Industrial control intrusion detection method and system based on improved triplet neural network

Abstract

The invention provides an improved triplet neural network-based industrial control intrusion detection method and system, and the method improves the convergence speed of a model and reduces the training calculation cost through constructing an improved triplet neural network model with any triple sample as input and combining a self-attention mechanism and an optimized loss function design. Real-time network flow is input into the improved triplet neural network, the distance between the improved triplet neural network and the mass center of a normal sample and the distance between the improved triplet neural network and the mass center of an abnormal sample are calculated and compared with a preset threshold value, and therefore whether intrusion behaviors exist or not is judged. The method can effectively monitor and identify the abnormal activity in the industrial network, and has high detection precision and real-time performance.

Description

Technical Field

[0001] The present invention relates to the field of machine learning technology, and in particular to an industrial control intrusion detection method and system based on an improved triplet neural network. Background Art

[0002] With the widespread adoption of Industrial Control Systems (ICS), the security of industrial networks has become an increasingly important research topic. The interconnectedness of numerous devices within industrial networks provides efficient management and control for production and operations, but it also makes these systems potential targets for cyberattacks. Industrial Intrusion Detection Systems (IDS) are a key means of ensuring industrial network security. By monitoring network traffic for abnormal behavior, they can promptly identify potential threats and prevent cyberattacks from damaging industrial systems.

[0003] Traditional intrusion detection technologies primarily rely on rule-based detection and statistical analysis. However, these methods are inflexible in complex industrial network environments, and often suffer from poor detection performance, particularly in the face of increasing numbers of unknown attacks and advanced persistent threats (APTs). In recent years, with the advancement of machine learning, intrusion detection methods based on deep learning have become a research hotspot. By learning the characteristic patterns of network traffic, they can better adapt to complex and changing industrial environments.

[0004] In the field of deep learning, the Triplet Neural Network (TN) is a common model used for metric learning, effectively handling the classification of similar and dissimilar samples. However, traditional TNs rely on fixed input formats of anchor points, positive samples, and negative samples, limiting their flexibility and adaptability when processing complex and diverse industrial network traffic. Furthermore, the model's convergence speed and computational efficiency have become bottlenecks hindering its large-scale application in industrial environments. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide an industrial control intrusion detection method and system based on an improved triplet neural network. By constructing an improved triplet neural network, it no longer relies on the fixed anchor point-positive sample-negative sample input format in the traditional triplet network, but allows any triplet sample input; calculates the distance between real-time network traffic and the centroid of normal samples and abnormal samples, and performs efficient intrusion detection, which significantly improves the efficiency and accuracy of intrusion behavior detection in industrial control systems.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: an industrial control intrusion detection method based on an improved triplet neural network, comprising the following steps:

[0007] Step S1: Collect network traffic from industrial network devices, pre-process the data, and construct a training data set;

[0008] Step S2, constructing an improved triplet neural network model;

[0009] Step S3: using the training data set to train the improved triplet neural network model until the improved triplet neural network model converges;

[0010] Step S4, respectively calculating the centroid of the output results of the improved triplet neural network for normal traffic samples and abnormal traffic samples;

[0011] Step S5: After preprocessing the real-time network traffic, input it into the improved triplet neural network to obtain the output result, and calculate the distance between the output result and the centroid of the normal sample and the centroid of the abnormal sample respectively;

[0012] Step S6: Compare the normal distance and the abnormal distance with a preset threshold to determine whether there is an intrusion.

[0013] In a preferred embodiment, step S1 specifically includes: collecting traffic logs and status monitoring data from industrial network devices, covering network protocols and industrial communication standards; using network traffic capture tools such as Wireshark, Tcpdump or dedicated traffic monitoring tools.

[0014] In a preferred embodiment, the data preprocessing in step 1 includes: 1) cleaning, removing duplicate data, irrelevant fields, and empty data; 2) feature extraction, extracting the following features based on each traffic record: network protocol, source IP, destination IP, source port, destination port, packet size, timestamp, and packet interval; 3) normalization, normalizing or standardizing the numerical features to ensure that the magnitudes of different features are the same; 4) label processing: marking normal traffic samples as positive samples and abnormal traffic samples as negative samples; dividing the cleaned and preprocessed data into a training set, a validation set, and a test set, and three random samples in the training set are used as a triplet combination sample X = {x1, x2, x3}.

