An Industrial Control System Intrusion Detection Method and System Based on Improved Triple Neural Network

Abstract

This invention provides an industrial control system intrusion detection method and system based on an improved triplet neural network. The method constructs an improved triplet neural network model that takes arbitrary triplet samples as input, and combines a self-attention mechanism with an optimized loss function design to improve the model's convergence speed and reduce training computation costs. This invention inputs real-time network traffic into the improved triplet neural network, calculates the distance between its centroid and the centroids of normal and abnormal samples, and compares this distance with a preset threshold to determine whether intrusion behavior exists. This invention can effectively monitor and identify abnormal activities in industrial networks, exhibiting high detection accuracy and real-time performance.

Description

Technical Field

[0001] This invention relates to the field of machine learning technology, and in particular to an industrial control system intrusion detection method and system based on an improved triplet neural network. Background Technology

[0002] With the widespread application of Industrial Control Systems (ICS), the security of industrial networks has become an increasingly important research topic. The interconnectivity of numerous devices in industrial networks provides efficient management and control for production and operations, but it also makes these systems potential targets for cyberattacks. Industrial Intrusion Detection Systems (IDS) are a key means of ensuring industrial network security. By monitoring abnormal behavior in network traffic, they promptly detect potential threats and prevent cyberattacks from damaging industrial systems.

[0003] Traditional intrusion detection techniques primarily rely on rule-based detection and statistical analysis methods. However, these methods are not flexible enough for complex industrial network environments, especially when facing increasingly numerous unknown attacks and advanced persistent threats (APTs), where their detection performance is often poor. In recent years, with the development of machine learning technology, deep learning-based intrusion detection methods have gradually become a research hotspot. By learning the characteristic patterns of network traffic, they can better adapt to complex and ever-changing industrial environments.

[0004] In the field of deep learning, the Triplet Neural Network is a common model used for metric learning, effectively handling the classification of similar and dissimilar samples. However, traditional Triplet Neural Networks rely on fixed anchor points and input formats of positive and negative samples, limiting their flexibility and adaptability when dealing with complex and diverse industrial network traffic. Furthermore, the model's convergence speed and computational efficiency are bottlenecks restricting its large-scale application in industrial environments. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide an industrial control system intrusion detection method and system based on an improved triplet neural network. By constructing an improved triplet neural network, it no longer relies on the fixed anchor point-positive sample-negative sample input format of the traditional triplet network, but allows arbitrary triplet sample input; it calculates the distance between the centroids of real-time network traffic and normal and abnormal samples, and performs efficient intrusion detection, which significantly improves the efficiency and accuracy of intrusion behavior detection in industrial control systems.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: an industrial control system intrusion detection method based on an improved triplet neural network, comprising the following steps:

[0007] Step S1: Collect network traffic from industrial network devices, preprocess the data, and construct a training dataset;

[0008] Step S2: Construct an improved triplets neural network model;

[0009] Step S3: Train the improved triplets neural network model using the training dataset until the improved triplets neural network model converges.

[0010] Step S4: Calculate the centroids of the output results of the improved triplet neural network for normal flow samples and abnormal flow samples respectively;

[0011] Step S5: After preprocessing the real-time network traffic, input it into the improved triplet neural network to obtain the output results, and calculate the distance between it and the centroid of normal samples and the centroid of abnormal samples respectively.

[0012] Step S6: Compare the normal distance and abnormal distance with the preset threshold to determine whether there is an intrusion.

[0013] In a preferred embodiment, step S1 specifically includes: collecting traffic logs and status monitoring data from industrial network devices, covering network protocols and industrial communication standards; and using network traffic capture tools such as Wireshark, Tcpdump, or dedicated traffic monitoring tools.

[0014] In a preferred embodiment, the data preprocessing in step 1 includes: 1) cleaning, removing duplicate data, irrelevant fields, and empty data; 2) feature extraction, extracting the following features for each traffic record: network protocol, source IP, destination IP, source port, destination port, packet size, timestamp, and packet interval; 3) normalization, normalizing or standardizing the numerical features to ensure that different features have the same magnitude; 4) labeling: labeling normal traffic samples as positive samples and abnormal traffic samples as negative samples; the cleaned and preprocessed data is divided into a training set, a validation set, and a test set, and three random samples in the training set are combined as triplets X = {x1, x2, x3}.

