detection method and apparatus

Abstract

The application belongs to the field of industrial network security, and provides a lightweight general anomaly detection method and device. Frequency domain feature representation of industrial network traffic session is acquired and transformed to obtain model input sequence; a lightweight anomaly detection model is constructed by combining a deep convolutional autoencoder CAE and a generative adversarial network GAN, and trained by inputting the model input sequence, and the model reaches a convergence state by minimizing the loss function through a gradient descent algorithm; the lightweight anomaly detection model serves as a baseline evaluation model, and a to-be-detected sequence sample is input into the baseline evaluation model to calculate an anomaly score and an anomaly threshold value, and according to the comparison between the anomaly score and the anomaly threshold value, effective discrimination of unknown attack behavior is completed. The application avoids the problem of relying on expert knowledge and ignoring important discriminant features in the past, effectively reduces the reconstruction loss of normal samples in the latent distribution space, and realizes effective detection of unknown attacks.

Description

Technical Field

[0001] This invention relates to the field of industrial network security, and in particular to a lightweight, universal anomaly detection method and apparatus. Background Technology

[0002] Due to the continuous upgrading and iteration of new network and hardware technologies in the industrial sector, the internal functions and systems of the Industrial Internet have been further improved and developed. However, the normal operation of critical infrastructure in industrial scenarios (such as power, oil and petrochemical, and water treatment) still relies on the monitoring and control of the SCADA core system and components. Currently, to meet the practical production needs of enterprises such as remote monitoring, reducing human maintenance costs, and building industrial intelligence, the barriers between the internal industrial network and the enterprise IT network are gradually being broken down, enabling real-time monitoring and analysis of industrial data, as well as remote control and automated operation. However, the cybersecurity vulnerabilities of the traditional closed and isolated environment are also being exposed. The internal SCADA system frequently faces numerous unknown security threats, and these threats propagate directly through the network layer to specific stages of the industrial production process.

[0003] To monitor SCADA systems for unknown security threats in a timely manner, industrial network anomaly detection technology is currently used to detect attacks on industrial SCADA systems. However, since most industrial network attacks are unknown and covert, existing detection methods based on traditional rules and fixed features are prone to producing a large number of false negatives due to limited detection capabilities. Furthermore, network flows of different protocol types cannot be uniformly characterized. Detecting network anomalies in such cases requires the construction of different detection methods, which inevitably increases the detection cost and makes it difficult to apply or deploy existing research methods in various practical industrial production control scenarios.

[0004] While existing research has achieved good test results in the detection phase of a single industrial scenario, most of them only use Modbus protocol data for validation, failing to demonstrate the universality of the method for multi-protocol anomaly detection in different industrial scenarios. Furthermore, in the model training input phase, they still rely on feature extraction methods based on expert knowledge, requiring the acquisition of entity feature information within the traffic to accurately construct the baseline detection model, which introduces certain failures when detecting other industrial protocol data. Some methods propose using raw byte sequences to directly represent the feature space corresponding to network packets, but the representation of attack behavior in industrial networks often corresponds to read and write operations in multiple packets; information in a single packet cannot reflect features that violate normal communication behavior. Additionally, when using only autoencoders to reconstruct traffic data, anomaly information may be effectively reconstructed during training, resulting in poor detection performance. In summary, existing industrial control network anomaly detection methods suffer from poor universality, one-sided consideration of problems, and overly closed scenarios, leading to low accuracy and difficulty in practical application in industrial control networks. Summary of the Invention

[0005] The purpose of this invention is to propose a lightweight and universal anomaly detection method and device for industrial SCADA systems. This method is compatible with network traffic in different industrial scenarios and automatically obtains important features within the traffic session by utilizing frequency domain transformation, thereby achieving effective detection of unknown attacks.

[0006] The technical solution of the present invention is as follows: A lightweight and universal anomaly detection method, comprising the following steps:

[0007] Step 1: Obtain industrial network traffic sessions, and sequentially process the traffic sessions through byte serialization, frequency domain transformation, and feature merging to obtain the model input sequence;

[0008] Step 2: Combine a deep convolutional autoencoder (CAE) to build a lightweight anomaly detection model;

[0009] Step 3: Train the lightweight anomaly detection model using the input sequence of the model to obtain the optimized lightweight anomaly detection model;

[0010] Step 4: Using the lightweight anomaly detection model optimized in Step 3 as the baseline evaluation model, input the sequence sample to be tested into the baseline evaluation model to calculate the anomaly score and anomaly threshold. Based on the comparison between the anomaly score and the anomaly threshold, the effective identification of unknown attack behavior is completed.

[0011] Step one specifically involves:

[0012] Step 1.1 Perform session segmentation on the traffic data of the industrial network according to the five-tuple structure of network data packets to obtain the first traffic session unit composed of multiple network data packets;

[0013] Step 1.2 Based on the protocol characteristics corresponding to the industrial network traffic data, the first traffic session unit is further segmented according to the following methods: no segmentation, polling time segmentation, and TCP_ACK flag segmentation, to obtain multiple second traffic session units;

[0014] Step 1.3 Byte serialization of the second traffic session unit to obtain the initial session sequence; perform session truncation, packet truncation and byte concatenation operations on the second traffic session unit to obtain the initial session sequence;

[0015] Step 1.4 Based on the tag information of the traffic data of the industrial network in Step 1.1, the initial session sequence is re-labeled, and the data of the labeled initial session sequence is standardized or normalized to obtain the sample input sequence.

