Industrial Internet of Things intrusion detection method based on deep learning

Abstract

The invention discloses an industrial Internet of Things intrusion detection method based on deep learning, and the method comprises the following steps: S1, constructing a variational automatic encoder model, and executing first-stage detection to distinguish normal network traffic and known attack behaviors; s2, calculating and collecting reconstruction errors generated by the model; s3, modeling the reconstruction error by applying an extreme value theory, and further executing a second stage to detect and identify an unknown attack; s4, for the data classified as unknown attacks, extracting related features and adding the related features into a data set for learning; and S5, continuously updating the deep learning model, and optimizing the detection architecture. According to the method, known attacks can be accurately classified, unknown attacks can be effectively deduced and recognized, and the method has the capability of continuously updating the model to adapt to a new attack mode, so that the safety and reliability of the industrial Internet of Things are improved.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet of Things security, and in particular to an industrial Internet of Things intrusion detection method based on deep learning. Background Art

[0002] The Internet of Things (IoT) is a technology that closely connects the physical world with the digital world, enabling intelligent interaction and data exchange between devices through the Internet. It refers to the interconnection of everyday devices through the Internet, enabling them to communicate and share data seamlessly. On this basis, the Industrial Internet of Things (IIoT) extends these capabilities to the industrial field, enhancing manufacturing processes, improving efficiency and enabling advanced analysis by integrating smart sensors and connected machines. IIoT involves the use of smart devices and sensors to collect data from industrial equipment and processes, which is then analyzed to optimize operations, predict maintenance needs and reduce downtime. Unfortunately, industrial equipment is often designed without modern cybersecurity measures because they focus more on functionality and lifespan rather than security, which makes them vulnerable to intrusion attacks. In addition, the openness of the IoT architecture further exacerbates this vulnerability, resulting in major security risks in IIoT.

[0003] In recent years, the application of machine learning and deep learning-based intrusion detection technology to the Industrial Internet of Things has made effective progress in solving existing security problems. First, the Intrusion Detection System (IDS) monitors and analyzes device activities to identify potential security vulnerabilities. Once an attack on a device is detected, immediate action can be taken to mitigate the threat and protect the system. Second, IDS can effectively protect the Industrial Internet of Things system from cyber attacks by providing continuous monitoring and real-time threat detection, thereby enhancing the overall security and resilience of industrial networks. However, one disadvantage of current IDS based on the Industrial Internet of Things is that all types of attacks present in the test set will also appear in the training set. This is not suitable for the current open trend of the Industrial Internet of Things, where it is likely to encounter previously unseen attacks in an open environment. In addition, traditional classifiers perform poorly in detecting previously unseen attacks and are prone to misclassifying them as known attack types, thereby increasing the incidence of misclassification. Therefore, this limitation weakens the effectiveness of IDS in an open IIoT environment, where the ability to identify new threats is crucial. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide an efficient and lightweight intrusion detection method for industrial Internet of Things devices in an industrial Internet of Things scenario.

[0005] To this end, the technical solution proposed in the present invention is an industrial Internet of Things intrusion detection method based on deep learning, comprising the following steps:

[0006] S1. Build a variational autoencoder model and perform the first stage of detection to distinguish normal network traffic from known attack behaviors;

[0007] S2. Calculate and collect the reconstruction error generated by the model;

[0008] S3. Apply extreme value theory to model the reconstruction error and further perform the second stage detection to identify unknown attacks;

[0009] S4. For data classified as unknown attacks, extract relevant features and add them to the dataset for learning;

[0010] S5.Continuously update deep learning models and optimize detection architecture.

[0011] Furthermore, in the aforementioned S1, a variational autoencoder model is established, which includes three main components: encoder, decoder and classifier. The encoder converts the input data into feature representations of the latent space, and the decoder attempts to reconstruct the original data from these feature representations. The classifier uses these feature representations to classify the input data.

[0012] Furthermore, the classifier is able to identify various patterns of normal network traffic and different characteristics of known attack behaviors, and classify them into fine-grained categories.