[0015] In a preferred embodiment, in step S2, an improved triplets neural network model is constructed; the triplets neural network structure is designed as follows:

[0016] Input layer: Receives any triplets combination sample X = {x1, x2, x3};

[0017] Three self-attention convolutional networks with the same structure: combining convolutional neural networks (CNNs) and self-attention mechanisms to extract local and global network traffic features; convolutional layers: extracting local features of the data; self-attention mechanism: enhancing the model's ability to capture correlations between data.

[0018] Output layer: Connects all self-attention features to a low-dimensional feature space and outputs feature vectors C1, C2, C3.

[0019] In a preferred embodiment, the improved loss function for the triplets neural network is:

[0020] L=max(0,M*n+w1*d(C1,C2)+w2*(C1,C3)+w3*(C2,C3)),

[0021] Where d(·,·) is the similarity, calculated by Euclidean distance or cosine similarity; weights w1, w2, w3 are used to distinguish between samples of the same class (1) and samples of different classes (-1); M is the minimum interval between samples of different classes, and n is the number of pairs of samples of different classes in the three pairs of samples.

[0022] In a preferred embodiment, step S3 involves training the improved triplets neural network model using a constructed dataset until the model converges. The training process includes the following steps:

[0023] Data input: Input the triplet samples from the training set into the model;

[0024] Loss function optimization: The model is trained using the Adam optimizer, and the model parameters are gradually adjusted to minimize the loss function;

[0025] Model iteration: Perform multiple rounds of training until the model converges;

[0026] The model converges when the loss function becomes stable and the performance on the validation set no longer improves, at which point training stops; an early stopping mechanism is used during training to avoid overfitting.

[0027] In a preferred embodiment, step S4 involves calculating the centroids of the output results of the improved triplet neural network for normal traffic samples and abnormal traffic samples, respectively; the normal traffic centroid is calculated by passing a large number of normal traffic samples through the trained neural network model to calculate the feature vector of each sample. Then, the mean of these eigenvectors is calculated as the centroid of the normal traffic sample. p :

[0028]

[0029] Where N p The number of normal traffic samples used;

[0030] The centroid of abnormal traffic: A large number of abnormal traffic samples are processed through a trained neural network model to calculate the feature vector of each sample. Then, the mean of these eigenvectors is calculated as the centroid CT of the abnormal flow samples. n :

[0031]

[0032] Where N n The number of abnormal traffic samples used.

[0033] In a preferred embodiment, step S5 involves preprocessing the real-time network traffic, inputting it into the improved triplet neural network to obtain the output result, and calculating the distance between the output result and the centroids of normal and abnormal samples, respectively; specifically, it includes the following steps:

[0034] Real-time network traffic preprocessing: Perform preprocessing on the real-time monitored network traffic in the same way as the training set, extract attribute features and normalize them;

[0035] Input Model to Obtain Feature Vector: The real-time traffic feature vector is input into the trained improved triplet neural network. The first model is used to extract the feature vector, and the feature vector C is output. r ;

[0036] Calculate similarity: Similarity between real-time traffic feature vector and normal centroid: D p =d(CT) p C r ), Similarity between real-time traffic feature vector and outlier centroid: D n =d(CT) n C r ).

[0037] In a preferred embodiment, step S6 involves comparing the normal distance and the abnormal distance with a preset threshold to determine whether intrusion behavior exists; the threshold includes a normal threshold γ. p and abnormal threshold γ n If D p <γ p If D p >γ p Or D n <γ n If so, the traffic sample is identified as an intrusion.

[0038] The present invention also provides a system for an industrial control system intrusion detection method based on an improved triplet neural network, including a data acquisition module, a data preprocessing module, a model building module, a model training module, and an intrusion detection module;

[0039] The data acquisition module is used to collect historical data and known public data from the industrial control system to build a training dataset, while capturing real-time network traffic of the industrial control system.

