Industrial network attack detection method based on federal map information compression

Abstract

The invention provides an industrial network attack detection method based on federal map information compression, aiming at the problem of network attacks in the industrial internet. According to the method, data features are represented through a graph structure under a federated learning framework, important features in a node matrix and an adjacent matrix are extracted, and a central server aggregates and updates a detection model from edge equipment. The invention aims to improve industrial network security and intelligent detection capability.

Description

Technical Field

[0001] Based on the industrial Internet technology, the present invention constructs an industrial network attack detection method based on federated graph information compression. Under the framework of federated learning, the attack detection model using graph information compression is used to train the collected industrial network attack data. During the training process, the graph structure is used to characterize the data features, and the node matrix and the adjacency matrix are extracted for important features. The detection model is aggregated and updated on the central server. The technical field to which the present invention belongs is industrial network security and intelligent detection, specifically network attack detection, which can improve the network security detection capability in the industrial Internet environment. Background Art

[0002] With the development of Industry 4.0 and Internet of Things technologies, industrial control systems and industrial Internet of Things are increasingly being used in various industries. However, with the increase in connected devices and the increasing complexity of systems, industrial systems are facing more and more network security threats. Traditional network security measures, such as firewalls and intrusion detection systems, are no longer sufficient to cope with complex and diverse attack scenarios, especially in industrial environments, where attacks may cause serious production interruptions and safety accidents. Therefore, it is particularly important to study intelligent attack detection technology for industrial networks.

[0003] Current network attack detection technologies mainly rely on machine learning and deep learning methods to identify abnormal activities by analyzing network traffic and system logs. However, these methods have some limitations in industrial environments. First, industrial data is usually heterogeneous and non-independent and identically distributed, which increases the difficulty of model training. Second, attack samples in industrial networks are usually scarce, making it difficult for traditional data-driven methods to accurately identify and classify rare attacks. In addition, existing methods usually require a lot of computing resources and data transmission, which cannot meet the real-time requirements in industrial applications.

[0004] The present invention proposes an industrial network attack detection method based on federated graph information compression. Federated learning avoids large-scale data transmission by transmitting the detection model locally on the edge device, and effectively trains the industrial network attack features of the industrial system. The industrial data is represented as a graph structure, and important features are extracted from nodes and edges. The detection model can identify the most valuable features for the detection results and filter out redundant information. Therefore, the industrial network attack detection method based on federated graph information compression proposed in the present invention can improve the accuracy of the detection network and provide an effective method for industrial network attack detection. Summary of the invention

[0005] The present invention proposes an industrial network attack detection method based on federated graph information compression. The method first collects industrial data through an industrial vibration sensor device and an industrial temperature sensor device in an edge device, and transmits the data to a Raspberry Pi 4B device for conversion into a graph structure to represent data features, extracts important features in a node matrix and an adjacency matrix, and trains an industrial network attack detection model for local graph information compression. The trained local industrial network attack detection model is then uploaded to a Raspberry Pi 5 device in a central server for model aggregation. Finally, the global industrial network attack detection model is returned to the edge device to complete the update, and during the industrial network attack detection process, the detection results are displayed on an LCD1602 liquid crystal display.

[0006] Edge devices are located at the edge of the network near the source of objects or data, and provide edge intelligence services nearby through a distributed open platform that integrates network, computing, storage, and application core capabilities. Edge computing is to analyze the data collected from the terminal directly in the local device or network near the data generation, without the need to transmit the data to the cloud data processing center.

[0007] The present invention adopts the following technical solutions and implementation steps:

[0008] An industrial network attack detection method based on federated graph information compression is characterized by the collection and processing of industrial data samples, the construction of a local model for industrial network attack detection based on graph information compression, the determination of an optimization target for the local industrial network attack detection model, the construction of a global model for industrial network attack detection based on graph information compression, and the detection application of industrial network attacks, including the following steps:

[0009] (1) Collection and processing of industrial data samples

[0010] ① Set up K edge devices, each edge device deploys S sensors to collect industrial time series data. The length of the collected time series data is 50, and the data set is obtained Where D k ={X k ,Y k}, X k The size is S×50, label Y k There are 10 categories, the value range of k is [0, K], and the sample size is N;

[0011] ② The collected industrial time series data X k Normalize to [0,1];

[0012] ③For the kth edge device, the node matrix is ​​V k =X k ;

[0013] ④For the kth edge device, the similarity between the i-th node and the j-th node The calculation formula is:

[0014]

[0015] in, is the value of the index t of the i-th node in the k-th edge device, is the mean of the time series data in the i-th node in the k-th edge device;

