A cnn-gru industrial control network attack detection method fusing data packet and flow level features

Abstract

The application discloses a kind of CNN-GRU industrial control network attack detection methods of data packet and stream level feature fusion, method includes: based on the shunt processing and packet preprocessing of captured industrial control network flow, generate training set, the training set includes multiple data streams, each data stream includes multiple ordered data packets;Model training as follows: utilize one-dimensional convolutional neural network to each data packet is handled alone, extract data packet feature vector, utilize the context modeling of data packet feature vector in the same stream in gated recurrent unit, obtain the feature vector of intermediate hidden layer, and the feature vector of intermediate hidden layer is classified by fully connected neural network;Model inference is carried out using the trained model, and the final classification result is obtained.The application improves the accuracy and efficiency of industrial control network attack detection, thereby strengthening the security of industrial control network.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a CNN-GRU industrial control network attack detection method with data packet and flow level feature fusion. BACKGROUND

[0002] As a core component of industrial control systems, programmable logic controller (PLC) undertakes the important task of real-time control and automation of physical processes. However, as it is widely used in industrial sites and often connected to enterprise networks, PLC has become one of the main targets of network attackers. Therefore, timely sensing of abnormal network traffic, discovering and preventing network attacks, and ensuring the security of industrial control networks have become important challenges in today's network information security field.

[0003] In order to realize the perception of abnormal network, people have made many efforts, for example: rule matching based method, which identifies abnormal behavior in the network through a predefined rule set; byte feature matching based method, which uses byte level features of data packets for attack detection; CNN based deep packet detection method, which uses convolutional neural network (CNN) to extract and represent learning of byte features in data packets, and uses a classifier for attack detection; CNN-RNN based deep packet detection method, which first extracts byte features in data packets using CNN, and then segments the extracted byte features in a data packet into RNN for time series modeling, thereby further improving the accuracy; RNN based packet flow detection method, which sequentially inputs some manual features of each data packet, such as data packet sending direction, data packet byte length, etc., into a recurrent neural network (RNN), and uses RNN to model the time series of data flow to realize the detection of network attacks. However, the above methods still have some deficiencies through practical test. For the rule matching based method, it is time-consuming and costly to use, for the byte feature matching based method, it is difficult to detect attack data packets containing small attack payloads, for the CNN-RNN based deep packet detection method, it can only extract data packet level traffic features, and it is difficult to effectively detect some attack types such as fragment noise attack, resulting in incomplete network security protection, and for the RNN based packet flow detection method, it does not effectively use the byte features of data packets, and it is difficult to detect attacks with attack payloads concentrated in a small number of data packets.

[0004] In view of the deficiencies of the prior art, how to improve the accuracy and efficiency of attack detection is a problem to be solved urgently. SUMMARY

[0005] The main purpose of the present application is to overcome the shortcomings and deficiencies of the prior art, and provide a CNN-GRU industrial control network attack detection method with data packet and flow level feature fusion, which comprehensively utilizes CNN and GRU to model data packet and flow level features, improves the accuracy and efficiency of industrial control network attack detection, and thus enhances the security of industrial control network.

[0006] In order to achieve the above purpose, the present application adopts the following technical scheme:

[0007] In the first aspect, the present application provides a CNN-GRU industrial control network attack detection method with data packet and flow level feature fusion, comprising the following steps:

[0008] Based on the captured industrial control network traffic, the flow processing and packet preprocessing are performed to generate a training set; the training set includes a plurality of data flows, and each data flow includes a plurality of ordered data packets;

[0009] The training set is input into a model for training, wherein the model includes a one-dimensional convolutional neural network, a gated recurrent unit and a fully connected neural network, and the training steps include: using the one-dimensional convolutional neural network to process each data packet separately, extracting a data packet feature vector, using the gated recurrent unit to model the context of the data packet feature vectors in the same flow, obtaining a feature vector of an intermediate hidden layer, and classifying the feature vector of the intermediate hidden layer through the fully connected neural network;

[0010] The trained model is used for model inference to obtain a final classification result.

