CNN-GRU industrial control network attack detection method based on data packet and flow level feature fusion

Abstract

The invention discloses a CNN-GRU industrial control network attack detection method based on data packet and flow level feature fusion, and the method comprises the steps: carrying out the shunting processing and packet preprocessing based on the captured industrial control network flow, and generating a training set which comprises a plurality of data streams, and each data stream comprises a plurality of ordered data packets; the model training comprises the following steps of: independently processing each data packet by utilizing a one-dimensional convolutional neural network, extracting a data packet feature vector, performing context modeling on the data packet feature vector in the same stream by utilizing a gating circulation unit, obtaining a feature vector of a middle hidden layer, and performing data packet feature vector modeling; classifying the feature vectors of the middle hidden layer through a full-connection neural network; and performing model reasoning by using the trained model to obtain a final classification result. According to the invention, the accuracy and efficiency of industrial control network attack detection are improved, so that the security of the industrial control network is enhanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a CNN-GRU industrial control network attack detection method integrating data packet and flow-level features. Background Art

[0002] Programmable logic controllers (PLCs), as core components of industrial control systems, undertake the important task of real-time control and automation of physical processes. However, due to its widespread use in industrial sites and its frequent connection to enterprise networks, PLCs have become one of the main targets of cyber attackers. Therefore, timely sensing of abnormal network traffic, discovery and prevention of network attacks, and ensuring the security of industrial control networks have become important challenges in today's network information security field.

[0003] In order to realize the perception of abnormal networks, people have made many efforts to this end, such as: rule-based matching methods, which use predefined rule sets to identify abnormal behaviors in the network; byte-level features of data packets are used for attack detection based on byte feature matching methods; CNN-based deep packet detection methods, which use convolutional neural networks (CNN) to extract and represent byte features in data packets, and use classifiers to detect attacks; CNN-RNN-based deep packet detection methods, which first use CNN to extract byte features in data packets, and then send the byte features extracted from a data packet into RNN for time series modeling, thereby further improving the accuracy; RNN-based packet flow detection methods, which input certain manual features of each data packet, such as the direction of data packet transmission, the byte length of data packets, etc., into the recurrent neural network (RNN) in turn, and use RNN to perform time series modeling on the data stream to achieve the detection of network attacks. However, the above methods still have some shortcomings through practical tests. For the rule-based matching method, it is time-consuming and costly to use. For the byte feature matching method, it is difficult to detect attack data packets containing smaller attack payloads. For the CNN-RNN based deep packet detection method, only packet-level traffic features can be extracted. It is difficult to effectively detect certain attack types such as fragmentation noise attacks, resulting in incomplete network security protection. For the RNN based packet flow detection method, the byte features of the data packets are not effectively utilized, and it is difficult to detect attacks where the attack payload is concentrated in a small number of data packets.

[0004] In view of the shortcomings of existing technologies, it can be seen that how to improve the accuracy and efficiency of attack detection is an urgent problem to be solved. Summary of the invention

[0005] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art and to provide a CNN-GRU industrial control network attack detection method that integrates data packet and flow-level features. By comprehensively utilizing CNN and GRU to model data packet and flow-level features, the accuracy and efficiency of industrial control network attack detection are improved, thereby enhancing the security of the industrial control network.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions: In a first aspect, the present invention provides a CNN-GRU industrial control network attack detection method integrating data packet and flow-level features, comprising the following steps: Based on the captured industrial control network traffic, traffic diversion and packet preprocessing are performed to generate a training set; the training set includes multiple data streams, each of which includes multiple ordered data packets; The training set is input into the model for training, wherein the model includes a one-dimensional convolutional neural network, a gated recurrent unit, and a fully connected neural network, and the training steps include: using the one-dimensional convolutional neural network to process each data packet separately, extracting a data packet feature vector, using the gated recurrent unit to perform context modeling on the data packet feature vectors in the same flow, obtaining a feature vector of an intermediate hidden layer, and classifying the feature vector of the intermediate hidden layer through a fully connected neural network; Use the trained model to perform model inference and obtain the final classification results.

[0007] As a preferred technical solution, the one-dimensional convolutional neural network includes two layers of one-dimensional multi-channel convolution and maximum pooling layers.

[0008] As a preferred technical solution, the one-dimensional convolutional neural network is used to process each data packet separately and extract the data packet feature vector, specifically: Process a data stream in the training set, input the data packets into the one-dimensional convolutional neural network in sequence, use the one-dimensional convolutional neural network to perform convolution and maximum pooling, stretch the two-dimensional features into one dimension, and obtain a one-dimensional data packet feature vector.