[0016] Step 1.5 uses frequency domain tools to perform frequency domain decomposition on the sample input sequence from Step 1.4 to obtain the approximate components and detail components of the target sequence. The calculation formulas are as follows:

[0017] cA l =cA l+1 H i +cD l+1 G i

[0018] Among them, for the sample input sequence i represents the number of elements in the sample input sequence, l represents the number of decomposition layers, and H i and G i These represent the low-pass and high-pass filters corresponding to a sample input sequence of length i, respectively; approximate components cA are obtained by layer-by-layer decomposition according to a fixed downsampling rate. l and detail component CD l Finally, the set of approximate component and detail component coefficients after l-level decomposition is obtained, where Represents the approximate component coefficients. The coefficients represent the detail component coefficients, and the coefficient set is as follows:

[0019] Step 1.6 Obtains multi-scale frequency domain information by reconstructing approximate and detail components layer by layer. The calculation formula is as follows:

[0020]

[0021] Where ψ′ represents the reconstruction function, and ω represents the current reconstruction level;

[0022] Step 1.7 concatenates the multi-scale frequency domain information with the sample input sequence channels to obtain the final model input sequence. The calculation formula is as follows:

[0023]

[0024] Re-marking the initial session sequence includes: the current initial session sequence containing malicious network traffic information, wherein the current initial session sequence is marked as malicious.

[0025] The lightweight anomaly detection model includes: a Generative Adversarial Network (GAN); the GAN includes a generator. and discriminator The generator Discriminator The CAE (Convolutional Encoder for Computers and Engineers) is constructed based on a deep convolutional autoencoder, which includes an encoder network E and a decoder network D; the loss function of the lightweight anomaly detection model is obtained through a generator. Corresponding reconstruction loss and discriminator Corresponding discriminant loss In summary, the deep convolutional autoencoder (DAE) uses the encoder network E and decoder network D to obtain CAE1 and CAE2 through copying and combination. CAE1 is used to build the generator for the adversarial network (GAN). CAE2 is used to build discriminators for adversarial network GANs.

[0026] Training a lightweight anomaly detection model using the model input sequence includes: inputting the model input sequence into a generator. The reconstructed output is obtained, and the parameters in CAE1 are adjusted based on the difference between the reconstructed output and the model input sequence; the generator is then... The reconstructed output is input to the discriminator. The discriminant output is obtained. Based on the difference between the discriminant output and the model input sequence, the parameters in CAE2 are adjusted. The parameters of CAE1 and CAE2 are adjusted to obtain the optimized lightweight anomaly detection model.

[0027] The generator Including CAE1, discriminator This is CAE2; both CAE1 and CAE2 consist of two interconnected encoding networks E and decoding networks D; the construction process of CAE1 and CAE2 is described below:

[0028] CAE1 =<E,D1>

[0029] CAE2 =<E,D2>

[0030] In this process, both decoding networks D1 and D2 are obtained by copying decoding network D.

[0031] The encoding network E in the CAE includes k first convolutional kernels, each with a bias b; the decoding network D in the CAE includes k second convolutional kernels, each with a bias c; the model input sequence is input to the generator. The reconstructed output is obtained by inputting the model input sequence x into each of the first convolutional kernels to obtain k feature maps h, calculated as follows:

[0032]

[0033] Where σ is the activation function and x is the model input sequence. Represents the first convolution kernel The corresponding weight matrix, Represents the first convolution kernel The applied bias value, Indicates after the first convolution kernel The final output of the subsequent encoding network;

[0034] Each feature map The corresponding second convolution kernel is then deconvolved and summed to obtain the reconstructed output; the calculation formula is as follows:

[0035]

[0036] in, This indicates the second convolution kernel in the decoding network during the deconvolution process. The corresponding weight matrix;

[0037] The reconstructed output is input to the discriminator. The discriminant output includes:

[0038] The reconstructed output x is input into each of the first convolutional kernels to obtain k feature maps h, calculated as follows:

[0039]

[0040] Where σ is the activation function and x is the model input sequence. Represents the first convolution kernel The corresponding weight matrix, Represents the first convolution kernel The applied bias value, Indicates after the first convolution kernel The output after that;

[0041] Each feature map The corresponding second convolution kernel is then deconvolved and summed to obtain the discriminant output; the calculation formula is as follows:

[0042]

[0043] in, This indicates the second convolution kernel in the decoding network during the deconvolution process. The corresponding weight matrix.

[0044] The sequence sample to be tested is input into the generator. Obtain the reconstructed output; discriminator It is used to identify the differences between the reconstructed output and the input samples, and to obtain the anomaly score and anomaly threshold.

[0045] The training objective of the lightweight anomaly detection model is to minimize the reconstruction loss of the generator and maximize the discrimination loss of the discriminator during the training process.

[0046] In the training phase of the lightweight anomaly detection model, iterative optimization is performed using a two-stage loss update. The two-stage loss includes the generator... Corresponding reconstruction loss and discriminator Corresponding discriminant loss The calculation process is as follows:

[0047]

[0048]

[0049] Where n is the number of training rounds; This represents the distance metric between the model input sequence and the reconstructed output of CAE1. This represents the distance measure between the model input sequence and the discriminative output of CAE2. This represents the distance measure between the model input sequence and the discriminator's discriminant output.