[0040] The data preprocessing module is used for data preprocessing and attribute feature extraction;

[0041] The model building module is used to build an improved triplets neural network model;

[0042] The model training module is used to train the improved triplets neural network model using the training dataset;

[0043] The intrusion detection module is used to detect intrusion behavior in real-time network traffic using a trained improved triplet neural network model.

[0044] Compared with existing technologies, this invention has the following advantages: By designing an improved triplet neural network, this invention allows for arbitrary triplet sample inputs, enhancing the model's flexibility and generalization ability, enabling it to better adapt to complex industrial network traffic and diverse attack patterns. By introducing class relationship weights based on sample pairs into the loss function, the model can adaptively adjust the distance between similar and dissimilar samples. This invention performs efficient intrusion detection by calculating the distance between the centroids of real-time network traffic and normal and abnormal samples. With a preset threshold, this invention can quickly and accurately identify abnormal behavior in network traffic. Furthermore, the model exhibits strong robustness to common noise data in industrial networks. Attached Figure Description

[0045] Figure 1 This is a flowchart of an industrial control system intrusion detection method based on an improved triplet neural network, according to a preferred embodiment of the present invention.

[0046] Figure 2 This is a structural diagram of an industrial control intrusion detection system based on an improved triplet neural network, according to a preferred embodiment of the present invention. Detailed Implementation

[0047] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0048] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0049] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations according to this application; as used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise; furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0050] like Figure 1-2 As shown, this invention provides an industrial control system intrusion detection method based on an improved triplet neural network, comprising the following steps:

[0051] S1. Collect network traffic from industrial network devices, preprocess the data, and construct a training dataset;

[0052] 1. Collect traffic logs and status monitoring data from industrial network devices (such as switches, routers, PLCs, etc.), covering common network protocols (such as Modbus, OPC UA, etc.) and industrial communication standards. Network traffic capture tools can be such as Wireshark, Tcpdump or dedicated traffic monitoring tools.

[0053] 2. Remove duplicate data, irrelevant fields, and empty data; extract the following features for each traffic record: network protocol, source IP, destination IP, source port, destination port, packet size, timestamp, and packet interval; normalize or standardize the numerical features (such as packet size, timestamp, etc.) to ensure that different features are of the same magnitude; mark normal traffic samples as positive samples and abnormal traffic samples as negative samples.

[0054] 3. Construct the training dataset, which includes a training set, a validation set, and a test set. Three random samples in the training set are combined into a triplets sample X = {x1, x2, x3}.

[0055] S2. Construct an improved neural network model for triplets;

[0056] The neural network structure design for the triplets is as follows:

[0057] Input layer: Receives any triplets combination sample X = {x1, x2, x3}.

[0058] Three self-attention convolutional networks with the same structure: combining convolutional neural networks (CNNs) and self-attention mechanisms to extract local and global network traffic features. Convolutional layers: extract local features of the data; self-attention mechanism: enhance the model's ability to capture correlations between data.

[0059] Output layer: Connects all self-attention features to a low-dimensional feature space and outputs feature vectors C1, C2, C3.

[0060] S3. Use the constructed dataset to train and improve the triplets neural network model until the model converges.

[0061] Improved loss function for triplets neural networks:

[0062] L=max(0,M*n+w1*d(C1,C2)+w2*(C1,C3)+w3*(C2,C3)),

[0063] Where d(·,·) is the similarity, which can be calculated using Euclidean distance or cosine similarity; weights w1, w2, w3 are used to distinguish between samples of the same class (1) and samples of different classes (-1); M is the minimum interval between samples of different classes, and n is the number of pairs of samples of different classes in the three pairs of samples.

[0064] The training process includes the following steps:

[0065] Data input: Input the triplet samples from the training set into the model.

[0066] Loss function optimization: The model is trained using the Adam optimizer, and the model parameters are gradually adjusted to minimize the loss function.

[0067] Model iteration: Multiple rounds of training are performed until the model converges. Overfitting is avoided during training through an early stopping mechanism.

[0068] The model converges when the loss function becomes stationary and the performance on the validation set no longer improves, at which point training stops.