[0011] As a preferred technical scheme, the one-dimensional convolutional neural network includes two layers of one-dimensional multi-channel convolution and maximum pooling layer.

[0012] As a preferred technical scheme, the one-dimensional convolutional neural network is used to process each data packet separately to extract a data packet feature vector, specifically:

[0013] A data flow in the training set is processed, the data packets are input into the one-dimensional convolutional neural network in sequence, convolution and maximum pooling are performed by using the one-dimensional convolutional neural network, the two-dimensional features are stretched into one dimension, and a one-dimensional data packet feature vector is obtained.

[0014] As a preferred technical scheme, the gated recurrent unit is used to model the context of the data packet feature vectors in the same flow, including:

[0015] The data packet feature vector of the previous data packet is input into the gated recurrent unit for training to obtain a feature vector ht-1;

[0016] In the training of the same data stream, the packet feature vector X t of the current packet and the feature vector h t-1 are input into the gated recurrent unit to obtain the current feature vector h t.

[0017] As a preferred technical solution, if the current packet is the first packet in the data stream, the feature vector h t-1 is a special vector of all 0.

[0018] As a preferred technical solution, the classification of the feature vector of the intermediate hidden layer through the fully connected neural network comprises:

[0019] The current feature vector h t is nonlinearly transformed through the fully connected neural network to obtain a classification result vector; the classification result vector is 1*num, num representing the number of data types; the classification result vector comprises a plurality of point values, and the size of each point value represents the probability of classification.

[0020] As a preferred technical solution, the training step further comprises:

[0021] The cross-entropy loss function is used to calculate the classification loss, and the model parameters are back-propagated;

[0022] In the same data stream, each packet is processed in sequence, and other data streams are processed in the same step.

[0023] After multiple iterations until the classification loss is reduced to a minimum, a trained model is obtained.

[0024] As a preferred technical solution, the model inference using the trained model comprises:

[0025] In the same data stream, the following steps are performed:

[0026] S301, the preprocessed packet byte vector of the first packet and the special vector of all 0 are input into the trained model for inference to obtain a first classification result, and the feature vector h t of the intermediate hidden layer output by the gated recurrent unit is recorded.

[0027] S302, the preprocessed packet byte vector of the other packet and the feature vector h t of the intermediate hidden layer corresponding to the previous packet are input into the model for inference to obtain a second classification result, and the feature vector h t+1 of the intermediate hidden layer output by the gated recurrent unit is recorded.

[0028] S303, in different data streams, the following steps are performed:

[0029] Determine whether the packet is the first packet in the current data stream, if the current packet is the first packet in the current stream, execute S301, otherwise execute S302.

[0030] S304, perform Softmax calculation on all classification results to obtain a final classification result vector.

[0031] As a preferred technical solution, the shunt processing and packet preprocessing include:

[0032] Shunt processing: according to the basic attributes of the data packet, the industrial control network flow is shunted; the basic attributes of the data packet include source IP, source port, destination IP, destination port and transmission layer protocol;

[0033] Packet preprocessing: filtering network query data packets, intercepting the transmission layer payload of each data packet and discarding the remaining part, normalizing the intercepted payload, and shaping the length of the intercepted payload.

[0034] As a preferred technical solution, the generating training set includes:

[0035] The data packets after packet preprocessing are labeled with different categories by one-hot encoding, and the data packets in the same data stream are arranged in order, and the data packets of different data streams are stored separately.

[0036] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0037] (1) The present application extracts the features of the data packet by one-dimensional convolutional neural network 1D-CNN, and then models the previous data packet in the stream by gated recurrent unit GRU, so that the independent data packet features can be fused with the previous data packet information in the same stream, which can realize attack detection at the data packet granularity and effectively detect network attacks initiated by multiple independent data packets.