[0050] The general loss function of the depthwise convolutional autoencoder CAE is as follows:

[0051]

[0052] in, Input sequence to the model, express and Distance measure between.

[0053] Step four specifically includes:

[0054] Step 4.1 Input the test sequence samples into the baseline assessment model and calculate the anomaly score for each test sequence sample. The calculation formula is as follows:

[0055]

[0056] in, and As a balance factor, The sequence of the sample to be tested; This represents the anomaly score of the sequence to be tested after it has been input into the baseline model; This is a distance measure between the sequence of samples to be tested and the reconstructed output of the generator; This is a distance measure between the sequence of samples to be tested and the discriminant output.

[0057] Step 4.2 Combines the test sequence samples with the baseline evaluation model to calculate the anomaly thresholds corresponding to all test sequence samples. The calculation formula is as follows:

[0058]

[0059] in, This indicates the abnormal threshold corresponding to the sample to be tested. This represents the reconstructed output obtained after the sample sequence to be tested is input into the generator. This indicates that the reconstructed output will be used as a discriminator. The discriminant output obtained after inputting;

[0060] Step 4.3 compares the anomaly score with the anomaly threshold to determine the sample category CI to which the original network traffic in the test sequence sample belongs; when the anomaly score is less than the threshold, the sample category CI to which the original network traffic corresponding to the test sequence sample belongs is positive; when the anomaly score is greater than the threshold, the sample category CI to which the original network traffic corresponding to the test sequence sample belongs is negative.

[0061]

[0062] Step 4.4 Repeat steps 4.1-4.3 for each sample to be tested to achieve anomaly detection of attack behavior in traffic data.

[0063] A lightweight, universal anomaly detection device, comprising:

[0064] The network module is used to acquire industrial network traffic sessions in different industrial control scenarios;

[0065] The data processing module is used to extract the frequency domain feature representation of industrial network traffic sessions in the network module and transform it to obtain the model input sequence;

[0066] Memory, used to store lightweight anomaly detection models;

[0067] The processor is used to read session information from the memory and execute the corresponding computer program; when the computer program is executed, the processor is mainly used for:

[0068] A lightweight anomaly detection model is trained using the input sequence. The loss function is minimized using the gradient descent algorithm to bring the lightweight anomaly detection model to convergence, resulting in an optimized lightweight anomaly detection model. This optimized lightweight anomaly detection model is then used as a baseline evaluation model. The sample sequence to be detected is input into the baseline evaluation model to calculate the anomaly score and anomaly threshold. Based on the comparison between the anomaly score and the anomaly threshold, the unknown attack behavior is effectively identified.

[0069] A readable storage medium storing a computer program that can be executed by a processor to implement a detection method.

[0070] The beneficial effects of this invention are as follows: (1) This application proposes to effectively extract session-level traffic features using dual-frequency domain transformation, and to characterize the fine-grained sequence patterns within network traffic sessions in a form with low feature redundancy and low information loss, avoiding the problem of neglecting important discriminative features by relying on expert knowledge in the past. (2) This application proposes a lightweight anomaly detection model based on a deep convolutional autoencoder (CAE) and an adversarial training network, and uses the probability metric of the CAE itself and the reconstruction error of the adversarial network model as a joint anomaly metric, while effectively reducing the reconstruction loss of normal samples in the potential distribution space, and realizing effective detection of unknown attacks. (3) This application fully considers the application needs in actual production, and only requires a small amount of prior knowledge to deploy the model and perform automated detection. Attached Figure Description

[0071] Figure 1 Flowchart of a lightweight, general-purpose anomaly detection method;

[0072] Figure 2 This is a framework diagram of a lightweight anomaly detection model;

[0073] Figure 3 This is a schematic diagram of a lightweight, general-purpose anomaly detection device. Detailed Implementation

[0074] refer to Figure 1 As shown, the processing flow of the lightweight general anomaly detection method involved in this invention includes the following steps:

[0075] Step 1: Preprocess industrial network traffic. The traffic session is sequentially serialized into bytes, transformed in the frequency domain, and fused in the feature domain to obtain the model input sequence. The specific steps are as follows:

[0076] Step 1.1 Perform session segmentation on industrial network traffic based on the five-tuple structure of network data packets (source IP, destination IP, source port, destination port, and transport protocol) to obtain the first traffic session unit composed of multiple network data packets;

[0077] Step 1.2 Based on the protocol characteristics corresponding to the industrial network traffic data, the first traffic session unit is further segmented according to the following methods: no segmentation, polling time segmentation, and TCP_ACK flag segmentation, to obtain multiple second traffic session units;

[0078] Step 1.3 Byte serialization of the session unit to obtain the initial session sequence; for the second traffic session unit, session truncation, data packet truncation and byte concatenation operations are performed, that is, the first m data packets of the current traffic session unit and j bytes in the data packets are selected as the core representation information, and the length is not sufficient to fill with 0, and the bytes are concatenated according to the order of the data packets to form the initial session sequence.

[0079] Step 1.4 Based on the label information of the industrial network traffic in Step 1.1, the serialized session units are re-labeled, and the labeled initial session sequence data is standardized or normalized to obtain the sample input sequence.