[0013] Furthermore, in the aforementioned S2, by calculating and collecting the reconstruction error generated by the variational autoencoder, a quantitative evaluation of the reconstruction effect of the input data is achieved. After the model encodes and decodes the input data, corresponding reconstructed data will be generated. The reconstruction error is the difference between the input data and its reconstructed data. Specifically, the following steps are included:

[0014] Step S21: Pass the input data x into the encoder part of the variational autoencoder to generate a representation z of the latent space. The encoding process can be expressed as:

[0015] z=E(x)

[0016] Where E is the encoder function.

[0017] Step S22: Input the latent space z into the decoder to generate the corresponding reconstructed data x′:

[0018] x′=D(z)

[0019] Where D is the decoder function.

[0020] Step S23: Calculate the reconstruction error by calculating the difference between the input data x and the reconstructed data x′ to obtain the reconstruction error L r :

[0021]

[0022] Where J is the number of data samples and ||·|| represents the Euclidean distance.

[0023] Furthermore, in the aforementioned S3, the extreme value theory is applied to model the reconstruction error. The extreme value theory analyzes the statistical characteristics of the reconstruction error and identifies the distribution law of outliers in the reconstruction error. By establishing an extreme value distribution model, the extreme values ​​in the reconstruction error can be captured, thereby achieving the ability to detect unknown attack behaviors. Specifically, the following steps are included:

[0024] Step S31: Establish a reconstruction error sample set L by calculating the reconstruction errors of all input samples:

[0025] L = {L1, L2, ..., L N}

[0026] Where N is the total number of samples.

[0027] Step S32: Perform statistical analysis on the reconstructed error data and calculate descriptive statistics such as the mean and standard deviation to provide a basis for the subsequent establishment of an extreme value distribution model.

[0028] Step S33: According to the distribution characteristics of the reconstruction error, the extreme value distribution model is used to fit the data, and the distribution parameters are estimated using the maximum likelihood estimation.

[0029] Step S34: by fitting the extreme value distribution model, the confidence interval of the threshold u of the reconstruction error is set to 95%, indicating that the reconstruction error above this threshold will be regarded as an extreme value.

[0030] Step S35: Detect new input data using the set threshold u:

[0031]

[0032] Among them, Y * is the predicted category label, R is the reconstruction error after sorting, K represents the known category, and U represents the unknown attack.

[0033] Furthermore, the extreme value theory performs the second stage detection and identification of unknown attacks through a threshold value. When the detected reconstruction error exceeds the threshold value, it is considered that the traffic may belong to an unknown attack.

[0034] Furthermore, in the aforementioned S4, the data classified as unknown attacks are extracted with relevant features, which are used to enhance the model's detection capability for new attacks, and are marked as unknown attacks to form a new data set. The original data set only contains normal traffic and known attack data. Specifically, the following steps are included:

[0035] Step S41: Identify data classified as unknown attacks from the detection results of the model, mark these data as Unknown, and extract relevant features for subsequent model training.

[0036] Step S42: Add the extracted unknown attack to the original data set. The original data set includes normal traffic and attack data, which is recorded as Data1.

[0037] Step S43: The new data set Data2 is composed of the original data set and the newly added unknown attack, which can be expressed as:

[0038] Data2=Data1∪Unknown

[0039] Among them, Data1 represents the original data set, and Unknown is the extracted unknown attack data.

[0040] Step S44: After forming the new data set Data2, data cleaning and preprocessing are performed, including removing duplicate samples, processing missing values, and standardizing and normalizing feature values.

[0041] Furthermore, in the aforementioned S5, continuously updating the deep learning model includes periodically collecting the latest data set and using it to train the model to capture and adapt to new unknown attack patterns. Through knowledge distillation technology, the optimized model is fine-tuned to adapt to the behavior of the original model and learn the output and feature representation of the original model. This process ensures that the optimized model maintains efficient performance and detection capabilities while being simplified. Specifically, the following steps are included:

[0042] Step S51: Use a pre-trained complex deep learning model as the original model, whose output includes logits and feature representation.

[0043] Step S52: Build a simplified optimization model, and use knowledge distillation technology to enable the model to learn the behavior of the original model. The output logits of the original model are temperature-adjusted to generate soft labels, and the formula is:

[0044]

[0045] Among them, P i represents the soft label probability of the i-th category, l iis the logits of the original model’s output for the i-th class, and T is the temperature coefficient, which is used to adjust the smoothness of the soft label.