[0015] In a preferred embodiment, in step S2, an improved triplet neural network model is constructed; the triplet neural network structure is designed as follows:

[0016] Input layer: receives any triplet combination sample X = {x1, x2, x3};

[0017] Three self-attention convolutional networks with the same structure: combining the convolutional neural network (CNN) and the self-attention mechanism to extract local and global network traffic features; the convolutional layer: extracts local features of the data; the self-attention mechanism: enhances the model's capture of inter-data correlations;

[0018] Output layer: fully connects the self-attention features into a low-dimensional feature space and outputs feature vectors C1, C2, and C3.

[0019] In a preferred embodiment, the improved triplet neural network loss function is:

[0020] L=max(0,M*n+w1*d(C1,C2)+w2*(C1,C3)+w3*(C2,C3)),

[0021] Where d(·,·) is the similarity, which is calculated by Euclidean distance or cosine similarity; weights w1, w2, w3 are used to distinguish between similar samples (1) and heterogeneous samples (-1); M is the minimum interval between heterogeneous samples, and n is the number of heterogeneous sample pairs in the three pairs of samples.

[0022] In a preferred embodiment, the step S3 uses the constructed data set to train the improved triplet neural network model until the model converges, and the training process includes the following steps:

[0023] Data input: Input the triplet samples in the training set into the model;

[0024] Loss function optimization: Use the Adam optimizer to train the model and gradually adjust the model parameters to minimize the loss function;

[0025] Model iteration: perform multiple rounds of training until the model converges;

[0026] The model convergence criterion is that the loss function tends to be stable and the performance on the validation set no longer improves, so the training is stopped; the early stopping mechanism is used to avoid overfitting during the training process.

[0027] In a preferred embodiment, the step S4 is to calculate the centroid of the output results of the improved triplet neural network for normal traffic samples and abnormal traffic samples respectively; the normal traffic centroid: a large number of normal traffic samples are passed through the trained neural network model to calculate the feature vector of each sample Then calculate the mean of these eigenvectors as the centroid of the normal traffic sample p :

[0028]

[0029] where N p is the number of normal traffic samples used;

[0030] The abnormal traffic centroid: a large number of abnormal traffic samples are passed through the trained neural network model to calculate the feature vector of each sample Then calculate the mean of these eigenvectors as the centroid CT of the abnormal flow sample n :

[0031]

[0032] where N n is the number of abnormal traffic samples used.

[0033] In a preferred embodiment, the step S5, after pre-processing the real-time network traffic, inputs it into the improved triplet neural network to obtain the output result, and calculates the distance between the output result and the centroid of the normal sample and the centroid of the abnormal sample respectively; specifically includes the following steps:

[0034] Real-time network traffic preprocessing: Preprocess the real-time monitored network traffic to be consistent with the training set, extract attribute features and normalize them;

[0035] Input model to obtain feature vector: Input the real-time traffic feature vector into the trained improved triplet neural network, use the first model to extract the feature vector, and output its feature vector C r ;

[0036] Calculate similarity: Similarity between real-time traffic feature vector and normal centroid: D p =d(CT p ,C r ), similarity between real-time traffic feature vector and anomaly centroid: D n =d(CT n ,C r ).

[0037] In a preferred embodiment, the step S6 compares the normal distance and the abnormal distance with a preset threshold to determine whether there is an intrusion; the threshold includes a normal threshold γ p and anomaly threshold γ n , if D p <γ p , then the traffic sample is judged to be normal; if D p >γ p or D n <γ n , then the traffic sample is determined to be an intrusion.

[0038] The present invention also provides a system for industrial control intrusion detection method based on improved triplet neural network, comprising a data acquisition module, a data preprocessing module, a model building module, a model training module and an intrusion detection module;

[0039] The data acquisition module is used to collect historical data of industrial control systems and known public data to build training data sets, while capturing real-time industrial control system network traffic;

[0040] The data preprocessing module is used for data preprocessing and attribute feature extraction;

[0041] The model building module is used to build an improved triplet neural network model;

[0042] The model training module is used to train and improve the triplet neural network model using the training data set;

[0043] The intrusion detection module is used to detect intrusion behaviors in real-time network traffic using the trained improved triplet neural network model.