[0009] As a preferred technical solution, the method of using a gated recurrent unit to perform context modeling on feature vectors of data packets in the same stream includes: Input the data packet feature vector of the previous data packet into the gated recurrent unit for training to obtain the feature vector ht-1; In the training of the same data stream, the data packet feature vector Xt and the feature vector ht-1 of the current data packet are input into the gated recurrent unit to obtain the current feature vector ht.

[0010] As a preferred technical solution, if the current data packet is the first data packet in the data stream, the characteristic vector ht-1 is a special vector of all zeros.

[0011] As a preferred technical solution, the classification of the feature vectors of the intermediate hidden layer by a fully connected neural network includes: The current feature vector ht is nonlinearly transformed through a fully connected neural network to obtain a classification result vector; the classification result vector is 1*num, num represents the number of data types; the classification result vector includes multiple point values, and the size of each point value represents the probability of classification.

[0012] As a preferred technical solution, the training step further includes: The cross entropy loss function is used to calculate the classification loss and the model parameters are back-propagated; In the same data stream, each data packet is processed in order, and the model is processed in the same steps for other data streams; After multiple iterations, the classification loss is reduced to a minimum and the trained model is obtained.

[0013] As a preferred technical solution, the use of a trained model for model reasoning is specifically as follows: In the same data flow, perform the following steps: S301, input the data packet byte vector and the special vector of all 0s preprocessed by the first data packet into the trained model for inference, obtain the first classification result, and record the feature vector ht of the middle hidden layer output by the gated recurrent unit; S302, inputting the byte vectors of the data packets preprocessed by other data packets and the feature vector ht of the middle hidden layer corresponding to the previous data packet into the model for inference, obtaining the second classification result, and recording the feature vector ht+1 of the middle hidden layer output by the gated recurrent unit; S303, between different data streams, perform the following steps: Determine whether the data packet is the first data packet of the current data flow, if the current data packet is the first data packet of the current flow, execute S301, otherwise execute S302; S304: Perform Softmax calculation on all classification results to obtain the final classification result vector.

[0014] As a preferred technical solution, the flow separation process and packet preprocessing include: Diversion processing: Divert the industrial control network traffic according to the basic attributes of the data packet; the basic attributes of the data packet include source IP, source port, destination IP, destination port and transport layer protocol; Packet preprocessing: Filter network query packets, intercept the transport layer payload of each packet and discard the rest, normalize the intercepted payload, and shape the intercepted payload length.

[0015] As a preferred technical solution, generating a training set includes: The pre-processed data packets are labeled with different categories using one-hot encoding, and the data packets in the same data stream are arranged in order, and the data packets in different data streams are stored separately.

[0016] Compared with the prior art, the present invention has the following advantages and beneficial effects: (1) The present invention extracts packet-level features through a one-dimensional convolutional neural network (1D-CNN), and then models the preceding packets of the packet in the stream through a gated recurrent unit (GRU), so that the features of independent packets can be integrated into the information of preceding packets in the same stream, thereby realizing attack detection at the packet granularity and effectively detecting network attacks initiated by multiple independent packets.

[0017] (2) The present invention aims at the situation that attackers often evade detection by mixing some normal flows in network attacks on industrial control systems. By performing attack detection based on the granularity of data packets, a more fine-grained attack detection method is provided, thereby improving the sensitivity and accuracy of attack detection.

[0018] (3) The present invention uses an end-to-end neural network model to automatically learn the features in the data set without spending a lot of time and manpower on analyzing private protocols. At the same time, it integrates flow-level features into packet-level features, which can effectively detect network attacks initiated by multiple independent data packets, thereby improving the accuracy of attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 It is a flow chart of the CNN-GRU industrial control network attack detection method integrating data packet and flow-level features according to an embodiment of the present invention; Figure 2 A schematic diagram of the model structure and its training in an embodiment of the present invention; Figure 3 Schematic diagram of the structure of a one-dimensional convolutional neural network according to an embodiment of the present invention; Figure 4is a structural diagram of a gated recurrent unit according to an embodiment of the present invention; Figure 5 A schematic diagram of a fully connected neural network according to an embodiment of the present invention; Figure 6 Schematic diagram of a fragment noise filling attack according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0022] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0023] Example 1 See also Figure 1 This embodiment provides a CNN-GRU industrial control network attack detection method that integrates data packet and flow-level features, including the following steps: S1. Performing flow diversion processing and packet preprocessing based on captured industrial control network traffic to generate a training set; the training set includes multiple data streams, and each data stream includes multiple ordered data packets.