[0046] Step S53: The optimization model learns the output distribution of the original model by minimizing the distillation loss function. The loss function formula is:

[0047]

[0048] Among them, P t (i) represents the soft label probability of the original model, P s (i) represents the predicted probability of the optimized model, and I is the number of categories.

[0049] The present invention also provides an industrial physical network intrusion detection system based on deep learning, the system includes a known attack classification module, an unknown attack identification module, and a dynamic update detection module. Among them, the known attack classification module is responsible for classifying known attack behaviors and normal network traffic, and improving the detection accuracy of known attacks through model training and updating. The unknown attack identification module uses extreme value theory and reconstruction error analysis to perform a second-stage detection on the data to identify unknown attack behaviors, and add its features to the data set for learning. The dynamic update detection module periodically updates the deep learning model by continuously collecting the latest data to ensure that the system can adapt to and detect new attack patterns and maintain efficient detection capabilities.

[0050] The present invention has the following beneficial effects: the industrial Internet of Things intrusion detection method based on deep learning proposed by the present invention can realize the intrusion detection function efficiently and lightly. The present invention provides an intrusion detection method with three modules. The known attack classification module identifies and classifies known attack behaviors, and can accurately distinguish normal network traffic from various known attack behaviors, thereby improving the detection accuracy and response speed of the system. The unknown attack identification module focuses on detecting and identifying unknown attack behaviors, and can perform in-depth analysis of outliers in the data, thereby improving the accuracy of identifying unknown attacks. The dynamic update detection module is committed to ensuring that the system can continuously adapt to changing attack patterns and maintain its efficient detection capabilities and response performance. The collaborative work of these modules enables the present invention to not only efficiently perform intrusion detection, but also provide comprehensive network security protection without increasing the computing burden, and adapt to the needs of the industrial Internet of Things environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a flowchart of the industrial physics king intrusion detection method based on deep learning;

[0052] Figure 2 This is a system structure diagram of the industrial Internet of Things intrusion detection method based on deep learning;

[0053] Figure 3 is the flow chart of the known attack classification module;

[0054] Figure 4 is the flow chart of the unknown attack identification module;

[0055] Figure 5 is a flow chart of the dynamic update detection module;

[0056] Figure 6 It is the detection and classification result of known attacks on the natural gas pipeline dataset;

[0057] Figure 7 It is the detection and recognition result of unknown attacks on the natural gas pipeline dataset. DETAILED DESCRIPTION

[0058] The technical solutions and effects of the present invention are described in detail below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0059] Embodiment 1: A method for intrusion detection of industrial Internet of Things based on deep learning, comprising the following steps:

[0060] S1. Build a variational autoencoder model and perform the first stage of detection to distinguish normal network traffic from known attack behaviors;

[0061] S2. Calculate and collect the reconstruction error generated by the model;

[0062] S3. Apply extreme value theory to model the reconstruction error and further perform the second stage detection to identify unknown attacks;

[0063] S4. For data classified as unknown attacks, extract relevant features and add them to the dataset for learning;

[0064] S5.Continuously update deep learning models and optimize detection architecture.

[0065] Furthermore, in the aforementioned S1, a variational autoencoder model is established, which includes three main components: encoder, decoder and classifier. The encoder converts the input data into feature representations of the latent space, and the decoder attempts to reconstruct the original data from these feature representations. The classifier uses these feature representations to classify the input data.

[0066] Furthermore, the classifier is able to identify various patterns of normal network traffic and different characteristics of known attack behaviors, and classify them into fine-grained categories.

[0067] Furthermore, in the aforementioned S2, by calculating and collecting the reconstruction error generated by the variational autoencoder, a quantitative evaluation of the reconstruction effect of the input data is achieved. After the model encodes and decodes the input data, corresponding reconstructed data will be generated. The reconstruction error is the difference between the input data and its reconstructed data. Specifically, the following steps are included:

[0068] Step S21: Pass the input data x into the encoder part of the variational autoencoder to generate a representation z of the latent space. The encoding process can be expressed as:

[0069] z=E(x)

[0070] Where E is the encoder function.