[0080] Step 1.5 Use frequency domain tools (such as wavelet analysis and Fourier transform) to perform frequency domain decomposition on the sample input sequence to obtain the approximate components and detail components of the target sequence. The calculation formula is as follows:

[0081] cA l =cA l+1 H i +cD l-1 G i

[0082] Among them, for the sample input sequence i represents the number of elements in the sample input sequence, l represents the number of decomposition layers, and H i and G i These represent the low-pass and high-pass filters corresponding to a sample input sequence of length i, respectively; approximate components cA are obtained by layer-by-layer decomposition according to a fixed downsampling rate. l and detail component CD l Finally, the set of approximate component and detail component coefficients after l-level decomposition is obtained, where Represents the approximate component coefficients. The coefficients represent the detail component coefficients, and the coefficient set is as follows:

[0083] Step 1.6 Obtains multi-scale frequency domain information by reconstructing approximate and detail components layer by layer. The calculation formula is as follows:

[0084]

[0085] Where ψ′ represents the reconstruction function, and ω represents the current reconstruction level;

[0086] Step 1.7 concatenates the multi-scale frequency domain information with the sample input sequence channels to obtain the final model input sequence. The calculation formula is as follows:

[0087]

[0088] Step Two: As Figure 2 As shown, a lightweight anomaly detection model is constructed by combining a deep convolutional autoencoder (CAE) and an adversarial network (GAN).

[0089] Step 2.1 Constructing the encoding network E in CAE includes k first convolutional kernels, each of which is given a bias b; the model input sequence x is input into each of the first convolutional kernels to obtain k feature maps h, calculated as follows:

[0090]

[0091] Where σ is the activation function and x is the model input sequence. Represents the first convolution kernel The corresponding weight matrix, Represents the first convolution kernel The applied bias value, Indicates after the first convolution kernel The final output of the subsequent encoding network;

[0092] The decoding network D in the CAE constructed in step 2.2 includes k second convolutional kernels, each of which is subject to a bias c. Each feature map h is deconvolved and summed with its corresponding second convolutional kernel to obtain the output of the depthwise convolutional autoencoder. The calculation formula is as follows:

[0093]

[0094] in, This represents the second convolution kernel during the deconvolution process of the decoding network. The corresponding weight matrix;

[0095] The loss function used in the CAE to measure reconstruction performance is calculated as follows, which is used to constrain the CAE to compress the model input sequence to a set feature range:

[0096]

[0097] Where p represents the number of input sequences to the model, x i Let y represent the i-th element in the model input sequence.i This represents the i-th element in the output sequence of a depthwise convolutional autoencoder. This represents the distance between the model input sequence and the output of the deep convolutional autoencoder.

[0098] Step 2.3 Based on the encoding network E and decoding network D in the CAE entity model constructed above, it is implicitly divided into two CAE structures, corresponding to the generator in the adversarial network. and discriminator Specifically, the decoding network D is copied to form two decoding networks, D1 and D2, and the encoding network E is combined with decoding networks D1 and D2 to obtain two CAE structures. The construction process is described as follows:

[0099] CAE1 =<E,D1>

[0100] CAE2 =<E,D2>

[0101] Among them, CAE1 serves as the generator. A network is used to fit the distribution of input samples to obtain the reconstructed output; CAE2 is used as a discriminator. The network is used to determine the differences between the reconstructed output and input samples.

[0102] Step 3: Train the lightweight anomaly detection model using the input sequence to obtain the optimized lightweight anomaly detection model. Specific steps include:

[0103] For the adversarial training process of a lightweight anomaly detection model, the general formula for calculating the maximum and minimum loss of the optimization objective is as follows:

[0104]

[0105] During model training, iterative optimization is performed using a two-stage loss update, where the generators formed in each stage are... Corresponding reconstruction loss and discriminator The corresponding discriminant loss is calculated as follows:

[0106]

[0107]

[0108] As the number of iterations n increases, the first term in the following formula, which relies solely on CAE for reconstruction, gradually diminishes. Instead, the second term, representing the change in adversarial loss between the two CAEs, takes precedence. For the generator, this means minimizing the difference between the input session sequence and the output sequence; while for the discriminator, it means maximizing the difference between the two, i.e., having a higher discriminative ability.

[0109] Repeat steps 3.1-3.4 until the model reaches the maximum number of training rounds.

[0110] A general loss function is defined based on the encoding and decoding networks established by CAE to improve reconstruction and discrimination capabilities. Both CAE1 and CAE2 use this general loss function during training, and its calculation process is as follows:

[0111]

[0112]

[0113] in, Input sequence to the model, Indicates the generator or discriminator E-compression of the coding network The resulting low-dimensional features Indicates a generator or discriminator Decompression of the Chinese decoding network The obtained reconstructed samples This represents a general loss function that measures the relationship between the input sequence and the reconstructed output. It can be set to other distance measures such as the L2 norm, SSIM, or MS-SSIM. express and Distance measure between;

[0114] Step 4: Using the lightweight anomaly detection model optimized in Step 3 as the baseline evaluation model, input the sample sequence to be tested into the baseline evaluation model to calculate the anomaly score and anomaly threshold. Compare the anomaly score and anomaly threshold, and based on the comparison, complete the effective identification of unknown attack behaviors. The specific steps are as follows:

[0115] Step 4.1 Input the test sequence samples into the baseline assessment model and calculate the anomaly score for each test sequence sample. The calculation formula is as follows:

[0116]

[0117] in, and The purpose of this balancing factor is to balance the weight of reconstruction loss and discrimination loss in anomaly scoring.