[0024] In this embodiment, first, the collected industrial control network traffic is diverted according to the basic attribute quintuple of the data packet, where the quintuple is (source IP, source port, destination IP, destination port, transport layer protocol).

[0025] Secondly, the data packets are sorted out in redundancy and form through packet preprocessing. After processing, the data of each data packet is a two-dimensional data packet original byte vector, as follows: S101, filter network query packets, including ICMP and DNS; S102, intercepting the transport layer payload of each data packet and discarding the remaining portion, wherein the remaining portion includes an Ethernet header, an IP header, and a transport layer header; S103, normalizing the intercepted payload; S104: The payload is truncated to shape its length, and any portion longer than N bytes is truncated, and any portion less than N bytes is padded with 0s until the total length reaches N.

[0026] After completing the packet preprocessing, these data are messy and lack clear classification instructions, so the present embodiment needs to process different data packets and different data packet flows separately to generate a training set. Specifically, the following steps are included: S105. Use unique hot coding to label each preprocessed data packet with different types of labels. Each category label represents the data type of the data packet. The data type is divided by each attribute in the basic attribute quintuple. It should be noted that there are multiple data packets in the same data stream, and the types of data packets are diverse and there is a dependency between the data packets. S106: Arrange the data packets in the same data stream according to the packet sending order, and store the data packets of different data streams separately.

[0027] S2. Input the training set into the model for training, wherein the model includes a one-dimensional convolutional neural network, a gated recurrent unit, and a fully connected neural network. The training steps include: using a one-dimensional convolutional neural network 1D-CNN to process each data packet separately, extracting the data packet feature vector, using a gated recurrent unit GRU to perform context modeling on the data packet feature vectors in the same stream, obtaining the feature vector of the middle hidden layer, and classifying the feature vector of the middle hidden layer through a fully connected neural network FFNN.

[0028] In this embodiment, the byte vector features of each data packet are extracted separately by using a one-dimensional convolutional neural network 1D-CNN, and then the feature vectors of each data packet level in the same data stream are modeled at the flow level by using a gated recurrent unit GRU. Finally, the output vector of the gated recurrent unit GRU is processed by a multi-layer fully connected neural network FFNN to obtain a classification vector, and the final classification result is obtained by using the Softmax function.

[0029] Specifically, if Figure 2 As shown in the figure, the model training process is as follows: S201. Extract the byte vector features of each data packet separately: process a data stream in the training set, input the data packets into a one-dimensional convolutional neural network in sequence, use the one-dimensional convolutional neural network to perform convolution and maximum pooling, stretch the two-dimensional features into one dimension, and obtain a one-dimensional data packet feature vector.

[0030] Furthermore, if Figure 3As shown, the one-dimensional convolutional neural network 1D-CNN of this embodiment adopts the structure of two layers of one-dimensional multi-channel convolution and maximum pooling layer. For the data packets in the same data stream, the input data is subjected to the first layer of one-dimensional multi-channel convolution to obtain the C1 output, the C1 output is subjected to the second layer of one-dimensional multi-channel convolution to obtain the C2 output, the C2 output is subjected to the maximum pooling layer to obtain the P1 output, and finally the two-bit feature vector of the P1 output is pulled into a one-dimensional vector to obtain the feature vector at the data packet level.

[0031] S202, perform flow-level modeling on the feature vectors of each data packet level in the same data stream: use the model to automatically learn the dependency relationship between the feature vector of each data packet and its preceding and following data packets. Figure 4 As shown, the gated recurrent unit has two inputs, including the feature vector ht-1 and the packet feature vector Xt of the current packet, and one output, including the current feature vector ht. In the training of the same data stream, the packet feature vector Xt and the feature vector ht-1 of the current packet are input into the gated recurrent unit to obtain the current feature vector ht; after the output is completed, the current feature vector ht is cached and waits for the input training of the next packet. If the current packet is the first packet in the data stream, the feature vector ht-1 is a special vector of all 0s.

[0032] S203, processing the output vector of the gated recurrent unit GRU: Figure 5 As shown, the current feature vector ht is input into the fully connected neural network, and the classification result vector is obtained by performing nonlinear transformation through the fully connected neural network. The classification result vector is 1*num, where num represents the number of data types. There are multiple nodes in the classification result vector, each node has a point value, and each point value represents the probability of classification.