[0071] Step S22: Input the latent space z into the decoder to generate the corresponding reconstructed data x′:

[0072] x′=D(z)

[0073] Where D is the decoder function.

[0074] Step S23: Calculate the reconstruction error by calculating the difference between the input data x and the reconstructed data x′ to obtain the reconstruction error L r :

[0075]

[0076] Where J is the number of data samples and ||·|| represents the Euclidean distance.

[0077] Furthermore, in the aforementioned S3, the extreme value theory is applied to model the reconstruction error. The extreme value theory analyzes the statistical characteristics of the reconstruction error and identifies the distribution law of outliers in the reconstruction error. By establishing an extreme value distribution model, the extreme values ​​in the reconstruction error can be captured, thereby achieving the ability to detect unknown attack behaviors. Specifically, the following steps are included:

[0078] Step S31: Establish a reconstruction error sample set L by calculating the reconstruction errors of all input samples:

[0079] L = {L1, L2, ..., L N}

[0080] Where N is the total number of samples.

[0081] Step S32: Perform statistical analysis on the reconstructed error data and calculate descriptive statistics such as the mean and standard deviation to provide a basis for the subsequent establishment of an extreme value distribution model.

[0082] Step S33: According to the distribution characteristics of the reconstruction error, the extreme value distribution model is used to fit the data, and the distribution parameters are estimated using the maximum likelihood estimation.

[0083] Step S34: by fitting the extreme value distribution model, the confidence interval of the threshold u of the reconstruction error is set to 95%, indicating that the reconstruction error above this threshold will be regarded as an extreme value.

[0084] Step S35: Detect new input data using the set threshold u:

[0085]

[0086] Among them, Y * is the predicted category label, R is the reconstruction error after sorting, K represents the known category, and U represents the unknown attack.

[0087] Furthermore, the extreme value theory performs the second stage detection and identification of unknown attacks through a threshold value. When the detected reconstruction error exceeds the threshold value, it is considered that the traffic may belong to an unknown attack.

[0088] Furthermore, in the aforementioned S4, the data classified as unknown attacks are extracted with relevant features, which are used to enhance the model's detection capability for new attacks, and are marked as unknown attacks to form a new data set. The original data set only contains normal traffic and known attack data. Specifically, the following steps are included:

[0089] Step S41: Identify data classified as unknown attacks from the detection results of the model, mark these data as Unknown, and extract relevant features for subsequent model training.

[0090] Step S42: Add the extracted unknown attack to the original data set. The original data set includes normal traffic and attack data, which is recorded as Data1.

[0091] Step S43: The new data set Data2 is composed of the original data set and the newly added unknown attack, which can be expressed as:

[0092] Data2=Data1∪Unknown

[0093] Among them, Data1 represents the original data set, and Unknown is the extracted unknown attack data.

[0094] Step S44: After forming the new data set Data2, data cleaning and preprocessing are performed, including removing duplicate samples, processing missing values, and standardizing and normalizing feature values.

[0095] Furthermore, in the aforementioned S5, continuously updating the deep learning model includes periodically collecting the latest data set and using it to train the model to capture and adapt to new unknown attack patterns. Through knowledge distillation technology, the optimized model is fine-tuned to adapt to the behavior of the original model and learn the output and feature representation of the original model. This process ensures that the optimized model maintains efficient performance and detection capabilities while being simplified. Specifically, the following steps are included:

[0096] Step S51: Use a pre-trained complex deep learning model as the original model, whose output includes logits and feature representation.

[0097] Step S52: Build a simplified optimization model, and use knowledge distillation technology to enable the model to learn the behavior of the original model. The output logits of the original model are temperature-adjusted to generate soft labels, and the formula is:

[0098]

[0099] Among them, P i represents the soft label probability of the i-th category, l i is the logits of the original model’s output for the i-th class, and T is the temperature coefficient, which is used to adjust the smoothness of the soft label.

[0100] Step S53: The optimization model learns the output distribution of the original model by minimizing the distillation loss function. The loss function formula is:

[0101]

[0102] Among them, P t (i) represents the soft label probability of the original model, P s (i) represents the predicted probability of the optimized model, and I is the number of categories.