[0118] Step 4.2 Combines the test sequence samples with the baseline evaluation model to calculate the anomaly thresholds corresponding to all test sequence samples. The calculation formula is as follows:

[0119]

[0120] in, This indicates the abnormal threshold corresponding to the sample to be tested. This represents the reconstructed output obtained after the sample to be tested is input into the generator. This indicates that the reconstructed output will be used as a discriminator. The discriminant output obtained after inputting;

[0121] Step 4.3 compares the anomaly score with the anomaly threshold to determine the sample category CI to which the original network traffic in the test sequence sample belongs; when the anomaly score is less than the threshold, the sample category CI to which the original network traffic corresponding to the test sequence sample belongs is positive; when the anomaly score is greater than the threshold, the sample category CI to which the original network traffic corresponding to the test sequence sample belongs is negative.

[0122]

[0123] Step 4.4 Repeat steps 4.1-4.3 for each sample to be tested to achieve anomaly detection of attack behavior in traffic data.

[0124] like Figure 3 As shown, a lightweight, universal anomaly detection device includes:

[0125] The network module is used to acquire industrial network traffic sessions in different industrial control scenarios;

[0126] The data processing module is used to extract the frequency domain feature representation of industrial network traffic sessions in the network module and transform it to obtain the model input sequence;

[0127] Memory, used to store lightweight anomaly detection models;

[0128] The processor is used to read session information from the memory and execute the corresponding computer program; when the computer program is executed, the processor is mainly used for:

[0129] A lightweight anomaly detection model is trained using the input sequence. The loss function is minimized using the gradient descent algorithm to bring the lightweight anomaly detection model to convergence, resulting in an optimized lightweight anomaly detection model. This optimized lightweight anomaly detection model is then used as a baseline evaluation model. The sample sequence to be detected is input into the baseline evaluation model to calculate the anomaly score and anomaly threshold. Based on the comparison between the anomaly score and the anomaly threshold, the unknown attack behavior is effectively identified.

[0130] A computer-readable storage medium stores a computer program that can be executed by a processor to implement a detection method. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media.

[0131] This invention addresses the shortcomings of traditional detection methods, which rely heavily on expert experience and cannot be reused for anomaly detection across different industrial protocols. It proposes a lightweight, universal anomaly detection method, device, and readable storage medium for network attacks on industrial SCADA systems. The key features include the following four points:

[0132] (1) By using only a small amount of indicative information in the industrial control protocol data stream, the target protocol stream features to be detected are extracted and characterized in a standardized manner, which greatly reduces the cost of manual feature selection.

[0133] (2) Using frequency domain transformation to amplify the representation depth of the original features in high-dimensional space is beneficial for the model to learn the multi-scale differences between abnormal data distribution and normal data distribution in a more granular way.

[0134] (3) Considering the reusability of SCADA system anomaly detection in different scenarios, and taking the end-to-end mode as the design criterion, a SCADA network traffic data anomaly detection method based on the combination of native CAE and adversarial training is proposed.

[0135] (4) In terms of detecting abnormal traffic in industrial networks, this detection model has the same or better detection accuracy and performance compared to the current large number of research methods based on deep learning models.

[0136] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0137] This embodiment uses two publicly available industrial network traffic datasets (related to power transmission and mining / smelting processes) from different industrial scenarios to validate the lightweight anomaly detection model. The protocol types are Modbus / TCP and S7comm, respectively. The traffic data includes types such as malware, unauthorized access, request fingerprint forgery, remote exploitation, and physical process attacks. The Modbus / TCP data for different attack types are distributed in different PCAP files, requiring separate detection of the current anomalous attack type. In contrast, S7comm distributes all attack types in the same PCAP file, so it is treated as an anomaly during the validation process. The specific data distribution is shown in Tables 1 and 2.

[0138] Table 1 Flow data in power transmission scenarios

[0139]

[0140] Table 2 Traffic Data for Mining and Metallurgical Scenarios

[0141]

[0142] A lightweight and general anomaly detection method for network attacks on industrial SCADA systems, comprising the following steps:

[0143] Step 1: Preprocess industrial network traffic, obtain the frequency domain feature representation of the traffic session and use it as model input. The specific steps are as follows:

[0144] Step 1.1 Perform session segmentation based on the five-tuple structure (source IP, destination IP, source port, destination port, transport protocol) in the basic network traffic to obtain a traffic session unit composed of multiple network data packets.

[0145] Step 1.2 Based on the protocol characteristics corresponding to the target traffic data, the traffic session units obtained in the previous step are further segmented according to the following methods: no segmentation, polling time segmentation, and TCP_ACK flag segmentation. Modbus / TCP session data is not subject to secondary segmentation, while S7comm is segmented using the TCP_ACK flag.

[0146] Step 1.3 Construct the initial session sequence input. Perform session truncation and packet truncation operations on the final traffic session unit. Select the first m packets of the current session and the first j bytes of the packet payload as the core representation information. Pad the length with 0 if it is less than the set length, and connect them into a session sequence in chronological order. For Modbus / TCP, m=6 and j=20, while for S7comm, m=13 and j=26. The corresponding input sequence lengths are 120 bytes and 338 bytes, respectively.

[0147] Step 1.4 Based on the original traffic information, re-label the target session sequence and standardize or normalize the sequence data.