[0069] S4. Calculate the centroids of the output results of the improved triplet neural network for normal flow samples and abnormal flow samples respectively;

[0070] Normal traffic centroid: By passing a large number of normal traffic samples through a trained neural network model, the feature vector of each sample is calculated. Then, the mean of these eigenvectors is calculated as the centroid of the normal traffic sample:

[0071]

[0072] Where N p This represents the number of normal traffic samples used.

[0073] Anomaly traffic centroid: A large number of anomaly traffic samples are processed through a trained neural network model to calculate the feature vector of each sample. Then, the mean of these eigenvectors is calculated as the centroid of the abnormal traffic samples:

[0074]

[0075] Where Nn The number of abnormal traffic samples used.

[0076] S5. After preprocessing the real-time network traffic, input it into the improved triplet neural network to obtain the output results, and calculate the distance between it and the centroid of normal samples and the centroid of abnormal samples respectively.

[0077] The network traffic monitored in real time is preprocessed in the same way as the training set, and attribute features are extracted and normalized.

[0078] The real-time traffic feature vector is input into the trained improved triplet neural network. The first model is used to extract the feature vector, and the feature vector C is output. r .

[0079] Calculate the similarity between the real-time traffic feature vector and the normal centroid: D p =d(CT) p C r ), Similarity between real-time traffic feature vector and outlier centroid: D n =d(CT) n C r ).

[0080] S6. Compare the normal distance and abnormal distance with the preset threshold to determine whether there is an intrusion.

[0081] Thresholds include the normal threshold γ p and abnormal threshold γ n If D p <γ p If D p >γ p Or D n <γ n If so, the traffic sample is identified as an intrusion.

[0082] like Figure 2 As shown, the present invention provides an industrial control intrusion detection system based on an improved triplet neural network, including a data acquisition module, a data preprocessing module, a model building module, a model training module, and an intrusion detection module;

[0083] The data acquisition module is used to collect historical data and known public data from the industrial control system to build a training dataset, while capturing real-time network traffic of the industrial control system.

[0084] The data preprocessing module is used for data preprocessing and attribute feature extraction;

[0085] The model building module is used to build an improved triplets neural network model;

[0086] The model training module is used to train the improved triplets neural network model using the training dataset;

[0087] The intrusion detection module is used to detect intrusion behavior in real-time network traffic using a trained improved triplet neural network model.

[0088] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An industrial control system intrusion detection method based on an improved triplets neural network, characterized in that, It includes the following steps: Step S1: Collect network traffic from industrial network devices, preprocess the data, and construct a training dataset; Step S2: Construct an improved triplets neural network model; Step S3: Train the improved triplets neural network model using the training dataset until the improved triplets neural network model converges. Step S4: Calculate the centroids of the output results of the improved triplet neural network for normal flow samples and abnormal flow samples respectively; Step S5: After preprocessing the real-time network traffic, input it into the improved triplet neural network to obtain the output results, and calculate the distance between it and the centroid of normal samples and the centroid of abnormal samples respectively. Step S6: Compare the normal distance and abnormal distance with the preset threshold to determine whether there is any intrusion behavior; In step S2, an improved triplets neural network model is constructed; the triplets neural network structure is designed as follows: Input layer: Receives any combination of triplets X = {x1, x2, x3}; Three self-attention convolutional networks with the same structure: combining convolutional neural networks (CNNs) and self-attention mechanisms to extract local and global network traffic features; convolutional layers: extracting local features of the data; self-attention mechanism: enhancing the model's ability to capture correlations between data. Output layer: Connects all self-attention features to a low-dimensional feature space and outputs feature vectors C1, C2, C3; Improved loss function for triplets neural networks: L=max(0,M*n+w1*d(C1,C2)+w2*(C1,C3)+w3*(C2,C3)), Where d(·,·) is the Euclidean distance, and the weights w1, w2, w3 are used to distinguish between samples of the same class (1) and samples of different classes (-1); M is the minimum margin between outlier samples, and n is the number of outlier sample pairs in the three pairs of samples; In step S4, the centroids of the output results of the improved triplet neural network for normal flow samples and abnormal flow samples are calculated respectively. The centroid of normal traffic is calculated by passing a large number of normal traffic samples through a trained neural network model, and then calculating the feature vector of each sample. Then, the mean of these eigenvectors is calculated as the centroid of the normal traffic sample. p : Where N p The number of normal traffic samples used; The centroid of abnormal traffic: A large number of abnormal traffic samples are processed through a trained neural network model to calculate the feature vector of each sample. Then, the mean of these eigenvectors is calculated as the centroid CT of the abnormal flow samples. n : Where N n The number of abnormal traffic samples used.