[0103] Embodiment 2: The present invention uses deep learning technology to propose a corresponding intrusion detection method for industrial Internet of Things scenarios. The method has the characteristics of high accuracy and strong dynamics.

[0104] Figure 1 The present invention discloses an industrial physical network intrusion detection method based on deep learning according to an embodiment of the present invention, and the method comprises the following steps:

[0105] S1. Build a variational autoencoder model and perform the first stage of detection to distinguish normal network traffic from known attack behaviors;

[0106] By building a variational autoencoder model, the model consists of three main components: encoder, decoder, and classifier. The encoder converts the input data into feature representations in the latent space, and the decoder attempts to reconstruct the original data from these feature representations. The classifier uses these feature representations to classify the input data, and can identify various patterns of normal network traffic and different features of known attack behaviors, and classify them into fine-grained categories.

[0107] S2. Calculate and collect the reconstruction error generated by the model;

[0108] By calculating and collecting the reconstruction error generated by the variational autoencoder, a quantitative evaluation of the reconstruction effect of the input data is achieved. After the model encodes and decodes the input data, the corresponding reconstructed data will be generated. The reconstruction error is the difference between the input data and its reconstructed data.

[0109] S3. Apply extreme value theory to model the reconstruction error and further perform the second stage detection to identify unknown attacks;

[0110] The extreme value theory is applied to model the reconstruction error. The extreme value theory analyzes the statistical characteristics of the reconstruction error and identifies the distribution law of outliers in the reconstruction error. By establishing an extreme value distribution model, the extreme values ​​in the reconstruction error can be captured, thereby achieving the ability to detect unknown attack behaviors.

[0111] S4. For data classified as unknown attacks, extract relevant features and add them to the dataset for learning;

[0112] The data classified as unknown attacks are used to extract relevant features. These features are used to enhance the model's detection ability for new attacks and mark them as unknown attacks. The unknown attacks are added to the dataset to form a new dataset. The original dataset only contains normal traffic and known attack data.

[0113] S5. Continuously update deep learning models and optimize detection architecture;

[0114] Continuously updating deep learning models involves periodically collecting the latest datasets and using them to train models to capture and adapt to new unknown attack patterns. Through knowledge distillation techniques, the optimized model is fine-tuned to adapt to the behavior of the original model and learn the output and feature representation of the original model.

[0115] Figure 2 The system structure diagram of the industrial Internet of Things intrusion detection method based on deep learning provided by the present invention is shown, including:

[0116] The known attack classification module classifies the input network traffic data into known attack types or normal traffic through pre-defined attack features and behavior patterns. Using the trained deep learning model, it can efficiently identify and classify various known network attacks.

[0117] The unknown attack identification module uses extreme value theory to model reconstruction errors and is used to detect and identify new attack behaviors that have never been seen in the system. By analyzing the outliers and patterns in the network traffic, it can respond in time when unknown attacks occur.

[0118] Dynamically update the detection model, regularly collect the latest network data and attack samples, and use these data to update and optimize the deep learning model. Through continuous learning and adaptation, ensure that the detection system can respond to emerging attack patterns in a timely manner.

[0119] Figure 3 A detailed flow chart of the known attack classification module provided by the present invention is shown. For the training data set, the potential feature representation of the input data is first captured by training a variational autoencoder model, including an encoder for mapping the input data to a latent space, and a decoder for reconstructing the original data from the latent space. Subsequently, these learned feature representations are used to further train a classifier, whose main function is to determine whether the input data is normal network traffic or a known attack behavior. During the operation of the classifier, if the input data is classified as normal network traffic, the system determines that the data belongs to a normal situation; conversely, if it is classified as a known attack, the system will identify and report the attack type.

[0120] Figure 4 The detailed flow chart of the unknown attack identification module provided by the present invention is shown. For the test data set, the reconstruction error is first analyzed, and the reconstruction error is modeled using extreme value theory to determine whether it exceeds the preset threshold. If the reconstruction error exceeds the threshold, it is determined to be an unknown attack; otherwise, it is classified as a known attack or normal network traffic.