[0033] S204. Use the cross entropy loss function to calculate the classification loss and perform back propagation on the model parameters.

[0034] S205, take the next data packet in the same data stream as input and execute step S201 until the data packets in the data stream are trained; take the first data packet in the next data stream as input and execute step S201 until all data sets are trained.

[0035] S206. Repeat steps S201 to S205 for N epochs until the loss value is reduced to the minimum, and obtain the trained model weights.

[0036] S3. Use the trained model to perform model inference and obtain the final classification result.

[0037] S301, for the first data packet in a data stream, input the pre-processed data packet byte vector and the special vector of all 0s into the trained model for inference, obtain the first classification result, and record the intermediate hidden layer vector ht output by the GRU; S302, for a non-first data packet in a data stream, input the pre-processed data packet byte vector and the intermediate hidden layer vector ht output by the GRU corresponding to the previous data packet into the model for inference to obtain a second classification result; and simultaneously record the intermediate hidden layer vector ht+1 output by the GRU; S303, depending on whether the incoming data packet is the first data packet in a data stream, if the current data packet is the first data packet of the current stream, execute S301, otherwise execute S302; S304: Perform Softmax calculation on all classification results to obtain the final classification result.

[0038] Example 2 In this embodiment, it is particularly applied to fragment noise filling attacks. By integrating flow-level features into packet-level features, fragment noise filling attacks initiated by multiple independent data packets can be effectively detected.

[0039] like Figure 6 As shown in the figure, the fragment noise filling attack is a novel network attack that injects malicious control logic into the PLC. The main idea is to divide the malicious control logic into X different data packets (fragmented), each of which contains only N bytes of the malicious control logic, and the rest are similar to 0000 or random noise bytes (noise). Through the write data block command, all the bytes of the malicious control logic are injected into the PLC one by one. On the one hand, this makes the injection process of the control logic look like the exchange of normal data blocks. On the other hand, since the N bytes transmitted to the data block in each data packet are too few, it is difficult to detect by capturing the byte characteristics of the malicious control logic.

[0040] To combat the fragment noise filling attack, this embodiment adopts the following steps: A1. Divide the collected industrial control network traffic according to the five-tuple of basic attributes of the data packet; A2. The collected data packets are preprocessed as follows: the steps S101-S103 in Example 1 are sequentially processed, and then the data packets longer than 256 bytes are truncated, and the data packets less than 256 bytes are padded with 0 at the end until the total length is 256.

[0041] A3. Use one-hot encoding to label each preprocessed data packet with different categories, as follows: 0 is a normal data packet, 1~M are attack type data packets, and the specific attack type is related to the training data set, such as DoS attack and scanning attack; arrange the data packets in the same data stream in the order of packet sending, and store the data packets of different data streams separately to generate a training set.

[0042] A4. Input the training set into the model for training, including: using a one-dimensional convolutional neural network 1D-CNN to process each data packet separately, extracting the data packet feature vector, using a gated recurrent unit GRU to perform context modeling on the data packet feature vectors in the same stream, obtaining the feature vector of the middle hidden layer, and classifying the feature vector of the middle hidden layer through a fully connected neural network FFNN to complete the training of the model.

[0043] A5. In a data stream, for the first data packet, the preprocessed 256-byte vector and the special vector of all 0s with the same number of bits are input into the trained model for inference to obtain the first classification result, and the intermediate hidden layer vector ht output by GRU is recorded; for other data packets, the preprocessed 256-byte vector and the intermediate hidden layer vector ht output by GRU corresponding to the previous data packet are input into the model for inference to obtain the second classification result; at the same time, the intermediate hidden vector ht+1 output by GRU is recorded; In different data streams, it is determined whether the data packet is the first data packet in a data stream, and step A5 of this embodiment is repeatedly executed.

[0044] A6. Perform Softmax calculation on all classification results to obtain the classification results of the fragments.

[0045] It should be noted that, for the sake of convenience, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited to the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously.