[0148] Step 1.5 uses frequency domain tools (such as wavelet analysis and Fourier transform) to perform frequency domain decomposition on the sequence data to obtain the approximate components and detail components of the target sequence. The verification process uses a 3-level dual wavelet decomposition, with the corresponding wavelet names being haar and db3, and their calculation formulas are as follows:

[0149]

[0150] Where for the input sequence Approximate components are obtained by decomposing the material layer by layer according to a fixed downsampling rate. and details Its component coefficient set is

[0151] Step 1.6 Obtains multi-scale frequency domain information, i.e., three-layer reconstructed information, by reconstructing components layer by layer. The calculation formula is as follows:

[0152]

[0153] Step 1.7 concatenates the reconstructed sequence information with the original session sequence to obtain the final model input sequence. The model input batch_size is set to 64, corresponding to a Modbus / TCP input dimension of (64, 7, 120), while the S7comm dimension is (64, 7, 338). The calculation formula is as follows:

[0154]

[0155] Step 2: Using the transformed conversation sequence as input data, the proposed lightweight anomaly detection model is trained. The L2 norm is used as the loss metric for both the training and validation phases. The model structure is as follows: Figure 2 As shown, the specific approach for this step is as follows:

[0156] Step 2.1 In the encoding process E, k convolutional kernels are initialized, and a bias b is applied to each convolutional kernel. The purpose is to dynamically extract local spatial feature maps on the input sequence x using different convolutional kernels, thereby obtaining k feature maps h. The calculation formula is as follows:

[0157] h k =σ(x*Wk+b k )

[0158] Step 2.2 In the decoding process D, each feature map h is convolved with its corresponding convolution kernel and summed, then a bias c is added to obtain the encoder output. The calculation formula is as follows:

[0159]

[0160] Step 2.3 uses the mean squared error (MSE) as the loss function to update the weights during training. The calculation formula is as follows:

[0161]

[0162] Step 2.4 Based on the encoding network E and decoding network D in the CAE entity model constructed above, it is implicitly divided into two CAE structures, corresponding to the generator in the adversarial network. and discriminator Specifically, D is copied to form two decoding networks, D1 and D2, and E is combined with the two to form the AE structure. The calculation process is as follows:

[0163] CAE1 =<E,D1>

[0164] CAE2 =<E,D2>

[0165] Among them, CAE1 is as A network is used to fit the sample distribution, and CAE2 is also used for implementation. Network discrimination function.

[0166] Step 3: During the training phase of the anomaly detection model, the loss function is minimized using the gradient descent algorithm, allowing the model to gradually converge. Specific steps include:

[0167] Step 3.1 In order to effectively measure the difference between the input sequence and the generated sequence, this invention defines a general loss function for CAE, the calculation process of which is as follows:

[0168]

[0169]

[0170] in, It can be expressed as L2 norm, SSIM, or MS-SSIM, or other distance measures.

[0171] Step 3.2 Calculate the backpropagation error for each sample as it passes through the CAE. The calculation formula is as follows:

[0172]

[0173] In this equation, the first and second terms correspond to the hidden layer and the reconstructed state information, respectively.

[0174] Step 3.3: Through adversarial training, CAE1 and CAE2 engage in a game of mutual competition. This allows CAE1 to improve its ability to reconstruct input samples, thereby deceiving CAE2. Simultaneously, it improves CAE2's ability to distinguish between reconstructed samples and real samples. The general formula for calculating the maximum and minimum loss of the optimization objective is as follows:

[0175]

[0176] Step 3.4: Generator training loss during adversarial training. and discriminator training loss The calculation process is as follows:

[0177]

[0178]

[0179] As the number of iterations n increases, the first term in the following formula, which relies solely on CAE for reconstruction, gradually diminishes. Instead, the second term, representing the change in adversarial loss between the two CAEs, takes precedence. For the generator, this means minimizing the difference between the input session sequence and the output sequence; while for the discriminator, it means maximizing the difference between the two, i.e., having a higher discriminative ability.

[0180] Step 3.5 Repeat steps 3.1-3.4 until the model reaches the maximum number of training rounds.

[0181] Step 4: Calculate the anomaly score of the sample to be tested using the anomaly detection baseline model obtained after training with normal samples, and complete the anomaly detection of unknown attack behavior. The batch_size of the validation input sample is 1.

[0182] The specific steps are as follows:

[0183] Step 4.1 Based on the optimized baseline model, calculate the anomaly score of the sequence sample to be inspected. The calculation formula is as follows:

[0184]

[0185] in, and The purpose of this balancing factor is to balance the weight of reconstruction loss and discrimination loss in anomaly scoring.

[0186] Step 4.2 Based on the trained baseline model parameters and the samples to be detected, calculate the corresponding anomaly threshold. The calculation formula is as follows:

[0187]

[0188] Step 4.3 Compare the anomaly score obtained after training the model for each sample to be tested with the detection threshold to obtain the final sample category CI. When the anomaly score is less than the threshold, it is classified as a positive class, and otherwise it is classified as a negative class.

[0189]

[0190] Step 4.4 Repeat steps 4.1-4.3 for each sample to be tested to achieve anomaly detection of attack behavior in traffic data.

[0191] To verify the effectiveness of the proposed method, a series of experiments were conducted to compare the system model with two more advanced anomaly detection algorithms, including the Finite State Machine (FSM) detection algorithm and the Stack Autoencoder (SDA) detection algorithm mentioned in the background section, in terms of detecting unknown attack traffic and scenario versatility. Table 3 shows the performance differences between the proposed system model and the two compared algorithms. Clearly, the proposed model outperforms the other algorithms in all evaluation metrics.