[0121] Figure 5 The detailed flow chart of the dynamic update detection module provided by the present invention is shown. For the original data set, soft labels are first generated based on the original model, and then the optimized model is obtained by using the simplified original model, and the corresponding hard labels are generated. Finally, the model is further optimized and updated through the knowledge distillation method. This process aims to continuously improve the performance and robustness of the detection module to adapt to the ever-changing network security threats and attack forms.

[0122] In this method, the generation of soft labels and hard labels complement each other. Soft labels can provide more information to help optimize the training of the model, while hard labels more directly indicate the classification of the data. Through knowledge distillation, the key knowledge of the optimized model is extracted, which helps to update the model to cope with emerging security challenges while maintaining the model's efficiency.

[0123] Figure 6 The detection and classification results of the present invention on the natural gas pipeline dataset for known attacks are shown. The classification results are explained by using a confusion matrix, which is used to show the relationship between the prediction results of the classification model and the true label. In the confusion matrix, the diagonal elements represent the number of correctly classified samples, that is, the number of correct model predictions; the non-diagonal elements represent the number of incorrect model predictions. The horizontal axis represents the category predicted by the model, and the vertical axis represents the true category.

[0124] according to Figure 6 The results show that for normal network traffic (Normal), the accuracy of the model reached 98%. For known attack categories, the specific accuracy rates are: CMRI (98%), MSCI (95%), MPCI (98%), MFCI (96%) and DoS (73%). These results show that the detection and classification method proposed in this study shows good accuracy and reliability on the natural gas pipeline dataset, and can effectively distinguish different types of known attacks, providing strong support for network security protection in practical applications.

[0125] Figure 7 The present invention shows the detection and recognition results of unknown attacks on the natural gas pipeline dataset. Here, NMRI (and Recon in the dataset are regarded as unknown attack types. Figure 7 From the results, it can be observed that the recognition accuracy of unknown attacks (Unknown) reached 73%. This means that among the samples marked as unknown attacks, 73% were correctly identified. However, 27% of the samples were incorrectly classified as normal network traffic (Normal), showing that there is still room for improvement in the recognition of unknown attacks. These results reveal a certain ability of the present invention in dealing with unknown attacks, and suggest that further research and optimization may be needed in the future to enhance the accuracy of unknown attacks.

[0126] The above drawings illustrate the embodiments of the present invention in detail, but the present invention is not limited to the above embodiments. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present invention without departing from the principle and purpose of the present invention.

Claims

1. A method for intrusion detection of industrial Internet of Things based on deep learning, characterized in that: The method comprises the following steps: S1. Build a variational autoencoder model and perform the first stage of detection to distinguish normal network traffic from known attack behaviors; S2. Calculate and collect the reconstruction error generated by the model; S3. Apply extreme value theory to model the reconstruction error and further perform the second stage detection to identify unknown attacks; S4. For data classified as unknown attacks, extract relevant features and add them to the dataset for learning; S5.Continuously update deep learning models and optimize detection architecture.

2. The industrial Internet of Things intrusion detection method based on deep learning according to claim 1 is characterized in that: In S1, a variational autoencoder model is established, which includes three main components: an encoder, a decoder, and a classifier. The encoder converts input data into feature representations in a latent space, the decoder attempts to reconstruct the original data from these feature representations, and the classifier uses these feature representations to classify the input data.

3. The industrial Internet of Things intrusion detection method based on deep learning according to claim 2 is characterized in that: The classifier is able to identify various patterns of normal network traffic and different characteristics of known attack behaviors, and classify them into fine-grained categories.

4. The industrial Internet of Things intrusion detection method based on deep learning according to claim 1 is characterized in that: In S2, by calculating and collecting the reconstruction error generated by the variational autoencoder, a quantitative evaluation of the reconstruction effect of the input data is achieved. Specifically, the input data x is passed into the encoder part of the variational autoencoder to generate a representation z of the latent space. The encoding process is expressed as: z=E(x), where E is the encoder function, and then the latent space z is input into the decoder to generate the corresponding reconstructed data represented as: x′=D(z), where D is the decoder function. The calculation reconstruction error L r The formula is as follows: Among them, x i is the input data, x′ i is the reconstructed data generated by the encoder and decoder, J is the number of data samples, ||·|| represents the Euclidean distance, The process of collecting reconstruction errors is to encode and decode each batch of input data, calculate the reconstruction error of each data sample according to the formula, and accumulate and record it, so as to achieve continuous monitoring of the model reconstruction effect.