[0038] (2) The present application provides a more fine-grained attack detection method by detecting attacks based on data packet granularity, which improves the sensitivity and accuracy of attack detection.

[0039] (3) The present application automatically learns the features in the data set by an end-to-end neural network model without consuming a lot of time and manpower to analyze private protocols, and at the same time, the flow level features are fused in the data packet level features, which can effectively detect network attacks initiated by multiple independent data packets and improve the accuracy of attack detection. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to make the technical solutions in the embodiments of the present application clearer, the accompanying drawings needed in the embodiment description will be briefly introduced. Obviously, the accompanying drawings in the following description only constitute some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort.

[0041] Figure 1 The flow chart of the CNN-GRU industrial control network attack detection method of the embodiment of the present application fuses data packet and flow level features;

[0042] Figure 2 The model structure and its training schematic diagram of the embodiment of the present application;

[0043] Figure 3 The structure schematic diagram of the one-dimensional convolutional neural network of the embodiment of the present application;

[0044] Figure 4 The structure diagram of the gated recurrent unit of the embodiment of the present application;

[0045] Figure 5 The fully connected neural network schematic diagram of the embodiment of the present application;

[0046] Figure 6 The fragment noise padding attack schematic diagram of the embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the technical solutions in the embodiments of the present application clearer, the accompanying drawings needed in the embodiment description will be briefly introduced. Obviously, the accompanying drawings in the following description only constitute some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort.

[0048] In the present application, the phrase "embodiment" means that the specific features, structures or characteristics described in connection with the embodiment can be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor is it an independent or alternative embodiment to other embodiments. Those skilled in the art explicitly and implicitly understand that the embodiments described in the present application can be combined with other embodiments.

[0049] Embodiment 1

[0050] Please refer to Figure 1 The embodiment provides a CNN-GRU industrial control network attack detection method fusing data packet and flow level features, which comprises the following steps:

[0051] S1, perform shunting processing and packet preprocessing based on the captured industrial control network traffic to generate a training set; the training set includes a plurality of data streams, and each data stream includes a plurality of ordered data packets.

[0052] In this embodiment, first, the collected industrial control network traffic is shunted according to the basic attribute five-tuple of the data packet, where the five-tuple is (source IP, source port, destination IP, destination port, and transport layer protocol).

[0053] Secondly, the data packets are arranged in terms of redundancy and form through packet preprocessing, and the data of each data packet after processing is a two-dimensional data packet original byte vector, which is as follows:

[0054] S101, filter network query data packets, including ICMP and DNS;

[0055] S102, intercept the transport layer payload of each data packet and discard the remaining part; wherein the remaining part includes the Ethernet header, IP header, and transport layer header;

[0056] S103, normalize the intercepted payload;

[0057] S104, shape the length of the payload, truncate the payload longer than N bytes, and fill the remaining N bytes with 0.

[0058] After completing the packet preprocessing, the data is disordered and lacks clear classification indication, so the next step of this embodiment is to process different data packets and different data packet streams to generate a training set. Specifically, the following steps are included:

[0059] S105, label each preprocessed data packet with different types using one-hot encoding, and each class label represents the data type of the data packet, which is divided by each attribute in the basic attribute five-tuple. It should be noted that there are multiple data packets in the same data stream, and the types of the data packets are diverse and have a front-back dependency between the data packets;

[0060] S106, arrange the data packets in the same data stream in the order of packet sending, and store the data packets of different data streams separately.

[0061] S2, inputting the training set into the model for training, wherein the model comprises a one-dimensional convolutional neural network, a gated recurrent unit and a fully connected neural network, and the training step comprises: separately processing each data packet by using the one-dimensional convolutional neural network 1D-CNN to extract a data packet feature vector, modeling the context of the data packet feature vectors in the same flow by using the gated recurrent unit GRU to obtain a feature vector of an intermediate hidden layer, and classifying the feature vector of the intermediate hidden layer by using the fully connected neural network FFNN.