[0192] (1) Regarding the detection performance of the model, since this invention uses the original bytes and their frequency domain distribution information as the training input of the model, it largely avoids the loss of important detailed features caused by manual selection. Through iterative training, the model can fit the normal sample distribution in the time-frequency space, reflecting the correlation of local and even global information in the original byte stream in a finer granular manner. Furthermore, it uses adversarial training to reduce the CAE's ability to reconstruct abnormal samples, meaning that the reconstruction loss of abnormal samples is much greater than that of normal samples, enabling the model to effectively detect abnormal behavior in industrial network traffic. As can be seen from Table 3, the detection model proposed in this invention is superior to other methods in terms of accuracy, recall, and F1 score, thus proving that this invention has a significant advantage in detection performance.

[0193] (2) Regarding the universality of the detection model, this invention utilizes two representative industrial network datasets of different protocol types for method verification. Existing detection models are generally only applicable to a single industrial scenario. When the target scenario's business is modified or the field control logic is changed, key information such as the corresponding network communication behavior and traffic characteristics changes. Traditional methods cannot extract features in a timely manner based on prior knowledge, leading to some missed and false alarms. As shown in Table 3's SDA, although some methods use raw information as input features, they still define a single data packet as a communication unit. When facing different business scenarios, this results in an inability to fully depict normal inter-device communication behavior or attack behavior launched by attackers during intrusion, rendering the detection model ineffective. In contrast, this invention, for the network traffic data to be detected, obtains session units that represent business communication behavior based on key node information such as device polling cycles and communication interaction flags, according to actual needs. This fully reflects the communication behavior status of the entire industrial network system and establishes a baseline for normal communication behavior, making it suitable for the effective detection of network flow anomalies in different scenarios.

[0194] Table 3 Attack detection results in different scenarios

[0195]

[0196] Based on the above observations, the system model proposed in this invention can combine frequency domain analysis and raw byte streams as inputs, and by adding adversarial training strategies on the basis of CAE, the detection model can achieve a classification performance of over 99% for unknown attacks. At the same time, relying on the above adversarial training, the model can better fit the behavioral distribution of normal network traffic samples and adapt to the target industrial network system to establish a more accurate baseline of normal communication behavior, thereby achieving the correct classification of abnormal attack behaviors in different industrial networks or network protocol stream data.

Claims

1. A lightweight, universal anomaly detection method, characterized in that, The steps include the following: Step 1: Obtain the traffic session of the industrial network, and process the traffic session sequentially through byte serialization, frequency domain transformation, and feature merging to obtain the model input sequence; Step 2: Combine a deep convolutional autoencoder (CAE) to build a lightweight anomaly detection model; Step 3: Train the lightweight anomaly detection model using the input sequence of the model to obtain the optimized lightweight anomaly detection model; Step 4: Using the lightweight anomaly detection model optimized in Step 3 as the baseline evaluation model, input the sequence sample to be tested into the baseline evaluation model to calculate the anomaly score and anomaly threshold, compare the anomaly score and anomaly threshold, and complete the effective identification of unknown attack behavior based on the comparison between the anomaly score and the anomaly threshold. The lightweight anomaly detection model includes: a Generative Adversarial Network (GAN); the GAN includes a generator. Discriminator The generator Discriminator The CAE (Construction Based on Deep Convolutional Autoencoder) includes an encoding network E and a decoding network D. In a deep convolutional autoencoder, the encoder network E and the decoder network D are obtained through copying and combining. and , Generators for building GANs (Generators for Adversarial Networks) , Discriminator used to build adversarial network GANs Training the lightweight anomaly detection model using the input sequence of the model includes: The model input sequence is input into the generator. The reconstructed output is obtained, and adjustments are made based on the difference between the reconstructed output and the model input sequence. Medium parameters; input the reconstructed output to the discriminator. Obtain the discriminant output, and adjust the model based on the difference between the discriminant output and the model input sequence. Medium parameters; based on the adjusted parameters and The optimized lightweight anomaly detection model was obtained. The loss function of the lightweight anomaly detection model includes the reconstruction loss corresponding to the generator and the discrimination loss corresponding to the discriminator: To ensure that the reconstruction loss of the generator is minimized and the discrimination loss of the discriminator is maximized during the training of the lightweight anomaly detection model; In the training phase of the lightweight anomaly detection model, iterative optimization is performed using a two-stage loss update. The two-stage loss includes the generator... Corresponding reconstruction loss and discriminator Corresponding discriminant loss The calculation process is as follows: Where n is the number of training rounds; Represents the model input sequence and The distance metric between the reconstructed outputs; Represents the model input sequence and The distance measure between the discriminant outputs; This represents the distance measure between the model input sequence and the discriminator's discriminant output.