[0044] Compared with the existing technology, the present invention has the following beneficial effects: the present invention allows the input of any triplet sample by designing an improved triplet neural network. This design improves the flexibility and generalization ability of the model and can better adapt to complex industrial network traffic and diverse attack modes; by introducing the category relationship weight based on sample pairs in the loss function, the model can adaptively adjust the distance between similar samples and heterogeneous samples; the present invention performs efficient intrusion detection by calculating the distance between real-time network traffic and the centroid of normal samples and abnormal samples. By presetting the threshold, the present invention can quickly and accurately judge abnormal behavior in network traffic. In addition, the model has strong robustness to the noise data commonly found in industrial networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The figure is a flow chart of an industrial control intrusion detection method based on an improved triplet neural network in a preferred embodiment of the present invention.

[0046] Figure 2 This is a structural diagram of an industrial control intrusion detection system based on an improved triplet neural network in a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0047] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0048] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present application belongs.

[0049] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form, and it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0050] like Figure 1-2 As shown, the present invention provides an industrial control intrusion detection method based on an improved triplet neural network, comprising the following steps:

[0051] S1. Collect network traffic from industrial network devices, preprocess the data, and construct a training dataset.

[0052] 1. Collect traffic logs and status monitoring data from industrial network devices (such as switches, routers, and PLCs), covering common network protocols (such as Modbus and OPC UA) and industrial communication standards. Network traffic capture tools such as Wireshark, Tcpdump, or dedicated traffic monitoring tools can be used;

[0053] 2. Remove duplicate data, irrelevant fields, and empty data; extract the following features from each traffic record: network protocol, source IP, destination IP, source port, destination port, packet size, timestamp, and packet interval; normalize or standardize numerical features (such as packet size and timestamp) to ensure that different features have the same magnitude; mark normal traffic samples as positive samples and abnormal traffic samples as negative samples;

[0054] 3. Construct a training data set including a training set, a validation set, and a test set. Three random samples in the training set are used as a triplet combination sample X = {x1, x2, x3}.

[0055] S2, construct an improved triplet neural network model;

[0056] The triplet neural network structure is designed as follows:

[0057] Input layer: Receive any triplet combination sample X = {x1, x2, x3}.

[0058] Three self-attention convolutional networks with the same structure: Combining a convolutional neural network (CNN) with a self-attention mechanism to extract local and global network traffic features. The convolutional layer extracts local features of the data; the self-attention mechanism enhances the model's ability to capture correlations between data.

[0059] Output layer: fully connects the self-attention features into a low-dimensional feature space and outputs feature vectors C1, C2, and C3.

[0060] S3. Use the constructed data set to train the improved triplet neural network model until the model converges;

[0061] Improved triplet neural network loss function:

[0062] L=max(0,M*n+w1*d(C1,C2)+w2*(C1,C3)+w3*(C2,C3)),

[0063] Where d(·,·) is the similarity, which can be calculated by Euclidean distance or cosine similarity; weights w1, w2, w3 are used to distinguish similar samples (1) from heterogeneous samples (-1); M is the minimum interval between heterogeneous samples, and n is the number of heterogeneous sample pairs in the three pairs of samples.

[0064] The training process consists of the following steps:

[0065] Data input: Input the triplet samples in the training set into the model.

[0066] Loss function optimization: The model is trained using the Adam optimizer, which gradually adjusts the model parameters to minimize the loss function.

[0067] Model iteration: Multiple rounds of training are performed until the model converges. Early stopping is used during training to avoid overfitting.

[0068] The model convergence criteria are that the loss function tends to be stable and the performance on the validation set no longer improves, so the training is stopped.

[0069] S4, respectively calculating the centroid of the output results of the improved triplet neural network for normal traffic samples and abnormal traffic samples;

[0070] Normal traffic centroid: Pass a large number of normal traffic samples through the trained neural network model to calculate the feature vector of each sample The mean of these eigenvectors is then calculated as the centroid of the normal traffic sample:

[0071]

[0072] where N p is the number of normal traffic samples used.