[0062] In the embodiment, the byte vector features of each data packet are separately extracted by using the one-dimensional convolutional neural network 1D-CNN, the feature vectors of the data packets at the flow level are modeled by using the gated recurrent unit GRU, finally, the output vector of the gated recurrent unit GRU is processed by using the multi-layer fully connected neural network FFNN to obtain a classification vector, and the final classification result is obtained by using a Softmax function.

[0063] Specifically, as shown in Figure 2 the process of model training is as follows:

[0064] S201, separately extracting byte vector features of each data packet: processing a data flow in the training set, sequentially inputting data packets into a one-dimensional convolutional neural network, performing convolution and maximum pooling by using the one-dimensional convolutional neural network, stretching the two-dimensional features into one dimension to obtain a one-dimensional data packet feature vector.

[0065] Further, as shown in Figure 3 the one-dimensional convolutional neural network 1D-CNN of the embodiment adopts a structure of two layers of one-dimensional multi-channel convolution and maximum pooling layer, for the data packets in the same data flow, the input data is subjected to the first layer of one-dimensional multi-channel convolution to obtain C1 output, the C1 output is subjected to the second layer of one-dimensional multi-channel convolution to obtain C2 output, the C2 output is subjected to the maximum pooling layer to obtain P1 output, and finally the two-dimensional feature vector of the P1 output is stretched into a one-dimensional vector to obtain a data packet level feature vector.

[0066] S202, modeling the feature vectors of the data packets at the flow level in the same data flow: automatically learning the dependency relationship between the data packet feature vector of each data packet and the data packets before and after it by using the model. As shown in Figure 4As shown, the gating recurrent unit has two inputs, including the feature vector ht-1 and the packet feature vector Xt of the current packet, and an output, including the current feature vector ht. In the training of the same data stream, the packet feature vector Xt of the current packet and the feature vector ht-1 are input into the gating recurrent unit to obtain the current feature vector ht; after the output is completed, the current feature vector ht is cached and waits for the input of the next packet for training. If the current packet is the first packet in the data stream, the feature vector ht-1 is a special vector of all 0.

[0067] S203, processing the output vector of the gating recurrent unit GRU: as shown, the current feature vector ht is input into the fully connected neural network to obtain a classification result vector through nonlinear transformation of the fully connected neural network. The classification result vector is 1*num, where num represents the number of data types, and has multiple nodes in the classification result vector, each node has a point value, and each point value represents the probability of classification. Figure 5

[0068] S204, using a cross-entropy loss function to calculate a classification loss, and performing back propagation on the model parameters.

[0069] S205, taking the next packet in the same data stream as input to perform S201, until the training of the packets in the data stream is completed; taking the first packet in the next data stream as input to perform S201, until the training of all data sets is completed.

[0070] S206, repeating steps S201 to S205 for N epochs until the loss loss value is reduced to a minimum to obtain the trained model weight.

[0071] S3, using the trained model to perform model inference to obtain a final classification result.

[0072] S301, for the first packet in a data stream, input the preprocessed packet byte vector and the special vector of all 0 into the trained model for inference to obtain a first classification result, and record the intermediate hidden layer vector ht output by the GRU;

[0073] S302, for a non-first packet in a data stream, input the preprocessed packet byte vector and the intermediate hidden layer vector ht output by the GRU corresponding to the previous packet into the model for inference to obtain a second classification result; and record the intermediate layer hidden vector ht+1 output by the GRU;

[0074] ​S303, if the incoming data packet is the first data packet in a data stream, execute S301, otherwise execute S302;

[0075] S304, perform Softmax calculation on all classification results to obtain the final classification result.

[0076] Embodiment 2

[0077] In this embodiment, it is particularly applied to a fragment noise filling attack. By fusing stream level features in packet level features, the fragment noise filling attack initiated by multiple independent data packets can be effectively detected.