2. The lightweight universal anomaly detection method according to claim 1, characterized in that, Step one specifically involves: Step 1.1 Perform session segmentation on the traffic data of the industrial network based on the five-tuple structure of network data packets to obtain the first traffic session unit composed of multiple network data packets; Step 1.2 Based on the protocol characteristics corresponding to the traffic data of the industrial network, the first traffic session unit is further segmented according to the following methods: no segmentation, polling time segmentation, and TCP_ACK flag segmentation, to obtain multiple second traffic session units; Step 1.3 Byte serialization of the second traffic session unit to obtain the initial session sequence; perform session truncation, packet truncation and byte concatenation operations on the second traffic session unit to obtain the initial session sequence; Step 1.4 Based on the tag information of the traffic data of the industrial network in Step 1.1, the initial session sequence is re-labeled, and the data of the labeled initial session sequence is standardized or normalized to obtain the sample input sequence. Step 1.5 Use frequency domain tools to perform frequency domain decomposition on the sample input sequence from Step 1.4 to obtain the approximate components and detail components of the target sequence. The calculation formulas are as follows: Among them, for the sample input sequence , This indicates the number of elements in the sample input sequence. Indicates the number of decomposition layers. and They represent lengths of The low-pass and high-pass filters corresponding to the sample input sequence are used; approximate components are obtained by layer-by-layer decomposition according to a fixed downsampling rate. and details Finally, after going through The set of coefficients for approximate and detail components after layer decomposition, where Represents the approximate component coefficients. The coefficients represent the detail component coefficients, and the coefficient set is as follows: ; Step 1.6 Obtain multi-scale frequency domain information by reconstructing approximate and detail components layer by layer. The calculation formula is as follows: in, Represents the refactoring function. Indicates the current reconstruction level; Step 1.7 Concatenate the multi-scale frequency domain information with the channels of the sample input sequence to obtain the final model input sequence. The calculation formula is as follows: 。 3. The lightweight universal anomaly detection method according to claim 2, characterized in that, The initial session sequence is re-tagged, including: The current initial session sequence contains malicious network traffic information, and the current initial session sequence is marked as malicious.

4. The lightweight universal anomaly detection method according to claim 1, characterized in that, and Each includes an interconnected encoding network E and a decoding network D; and The construction process is described as follows: Among them, the decoding network and decoding network All were obtained by copying from the decoding network D.

5. The lightweight universal anomaly detection method according to claim 4, characterized in that, The encoding network E includes k first convolutional kernels, each of which is subject to a bias b; the decoding network D includes k second convolutional kernels, each of which is subject to a bias c. The model input sequence is input into the generator. The reconstructed output is obtained from the process, including: The model input sequence x is fed into each of the first convolutional kernels to obtain k feature maps h, calculated as follows: in, Let x be the activation function, and let x be the input sequence of the model. Represents the first convolution kernel The corresponding weight matrix, Represents the first convolution kernel The applied bias value, Indicates after the first convolution kernel The output after that; Each feature map The corresponding second convolution kernel is then deconvolved and summed to obtain the reconstructed output; the calculation formula is as follows: in, This indicates the second convolution kernel in the decoding network during the deconvolution process. The corresponding weight matrix.

6. The lightweight universal anomaly detection method according to claim 1, characterized in that, The general loss function for depthwise convolutional autoencoders (CAEs) is as follows; in, Input sequence to the model, express and Distance measure between.

7. The lightweight universal anomaly detection method according to claim 1 or 6, characterized in that, Step four specifically includes: Step 4.1 Input the test sequence samples into the generator and discriminator in the baseline evaluation model in sequence, and calculate the anomaly score for each test sequence sample. The calculation formula is as follows: in, and As a balance factor, The sequence of the sample to be tested; This represents the anomaly score of the sequence to be tested after it has been input into the baseline model; This is a distance measure between the sequence of samples to be tested and the reconstructed output of the generator; This is a distance measure between the sequence of samples to be tested and the discriminant output. Step 4.2 Combining the test sequence samples with the baseline evaluation model, calculate the anomaly thresholds corresponding to all test sequence samples. The calculation formula is as follows: in, This indicates the abnormal threshold corresponding to the sample to be tested. This represents the reconstructed output obtained after the sample sequence to be tested is input into the generator. This indicates that the reconstructed output will be used as a discriminator. The discriminant output obtained after inputting; Step 4.3 Compare the anomaly score with the anomaly threshold to determine the sample category CI to which the original network traffic in the test sequence sample belongs; when the anomaly score is less than the threshold, the sample category CI to which the original network traffic corresponding to the test sequence sample belongs is positive; when the anomaly score is greater than the threshold, the sample category CI to which the original network traffic corresponding to the test sequence sample belongs is negative. Step 4.4 Repeat steps 4.1-4.3 for each sample to be tested to achieve anomaly detection of attack behavior in traffic data.

8. A lightweight, universal anomaly detection device, used to perform the method according to any one of claims 1-7, characterized in that, include: The network module is used to acquire traffic sessions of industrial networks in different industrial control scenarios; The data processing module is used to extract the frequency domain feature representation of the traffic sessions of the industrial network in the network module and transform it to obtain the model input sequence; Memory, used to store lightweight anomaly detection models; The processor is used to read session information from the memory and execute the corresponding computer program; when the computer program is executed, the processor is mainly used for: A lightweight anomaly detection model is trained using the input sequence. The loss function is minimized using the gradient descent algorithm to bring the lightweight anomaly detection model to convergence, resulting in an optimized lightweight anomaly detection model. This optimized lightweight anomaly detection model is then used as a baseline evaluation model. The sample sequence to be detected is input into the baseline evaluation model to calculate the anomaly score and anomaly threshold. Based on the comparison between the anomaly score and the anomaly threshold, the unknown attack behavior is effectively identified.

Images