[0016] The adjacency matrix A representing the connection relationship between the i-th node and the j-th node k The calculation formula for [i,j] is:

[0017]

[0018] ⑤Get ​​the kth edge device graph structure data G k = {V k ,A k}, where V k and A k The size is 50×50;

[0019] (2) Construction of a local model for industrial network attack detection based on graph information compression

[0020] ① Construct a multi-layer perceptron to extract features. The weight of the multi-layer perceptron is W IB , the structure is that the first layer of convolution uses a convolution kernel size of 3×3, a step size of 1, a padding of 1, and a rectified linear unit activation function layer σ. The calculation formula is:

[0021] σ[z]=max(0,z), (3)

[0022] Where max(·) is the maximum value function, and z is the input of the rectified linear unit activation function layer;

[0023] The second convolution layer uses a convolution kernel size of 3×3, a stride of 1, and a padding of 1;

[0024] ②Use multi-layer perceptron to process the graph structure data G of the kth edge device separately k = {V k ,A k}, and obtain the feature graph structure data G′ k = {V′ k ,A′ k}, where V′ k is the feature node matrix, A′ k is the feature adjacency matrix;

[0025] ③Build a graph neural network, the input includes an S×50 feature node matrix V′k and a 50×50 feature adjacency matrix A′ k , with weight W G ; The first layer is the graph convolution layer, using the weight matrix The size is S×50, connected to a rectified linear unit activation function layer σ, the calculation formula is:

[0026]

[0027] Where D is a diagonal matrix, D[i,i] is the number of neighboring nodes of node i, I is the identity matrix, and σ[·] is the rectified linear unit activation function;

[0028] The second layer is the graph convolution layer, using the weight matrix The size is S×64, connected to a rectified linear unit activation function layer σ, the calculation formula is:

[0029]

[0030] in, is the output of the first graph convolutional layer;

[0031] The third layer is the graph convolution layer, using the weight matrix The size is 64×128, the output is a feature matrix of S×128, connected to a rectified linear unit activation function layer σ, the calculation formula is:

[0032]

[0033] in, is the output of the second graph convolutional layer;

[0034] The fourth layer is a fully connected layer, which maps the graph-level features to the classification space of 10 categories to obtain the predicted labels.

[0035] (3) Determination of optimization objectives of local industrial network attack detection model

[0036] ① The optimization objective of industrial network attack detection graph learning for the kth edge device is:

[0037]

[0038] Where log(·) is the logarithmic function, y c is the true label of the cth category, Predict the label for the cth class, I M (·,·) is the mutual information, expressed as:

[0039]

[0040] Among them, p(·) is the probability density function, log(·) is the logarithmic function, is the output of the first graph convolutional layer of the nth sample in the kth edge device, y n is the label of the nth sample, v k,n is the node matrix of the nth sample in the kth edge device, v′ k,n is the feature node matrix of the nth sample in the kth edge device, a k,n is the adjacency matrix of the nth sample in the kth edge device, a′ k,n is the feature adjacency matrix of the nth sample in the kth edge device;

[0041] ②The kth edge device uploads the local industrial network attack detection graph to learn the model parameters W k = {W G ,W IB} to the central server;

[0042] (4) Construction of a global model for industrial network attack detection based on graph information compression

[0043] ① The central server uploads the model weight parameter W k Aggregation is performed and the calculation formula is:

[0044]

[0045] Among them, W Global is the global weight parameter after aggregation by the central server, and K is the number of edge devices;

[0046] ②The central server sets the global weight parameter W Global Return to the 16 edge devices to complete the local model W k Update, get W k′ ;

[0047] (5) Detection and application of industrial network attacks

[0048] In edge devices, industrial network attack data is used as the input of the local industrial network attack detection model to obtain attack prediction labels and realize industrial network attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a rendering of an industrial network attack detection method based on federated graph information compression. DETAILED DESCRIPTION

[0050] Figure 1 This is a rendering of an industrial network attack detection method based on federated graph information compression. As the rounds progress, the accuracy of the detection method gradually improves.

[0051] The attack sample generates data and completes the network attack sample generation.