[0073] Abnormal traffic centroid: A large number of abnormal traffic samples are passed through the trained neural network model to calculate the feature vector of each sample Then calculate the mean of these feature vectors as the centroid of the abnormal traffic sample:

[0074]

[0075] where Nn is the number of abnormal traffic samples used.

[0076] S5. After preprocessing the real-time network traffic, the improved triplet neural network is input to obtain the output result, and the distance between the output result and the centroid of the normal sample and the centroid of the abnormal sample is calculated respectively;

[0077] The network traffic monitored in real time is preprocessed in the same way as the training set, and attribute features are extracted and normalized.

[0078] Input the real-time traffic feature vector into the trained improved triplet neural network, use the first model to extract the feature vector, and output its feature vector C r .

[0079] Calculate the similarity between the real-time traffic feature vector and the normal centroid: D p =d(CT p ,C r ), similarity between real-time traffic feature vector and anomaly centroid: D n =d(CT n ,C r ).

[0080] S6. Compare the normal distance and the abnormal distance with a preset threshold to determine whether there is an intrusion.

[0081] Thresholds include normal threshold γ p and anomaly threshold γ n , if D p <γ p , then the traffic sample is judged to be normal; if D p >γ p or D n <γ n , then the traffic sample is determined to be an intrusion.

[0082] like Figure 2 As shown, the present invention provides an industrial control intrusion detection system based on an improved triplet neural network, comprising a data acquisition module, a data preprocessing module, a model building module, a model training module and an intrusion detection module;

[0083] The data acquisition module is used to collect historical data of industrial control systems and known public data to build training data sets, while capturing real-time industrial control system network traffic;

[0084] The data preprocessing module is used for data preprocessing and attribute feature extraction;

[0085] The model building module is used to build an improved triplet neural network model;

[0086] The model training module is used to train and improve the triplet neural network model using the training data set;

[0087] The intrusion detection module is used to detect intrusion behaviors in real-time network traffic using the trained improved triplet neural network model.

[0088] The above description is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, various modifications and variations of the present application are possible. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. An industrial control intrusion detection method based on improved triplet neural network, characterized in that: The following steps are involved: Step S1, collecting network traffic from industrial network devices, preprocessing the data, and constructing a training data set; Step S2, constructing an improved triplet neural network model; Step S3, using the training data set to train the improved triplet neural network model until the improved triplet neural network model converges; Step S4, respectively calculating the centroid of the output results of the improved triplet neural network for normal traffic samples and abnormal traffic samples; Step S5, after preprocessing the real-time network traffic, input it into the improved triplet neural network to obtain the output result, and calculate the distance between the output result and the centroid of the normal sample and the centroid of the abnormal sample respectively; Step S6: Compare the normal distance and the abnormal distance with a preset threshold to determine whether there is an intrusion.

2. According to claim 1, an industrial control intrusion detection method based on an improved triplet neural network is characterized in that: The step S1 specifically includes: collecting traffic logs and status monitoring data from industrial network devices, covering network protocols and industrial communication standards; using network traffic capture tools such as Wireshark, Tcpdump or dedicated traffic monitoring tools.

3. According to claim 1, an industrial control intrusion detection method based on an improved triplet neural network is characterized in that: The data preprocessing in step 1 includes: 1) cleaning, removing duplicate data, irrelevant fields, and empty data; 2) feature extraction, extracting the following features based on each flow record: network protocol, source IP, destination IP, source port, destination port, packet size, timestamp, and packet interval; 3) normalization, normalizing or standardizing the numerical features to ensure that the magnitudes of different features are the same; 4) label processing: marking normal traffic samples as positive samples and abnormal traffic samples as negative samples; dividing the cleaned and preprocessed data into a training set, a validation set, and a test set, and three random samples in the training set are used as a triplet combination sample X={x1,x2,x3}.