[0078] As shown in Figure 6 , the fragment noise filling attack is a novel network attack for injecting malicious control logic into a PLC. The main idea is to divide the malicious control logic into X different data packets (fragmented), each of which contains only N bytes of malicious control logic, and the others are similar to 0000 or random noise bytes (noise). By writing data block commands, all bytes of the malicious control logic are injected into the PLC one by one. In this way, on the one hand, the injection process of the control logic looks like the exchange of normal data blocks. On the other hand, since only N bytes of the data block are transmitted in each data packet, it is difficult to detect by capturing the byte characteristics of the malicious control logic.

[0079] For the fragment noise filling attack, the embodiment adopts the following steps:

[0080] A1, the collected industrial control network traffic is divided according to the basic attribute five-tuple of the data packet;

[0081] A2, the collected data packet is preprocessed, as follows: sequentially processed according to steps S101-S103 in embodiment 1, then, data packets longer than 256 bytes are truncated, and data packets less than 256 bytes are filled with 0 until the total length is 256.

[0082] A3, each preprocessed data packet is labeled with different categories by one-hot encoding, and the settings are as follows: 0 for normal data packets, 1-M for attack type data packets, and the specific attack types are related to the training data set, such as Dos attack and scanning attack; data packets in the same data stream are arranged in the order of packet sending, and data packets of different data streams are stored separately to generate a training set.

[0083] A4, input the training set into the model for training, including: using a one-dimensional convolutional neural network 1D-CNN to process each data packet separately, extracting a data packet feature vector, using a gated recurrent unit GRU to model the context of the data packet feature vector in the same flow, obtaining a feature vector of the intermediate hidden layer, and classifying the feature vector of the intermediate hidden layer through a fully connected neural network FFNN, completing the training of the model.

[0084] A5, in one data stream, for the first data packet, input the preprocessed 256-byte vector and the special vector of all 0s of the same bit number into the trained model for inference to obtain a first classification result, and record the intermediate hidden layer vector ht output by the GRU; for other data packets, input the preprocessed 256-byte vector and the intermediate hidden layer vector ht output by the GRU corresponding to the previous data packet into the model for inference to obtain a second classification result; and record the intermediate layer hidden vector ht+1 output by the GRU.

[0085] In different data streams, it is judged whether the data packet is the first data packet in a data stream, and the step A5 of the embodiment is repeatedly executed.

[0086] A6, performing Softmax calculation on all classification results to obtain the classification result of the fragment.

[0087] It should be noted that, for the foregoing method embodiments, in order to facilitate description, they are all described as a combination of a series of actions, but those skilled in the art should know that the present application is not limited by the order of the described actions, because according to the present application, certain steps can be performed in other order or simultaneously.

[0088] The technical features of the above embodiments can be combined arbitrarily, and in order to make the description simple, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0089] The above embodiments are the preferred embodiments of the present application, but the embodiments of the present application are not limited by the above embodiments, and any changes, modifications, substitutions, combinations, simplifications made without departing from the spirit and principles of the present application are equivalent replacement methods, and are included in the protection scope of the present application.