[0052] 1. An industrial network attack detection method based on federated graph information compression, characterized by the collection and processing of industrial data samples, the construction of a local model for industrial network attack detection based on graph information compression, the determination of the optimization target of the local industrial network attack detection model, the construction of a global model for industrial network attack detection based on graph information compression, and the detection application of industrial network attacks, including the following steps:

[0053] (1) Collection and processing of industrial data samples

[0054] ① Set up K edge devices, each edge device deploys S sensors to collect industrial time series data. The length of the collected time series data is 50, and the data set is obtained Where D k ={X k ,Y k}, X k The size is S×50, label Y k There are 10 categories, the value range of k is [0, K], and the sample size is N;

[0055] ② The collected industrial time series data X k Normalize to [0,1];

[0056] ③For the kth edge device, the node matrix is ​​V k =X k ;

[0057] ④For the kth edge device, the similarity between the i-th node and the j-th node The calculation formula is:

[0058]

[0059] in, is the value of the index t of the i-th node in the k-th edge device, is the mean of the time series data in the i-th node in the k-th edge device;

[0060] The adjacency matrix A representing the connection relationship between the i-th node and the j-th node k The calculation formula for [i,j] is:

[0061]

[0062] ⑤Get ​​the kth edge device graph structure data G k = {V k ,A k}, where V k and Ak The size is 50×50;

[0063] (2) Construction of a local model for industrial network attack detection based on graph information compression

[0064] ① Construct a multi-layer perceptron to extract features. The weight of the multi-layer perceptron is W IB , the structure is that the first layer of convolution uses a convolution kernel size of 3×3, a step size of 1, a padding of 1, and a rectified linear unit activation function layer σ. The calculation formula is:

[0065] σ[z]=max(0,z), (3)

[0066] Where max(·) is the maximum value function, and z is the input of the rectified linear unit activation function layer;

[0067] The second convolution layer uses a convolution kernel size of 3×3, a stride of 1, and a padding of 1;

[0068] ②Use multi-layer perceptron to process the graph structure data G of the kth edge device separately k = {V k ,A k}, and obtain the feature graph structure data G′ k = {V′ k ,A′ k}, where V′ k is the feature node matrix, A′ k is the feature adjacency matrix;

[0069] ③Build a graph neural network, the input includes an S×50 feature node matrix V′ k and a 50×50 feature adjacency matrix A′ k , with weight W G ; The first layer is the graph convolution layer, using the weight matrix The size is S×50, connected to a rectified linear unit activation function layer σ, the calculation formula is:

[0070]

[0071] Where D is a diagonal matrix, D[i,i] is the number of neighboring nodes of node i, I is the identity matrix, and σ[·] is the rectified linear unit activation function;

[0072] The second layer is the graph convolution layer, using the weight matrix The size is S×64, connected to a rectified linear unit activation function layer σ, the calculation formula is:

[0073]

[0074] in, is the output of the first graph convolutional layer;

[0075] The third layer is the graph convolution layer, using the weight matrix The size is 64×128, the output is a feature matrix of S×128, connected to a rectified linear unit activation function layer σ, the calculation formula is:

[0076]

[0077] in, is the output of the second graph convolutional layer;

[0078] The fourth layer is a fully connected layer, which maps the graph-level features to the classification space of 10 categories to obtain the predicted labels.

[0079] (3) Determination of optimization objectives of local industrial network attack detection model

[0080] ① The optimization objective of industrial network attack detection graph learning for the kth edge device is:

[0081]

[0082] Where log(·) is the logarithmic function, y c is the true label of the cth category, Predict the label for the cth class, I M (·,·) is the mutual information, expressed as:

[0083]

[0084] Among them, p(·) is the probability density function, log(·) is the logarithmic function, is the output of the first graph convolutional layer of the nth sample in the kth edge device, y n is the label of the nth sample, v k,n is the node matrix of the nth sample in the kth edge device, v′ k,n is the feature node matrix of the nth sample in the kth edge device, a k,n is the adjacency matrix of the nth sample in the kth edge device, a′ k,n is the feature adjacency matrix of the nth sample in the kth edge device;

[0085] ②The kth edge device uploads the local industrial network attack detection graph to learn the model parameters W k = {W G ,W IB} to the central server;

[0086] (4) Construction of a global model for industrial network attack detection based on graph information compression

[0087] ① The central server uploads the model weight parameter W k Aggregation is performed and the calculation formula is:

[0088]

[0089] Among them, W Global is the global weight parameter after aggregation by the central server, and K is the number of edge devices;

[0090] ②The central server sets the global weight parameter W Global Return to the 16 edge devices to complete the local model W k Update, get W k′ ;

[0091] (5) Detection and application of industrial network attacks

[0092] In edge devices, industrial network attack data is used as the input of the local industrial network attack detection model to obtain attack prediction labels and realize industrial network attack detection.