4. The industrial control intrusion detection method based on improved triplet neural network according to claim 1 is characterized in that: In step S2, an improved triplet neural network model is constructed; the triplet neural network structure is designed as follows: Input layer: receives any triplet combination sample X = {x1, x2, x3}; Three self-attention convolutional networks with the same structure: combining convolutional neural network (CNN) and self-attention mechanism to extract local and global network traffic features; convolutional layer: extract local features of data; self-attention mechanism: enhance the model's capture of correlation between data; Output layer: fully connect the self-attention features to a low-dimensional feature space and output feature vectors C1, C2, C3.

5. The industrial control intrusion detection method based on improved triplet neural network according to claim 1 is characterized in that: Improved triplet neural network loss function: L=max(0,M*n+w1*d(C1,C2)+w2*(C1,C3)+w3*(C2,C3)), Where d(·,·) is the similarity, which is calculated by Euclidean distance or cosine similarity; weights w1, w2, w3 are used to distinguish between similar samples (1) and heterogeneous samples (-1); M is the minimum interval between heterogeneous samples, and n is the number of heterogeneous sample pairs in the three pairs of samples.

6. The industrial control intrusion detection method based on improved triplet neural network according to claim 1 is characterized in that: The step S3 uses the constructed data set to train the improved triplet neural network model until the model converges, and the training process includes the following steps: Data input: Input the triple samples in the training set into the model; Loss function optimization: Use the Adam optimizer to train the model and gradually adjust the model parameters to minimize the loss function; Model iteration: perform multiple rounds of training until the model converges; The model convergence criterion is that the loss function tends to be stable and the performance on the validation set no longer improves, then the training is stopped; during the training process, an early stopping mechanism is used to avoid overfitting.

7. The industrial control intrusion detection method based on improved triplet neural network according to claim 1 is characterized in that: The step S4 is to respectively calculate the centroid of the output results of the improved triplet neural network for normal traffic samples and abnormal traffic samples; The normal traffic centroid: a large number of normal traffic samples are passed through the trained neural network model to calculate the feature vector of each sample Then calculate the mean of these feature vectors as the centroid of the normal traffic sample p : Where N p is the number of normal traffic samples used; The abnormal traffic centroid: a large number of abnormal traffic samples are passed through the trained neural network model to calculate the feature vector of each sample Then calculate the mean of these feature vectors as the centroid CT of the abnormal flow sample n : Where N n is the number of abnormal traffic samples used.

8. The industrial control intrusion detection method based on improved triplet neural network according to claim 3 is characterized in that: In step S5, after preprocessing the real-time network traffic, the improved triplet neural network is input to obtain the output result, and the distance between the output result and the centroid of the normal sample and the centroid of the abnormal sample is calculated respectively; The specific steps include: Real-time network traffic preprocessing: preprocess the real-time monitored network traffic in accordance with the training set, extract attribute features and normalize them; Input the model to obtain the feature vector: Input the real-time traffic feature vector into the trained improved triplet neural network, use the first model to extract the feature vector, and output its feature vector C r ; Calculate similarity: Similarity between real-time traffic feature vector and normal centroid: D p =d(CT p ,C r ), the similarity between the real-time traffic feature vector and the anomaly centroid: D n =d(CT n ,C r ).

9. The industrial control intrusion detection method based on improved triplet neural network according to claim 1 is characterized in that: In step S6, the normal distance and the abnormal distance are compared with a preset threshold to determine whether there is an intrusion behavior; the threshold includes a normal threshold γ p and the anomaly threshold γ n , if D p <γ p , then the traffic sample is judged to be normal; if D p >γ p or D n <γ n , then the traffic sample is judged as an intrusion.

10. A system for implementing an industrial control intrusion detection method based on an improved triplet neural network as described in any one of claims 1 to 9, comprising a data acquisition module, a data preprocessing module, a model building module, a model training module and an intrusion detection module; The data acquisition module is used to collect historical data of industrial control systems and known public data to build training data sets, while capturing real-time industrial control system network traffic; The data preprocessing module is used for data preprocessing and attribute feature extraction; The model building module is used to build an improved triplet neural network model; The model training module is used to train the improved triplet neural network model using the training data set; the intrusion detection module is used to detect intrusion behaviors in real-time network traffic using the trained improved triplet neural network model.

Images