Claims

1. A CNN-GRU industrial control network attack detection method based on the fusion of data packet and flow-level features, characterized in that, Includes the following steps: The captured industrial control network traffic is split and preprocessed to generate a training set; The generation of the training set includes: labeling the preprocessed data packets with different categories using one-hot encoding, arranging the data packets in the same data stream in order, and storing the data packets from different data streams separately. The training set includes multiple data streams, each data stream includes multiple ordered data packets, and multiple data packets exist in the same data stream. The data packets have diverse types and there is a dependency between the data packets. The training set is input into the model for training. The model includes a one-dimensional convolutional neural network, a gated recurrent unit, and a fully connected neural network. The training steps include: processing each data packet individually using the one-dimensional convolutional neural network to extract the data packet feature vector; using the gated recurrent unit to perform contextual modeling on the data packet feature vectors in the same stream to obtain the feature vectors of the intermediate hidden layers; and classifying the feature vectors of the intermediate hidden layers using the fully connected neural network. The one-dimensional convolutional neural network includes two layers of one-dimensional multi-channel convolution and a max pooling layer. Specifically, processing each data packet individually using the one-dimensional convolutional neural network to extract the data packet feature vector involves: processing a data stream in the training set, inputting the data packets into the one-dimensional convolutional neural network in sequence, and for data packets in the same data stream, passing the input data through the first layer of one-dimensional multi-channel convolution to obtain the C1 output, passing the C1 output through the second layer of one-dimensional multi-channel convolution to obtain the C2 output, passing the C2 output through the max pooling layer to obtain the P1 output, and stretching the two-dimensional feature vector of the P1 output into a one-dimensional vector to obtain the data packet-level feature vector. The trained model is used for inference to obtain the final classification result.

2. The CNN-GRU industrial control network attack detection method based on packet and flow-level feature fusion according to claim 1, characterized in that, The method of using gated loop units to perform context modeling of the feature vectors of data packets in the same stream includes: The feature vector of the previous data packet is input into the gated recurrent unit for training to obtain the feature vector ht-1; During training on the same data stream, the current data packet feature vector Xt and feature vector ht-1 are input into the gated recurrent unit to obtain the current feature vector ht.

3. The CNN-GRU industrial control network attack detection method based on the fusion of data packets and flow-level features according to claim 2, characterized in that, If the current data packet is the first data packet in the data stream, then the feature vector ht-1 is a special vector consisting entirely of zeros.

4. The CNN-GRU industrial control network attack detection method based on packet and flow-level feature fusion according to claim 2, characterized in that, The classification of feature vectors from intermediate hidden layers using a fully connected neural network includes: The current feature vector ht is nonlinearly transformed through a fully connected neural network to obtain a classification result vector; the classification result vector is 1*num, where num represents the number of data types; the classification result vector includes multiple point values, and the magnitude of each point value represents the probability of classification.

5. The CNN-GRU industrial control network attack detection method based on packet and flow-level feature fusion according to claim 1, characterized in that, The training steps also include: The classification loss is calculated using the cross-entropy loss function, and the model parameters are backpropagated. Within the same data stream, each data packet is processed sequentially, and the model is processed in the same manner for other data streams. After multiple iterations until the classification loss is minimized, a well-trained model is obtained.

6. The CNN-GRU industrial control network attack detection method based on packet and flow-level feature fusion according to claim 1, characterized in that, The process of using the trained model for model inference specifically involves: Within the same data stream, perform the following steps: S301. Input the preprocessed data packet byte vector and the special vector with all zeros into the trained model for inference, obtain the first classification result, and record the feature vector ht of the intermediate hidden layer output by the gated recurrent unit. S302. Input the preprocessed data packet byte vector of other data packets and the feature vector ht of the intermediate hidden layer corresponding to the previous data packet into the model for inference, obtain the second classification result, and record the feature vector ht+1 of the intermediate hidden layer output by the gated recurrent unit. S303. Between different data streams, perform the following steps: Determine if the data packet is the first data packet in the current data stream. If the current data packet is the first data packet in the current stream, execute S301; otherwise, execute S302. S304. Perform Softmax calculation on all classification results to obtain the final classification result vector.

7. The CNN-GRU industrial control network attack detection method based on packet and flow-level feature fusion according to claim 1, characterized in that, The packet splitting and preprocessing include: Traffic splitting: Industrial control network traffic is split according to the basic attributes of data packets; the basic attributes of the data packets include source IP, source port, destination IP, destination port, and transport layer protocol; Packet preprocessing: Filter network query packets, extract the transport layer payload of each packet and discard the remaining part, normalize the extracted payload, and reshape the length of the extracted payload.

Images