Claims

1. An industrial network attack detection method based on federated graph information compression, characterized in that The following steps are involved: (1) Collection and processing of industrial data samples ① Set up K edge devices, each edge device deploys S sensors to collect industrial time series data. The length of the collected time series data is 50, and the data set is obtained Where D k ={X k , Y k }, X k The size is S×50, label Y k There are 10 categories, the value range of k is [0, K], and the sample size is N; ② The collected industrial time series data X k Normalize to [0, 1]; ③For the kth edge device, the node matrix is ​​V k =X k ; ④For the kth edge device, the similarity between the i-th node and the j-th node The calculation formula is: in, is the value of the index t of the i-th node in the k-th edge device, is the mean of the time series data in the i-th node in the k-th edge device; The adjacency matrix A representing the connection relationship between the i-th node and the j-th node k The calculation formula for [i, j] is: ⑤Get ​​the kth edge device graph structure data G k = {V k , A k }, where V k and A k The size is 50×50; (2) Construction of a local model for industrial network attack detection based on graph information compression ① Construct a multi-layer perceptron to extract features. The weight of the multi-layer perceptron is W IB , the structure is that the first layer of convolution uses a convolution kernel size of 3×3, a step size of 1, a padding of 1, and a rectified linear unit activation function layer σ. The calculation formula is: σ[z]=max(0,z), (3) Where max(·) is the maximum value function, and z is the input of the rectified linear unit activation function layer; The second convolution layer uses a convolution kernel size of 3×3, a stride of 1, and a padding of 1; ②Use multi-layer perceptron to process the graph structure data G of the kth edge device separately k = {V k , A k }, and obtain the feature graph structure data G′ k = {V′ k , A′ k }, where V′ k is the feature node matrix, A′ k is the feature adjacency matrix; ③Build a graph neural network, the input includes an S×50 feature node matrix V′ k and a 50×50 feature adjacency matrix A′ k , with weight W G ; The first layer is the graph convolution layer, using the weight matrix The size is S×50, connected to a rectified linear unit activation function layer σ, the calculation formula is: Where D is a diagonal matrix, D[i, i] is the number of neighboring nodes of node i, I is the identity matrix, and σ[·] is the rectified linear unit activation function; The second layer is the graph convolution layer, using the weight matrix The size is S×64, connected to a rectified linear unit activation function layer σ, the calculation formula is: in, is the output of the first graph convolutional layer; The third layer is the graph convolution layer, using the weight matrix The size is 64×128, the output is a feature matrix of S×128, connected to a rectified linear unit activation function layer σ, the calculation formula is: in, is the output of the second graph convolutional layer; The fourth layer is a fully connected layer, which maps the graph-level features to the classification space of 10 categories to obtain the predicted labels. (3) Determination of optimization objectives of local industrial network attack detection model ① The optimization objective of industrial network attack detection graph learning for the kth edge device is: Where log(·) is the logarithmic function, y c is the true label of the cth category, Predict the label for the cth class, I M (·,·) is the mutual information, expressed as: Among them, p(·) is the probability density function, log(·) is the logarithmic function, is the output of the first graph convolutional layer of the nth sample in the kth edge device, y n is the label of the nth sample, v k，n is the node matrix of the nth sample in the kth edge device, v′ k，n is the feature node matrix of the nth sample in the kth edge device, a k，n is the adjacency matrix of the nth sample in the kth edge device, a′ k，n is the feature adjacency matrix of the nth sample in the kth edge device; ②The kth edge device uploads the local industrial network attack detection graph to learn the model parameters W k = {W G , W IB } to the central server; (4) Construction of a global model for industrial network attack detection based on graph information compression ① The central server uploads the model weight parameter W k Aggregation is performed and the calculation formula is: Among them, W Global is the global weight parameter after aggregation by the central server, and K is the number of edge devices; ②The central server sets the global weight parameter W Global Return to the 16 edge devices to complete the local model W k Update, get W k′ ; (5) Detection and application of industrial network attacks In edge devices, industrial network attack data is used as the input of the local industrial network attack detection model to obtain attack prediction labels and realize industrial network attack detection.

2. The method according to claim 1, characterized in that: The method first collects industrial data through the industrial vibration sensor device and the industrial temperature sensor device in the edge device, and transmits it to the Raspberry Pi 4B device to convert it into a graph structure to represent the data features, extract important features in the node matrix and the adjacency matrix, and train an industrial network attack detection model that compresses the local graph information. The trained local industrial network attack detection model is then uploaded to the central server for model aggregation. Finally, the global industrial network attack detection model is returned to the edge device, and the detection results are displayed on the display screen during the industrial network attack detection process.

Images