2. The industrial control system intrusion detection method based on an improved triplets neural network according to claim 1, characterized in that, Step S1 specifically includes: collecting traffic logs and status monitoring data from industrial network devices, covering network protocols and industrial communication standards; using network traffic capture tools such as Wireshark, Tcpdump, or dedicated traffic monitoring tools.

3. The industrial control system intrusion detection method based on an improved triplets neural network according to claim 1, characterized in that, The data preprocessing in step 1 includes: 1) cleaning, removing duplicate data, irrelevant fields, and empty data; 2) feature extraction, extracting the following features for each traffic record: network protocol, source IP, destination IP, source port, destination port, packet size, timestamp, and packet interval; 3) normalization, normalizing or standardizing the numerical features to ensure that different features are of the same magnitude; 4) labeling: labeling normal traffic samples as positive samples and abnormal traffic samples as negative samples; the cleaned and preprocessed data is divided into a training set, a validation set, and a test set, and three random samples in the training set are combined as triplets X = {x1, x2, x3}.

4. The industrial control system intrusion detection method based on an improved triplets neural network according to claim 1, characterized in that, Step S3 involves training the improved triplets neural network model using the constructed dataset until the model converges. The training process includes the following steps: Data input: Input the triplet samples from the training set into the model; Loss function optimization: The model is trained using the Adam optimizer, and the model parameters are gradually adjusted to minimize the loss function; Model iteration: Perform multiple rounds of training until the model converges; The model converges when the loss function becomes stable and the performance on the validation set no longer improves, at which point training stops; an early stopping mechanism is used during training to avoid overfitting.

5. The industrial control system intrusion detection method based on an improved triplets neural network according to claim 3, characterized in that, In step S5, the real-time network traffic is preprocessed and then input into the improved triplet neural network to obtain the output result, and the distance between the output result and the centroid of the normal sample and the centroid of the abnormal sample are calculated respectively. Specifically, the following steps are included: Real-time network traffic preprocessing: Perform preprocessing on the real-time monitored network traffic in the same way as the training set, extract attribute features and normalize them; Input Model to Obtain Feature Vector: The real-time traffic feature vector is input into the trained improved triplet neural network. The first model is used to extract the feature vector, and the feature vector C is output. r ; Calculate similarity: Similarity between real-time traffic feature vector and normal centroid: D p =d(CT) p C r ), Similarity between real-time traffic feature vector and outlier centroid: D n =d(CT) n C r ).

6. The industrial control system intrusion detection method based on an improved triplets neural network according to claim 1, characterized in that, In step S6, the normal distance and abnormal distance are compared with a preset threshold to determine whether intrusion behavior exists; the threshold includes the normal threshold γ. p and abnormal threshold γ n If D p <γ p If D p >γ p Or D n <γ n If so, the traffic sample is identified as an intrusion.

7. A system for implementing an industrial control system intrusion detection method based on an improved triplet neural network as described in any one of claims 1-6, comprising a data acquisition module, a data preprocessing module, a model building module, a model training module, and an intrusion detection module; The data acquisition module is used to collect historical data and known public data from the industrial control system to build a training dataset, while capturing real-time network traffic of the industrial control system. The data preprocessing module is used for data preprocessing and attribute feature extraction; The model building module is used to build an improved triplets neural network model; The model training module is used to train the improved triplets neural network model using the training dataset; The intrusion detection module is used to detect intrusion behavior in real-time network traffic using a trained improved triplet neural network model.

Images