[0046] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0047] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A CNN-GRU industrial control network attack detection method based on data packet and flow-level feature fusion, characterized in that: The steps include: Based on the captured industrial control network traffic, traffic diversion and packet preprocessing are performed to generate a training set; the training set includes multiple data streams, each of which includes multiple ordered data packets; The training set is input into the model for training, wherein the model includes a one-dimensional convolutional neural network, a gated recurrent unit, and a fully connected neural network, and the training steps include: using the one-dimensional convolutional neural network to process each data packet separately, extracting a data packet feature vector, using the gated recurrent unit to perform context modeling on the data packet feature vectors in the same flow, obtaining a feature vector of an intermediate hidden layer, and classifying the feature vector of the intermediate hidden layer through a fully connected neural network; Use the trained model to perform model inference and obtain the final classification results.

2. The CNN-GRU industrial control network attack detection method based on data packet and flow-level feature fusion according to claim 1 is characterized in that: The one-dimensional convolutional neural network includes two layers of one-dimensional multi-channel convolution and a maximum pooling layer.

3. The CNN-GRU industrial control network attack detection method based on data packet and flow-level feature fusion according to claim 2 is characterized in that: The one-dimensional convolutional neural network is used to process each data packet separately and extract the data packet feature vector, specifically: Process a data stream in the training set, input the data packets into the one-dimensional convolutional neural network in sequence, use the one-dimensional convolutional neural network to perform convolution and maximum pooling, stretch the two-dimensional features into one dimension, and obtain a one-dimensional data packet feature vector.

4. The CNN-GRU industrial control network attack detection method based on data packet and flow-level feature fusion according to claim 1 is characterized in that: The method of using a gated recurrent unit to perform context modeling on feature vectors of data packets in the same flow includes: Input the data packet feature vector of the previous data packet into the gated recurrent unit for training to obtain the feature vector ht-1; In the training of the same data stream, the data packet feature vector Xt and the feature vector ht-1 of the current data packet are input into the gated recurrent unit to obtain the current feature vector ht.

5. The CNN-GRU industrial control network attack detection method based on data packet and flow-level feature fusion according to claim 4 is characterized in that: If the current data packet is the first data packet in the data stream, the characteristic vector ht-1 is a special vector of all 0s.

6. The CNN-GRU industrial control network attack detection method based on data packet and flow-level feature fusion according to claim 4 is characterized in that: The method of classifying the feature vectors of the intermediate hidden layer by using a fully connected neural network includes: The current feature vector ht is nonlinearly transformed through a fully connected neural network to obtain a classification result vector; the classification result vector is 1*num, num represents the number of data types; the classification result vector includes multiple point values, and the size of each point value represents the probability of classification.

7. The CNN-GRU industrial control network attack detection method based on data packet and flow-level feature fusion according to claim 1 is characterized in that: The training step further includes: The cross entropy loss function is used to calculate the classification loss and the model parameters are back-propagated; In the same data stream, each data packet is processed in order, and the model is processed in the same steps for other data streams; After multiple iterations, the classification loss is reduced to a minimum and the trained model is obtained.

8. The CNN-GRU industrial control network attack detection method based on data packet and flow-level feature fusion according to claim 1 is characterized in that: The model reasoning using the trained model is specifically as follows: In the same data flow, perform the following steps: S301, input the data packet byte vector and the special vector of all 0s preprocessed by the first data packet into the trained model for inference, obtain the first classification result, and record the feature vector ht of the middle hidden layer output by the gated recurrent unit; S302, inputting the byte vectors of the data packets preprocessed by other data packets and the feature vector ht of the middle hidden layer corresponding to the previous data packet into the model for inference, obtaining the second classification result, and recording the feature vector ht+1 of the middle hidden layer output by the gated recurrent unit; S303, between different data streams, perform the following steps: Determine whether the data packet is the first data packet of the current data flow, if the current data packet is the first data packet of the current flow, execute S301, otherwise execute S302; S304: Perform Softmax calculation on all classification results to obtain the final classification result vector.

9. The CNN-GRU industrial control network attack detection method based on data packet and flow-level feature fusion according to claim 1 is characterized in that: The diversion processing and packet preprocessing include: Diversion processing: Divert the industrial control network traffic according to the basic attributes of the data packet; the basic attributes of the data packet include source IP, source port, destination IP, destination port and transport layer protocol; Packet preprocessing: Filter network query packets, intercept the transport layer payload of each packet and discard the rest, normalize the intercepted payload, and shape the intercepted payload length.

10. The CNN-GRU industrial control network attack detection method based on data packet and flow-level feature fusion according to claim 1 is characterized in that: Generating a training set comprises: The pre-processed data packets are labeled with different categories using one-hot encoding, and the data packets in the same data stream are arranged in order, and the data packets in different data streams are stored separately.

Images