5. The industrial Internet of Things intrusion detection method based on deep learning according to claim 1 is characterized in that: In S3, the extreme value theory is applied to model the reconstruction error. The specific implementation process is: by calculating the reconstruction errors of all input samples, a reconstruction error sample set L is established, which is expressed as L = {L1, L2, ..., L N }, where N is the total number of samples, and the reconstruction error data is statistically analyzed to calculate its mean, standard deviation and other descriptive statistics to provide a basis for the subsequent establishment of the extreme value distribution model. According to the distribution characteristics of the reconstruction error, the extreme value distribution model is used to fit the data, and the maximum likelihood estimation is used to estimate the distribution parameters. The confidence interval of the reconstruction error threshold u is set to 95%, indicating that the reconstruction error will be regarded as an extreme value above this threshold. The extreme value distribution model is established to capture the extreme values ​​in the reconstruction error and make the following decisions: Among them, Y * is the predicted category label, R is the reconstruction error after sorting, u is the set threshold, K represents the known category, and U represents the unknown attack.

6. The industrial Internet of Things intrusion detection method based on deep learning according to claim 5 is characterized in that: The extreme value theory performs the second stage detection and identification of unknown attacks by setting a threshold, and determines a reasonable threshold u by analyzing the extreme value distribution of the reconstruction error. When the detected reconstruction error exceeds the threshold, it is considered that the traffic may belong to the unknown attack U.

7. The industrial Internet of Things intrusion detection method based on deep learning according to claim 1 is characterized in that: In S4, the data classified as unknown attacks are used to extract relevant features. These features are used to enhance the model's detection capability for new attacks, and they are marked as unknown attacks. The unknown attack is added to the original data set Data1 to form a new data set Data2. The original data set only contains normal traffic and known attack data. The new data set Data2 is expressed as Data2=Data1∪Unknown. After the new data set Data2 is formed, data cleaning and preprocessing operations are required.

8. The industrial Internet of Things intrusion detection method based on deep learning according to claim 1 is characterized in that: In S5, continuously updating the deep learning model includes periodically collecting the latest data sets and using them to train the model to capture and adapt to new unknown attack patterns.

9. The industrial Internet of Things intrusion detection method based on deep learning according to claim 8 is characterized in that: The optimization detection original model is realized by knowledge distillation technology. The optimization process is as follows: the optimization model adjusts its own weights and parameters by learning the behavior of the original model, especially the soft labels it outputs. The soft labels are calculated by the following formula: Among them, P i represents the soft label probability of the i-th category, l i is the logits of the original model output for the i-th class, T is the temperature coefficient, which is used to adjust the smoothness of the soft label. In the knowledge distillation process, the optimization model minimizes the knowledge distillation loss function L D To carry out training, the formula is as follows: Among them, P t (i) represents the soft label probability of the original model, P s (i) represents the prediction probability of the optimized model, and I is the number of categories. By minimizing the distillation loss, the optimized model can learn the output distribution of the original model, ensuring that while simplifying the complexity of the model, its efficient detection performance and accuracy are maintained.

10. An industrial physical network intrusion detection system based on deep learning, characterized in that: The intrusion detection system is used to implement the deep learning-based industrial Internet of Things intrusion detection method described in any one of claims 1 to 9. The detection system includes a known attack classification module, an unknown attack identification module and a dynamic update detection module, wherein the known attack classification module is responsible for classifying known attack behaviors and normal network traffic, and improving the detection accuracy of known attacks through model training and updating. The unknown attack identification module uses extreme value theory and reconstruction error analysis to perform a second stage of detection on the data to identify unknown attack behaviors and add their features to the data set for learning. The dynamic update detection module periodically updates the deep learning model by continuously collecting the latest data to ensure that the system can adapt to and detect new attack patterns and maintain efficient detection capabilities.

Images