Graph attention network-based interpretable industrial control intrusion detection method

Abstract

The invention provides an interpretable industrial control intrusion detection method based on a graph attention network. The invention relates to the field of industrial control system safety. The invention provides a spatio-temporal feature extraction model combining a graph attention network and a gating loop unit, aiming at the problem that the existing intrusion detection model has insufficient relevance among capture sensors. Secondly, for the problem that graph structure updating in the graph attention network lacks continuity, a graph structure learning process capable of being continuously updated is provided; then, a composite discriminator combining a threshold value and approximate entropy is provided to filter false alarms caused by noise, and the detection performance is further improved. And finally, providing a method based on aggregated neighbor abnormal scores to improve the interpretability of the model. Test results show that the method provided by the invention improves the precision of industrial control intrusion detection, and provides good anomaly interpretability at the same time.

Description

Technical Field

[0001] The present invention belongs to the field of industrial control system security, and specifically relates to an explainable industrial control intrusion detection method based on a graph attention network, which can effectively deal with intrusion problems in industrial control systems. Background Art

[0002] With the advancement of a new wave of industrial revolution, the rapid development of information and communication technology has promoted the deep integration of industrialization and informatization, thereby accelerating the transformation of industrial control systems to networking, informatization and intelligence. Although the transformation of industrial control systems has significantly improved the production efficiency of enterprises, it has also brought challenges to information security. In particular, the impact of this transformation is particularly obvious for large-scale industrial control systems. In order to monitor the operating status of the system, large-scale industrial control systems usually deploy a large number of high-precision, high-frequency sampling sensors, and there is a lot of noise in the deployment environment, which means that it not only needs to process a large amount of complex nonlinear related data, but also ensure the efficiency and stability of the system operation. Given the importance of large-scale industrial control systems to critical infrastructure, any operational failure may cause significant economic losses and social security issues.

[0003] Based on the above problems, the implementation of high-precision and easy-to-interpret intrusion detection algorithms has become a key measure to ensure the safe and stable operation of large-scale industrial control systems, so as to timely identify and locate the source of anomalies and support engineers to quickly respond to network security threats. It is a necessary strategy for large-scale industrial control systems to cope with network security challenges. At present, deep learning-based methods are widely used in the field of multivariate time series data intrusion detection in complex scenarios due to their powerful learning ability, which can learn high-dimensional sensor data and effectively capture the temporal characteristics of data. Specifically, the existing methods can be divided into three categories: based on recurrent neural networks, based on graph neural networks, and based on spatiotemporal fusion models. These methods each have their own advantages and limitations: the intrusion detection model based on recurrent neural networks can predict the future behavior of the system by learning the time series characteristics of high-dimensional sensor data. However, in actual industrial systems, the relationship between sensors is complex and nonlinearly interconnected. Such methods focus entirely on the extraction of time information and ignore the correlation in multivariate time series, resulting in poor detection results. The graph neural network-based method explicitly learns the association between sensor nodes through the learning process of the graph structure, and uses the learned graph structure to locate anomalies and find intrusion devices. However, such methods lack the process of modeling each dimension along the time series. Models based on spatiotemporal fusion can extract spatiotemporal features, but the structure of most models is complex, and the mutual interference between devices introduces noise, which increases the false alarm rate of the model.

[0004] In summary, the main challenge of current intrusion detection research is to design a model for the relationship between system sensors, while reducing the impact of environmental noise on intrusion detection accuracy and providing the ability to explain anomalies, thereby improving the application of intrusion detection technology in actual industrial control scenarios. Summary of the invention

[0005] In large-scale industrial control systems, due to the mutual influence and interference between a large number of sensors deployed, the accuracy of existing industrial control intrusion detection methods has decreased, and the lack of explainability of anomalies has caused many deep learning-based detection methods to be unable to be applied to actual scenarios. Therefore, it is necessary to study methods that can fully extract the spatiotemporal features of sensor data and provide explainability of anomalies.

[0006] In view of the fact that the existing intrusion detection models in large-scale industrial control systems fail to fully extract the spatiotemporal features of sensor data, and the model lacks the interpretability of anomalies, the present invention proposes an interpretable intrusion detection algorithm based on a graph attention network. Firstly, in view of the problem that the existing intrusion detection models are insufficient in capturing the correlation between sensors, the present invention proposes a spatiotemporal feature extraction model combining a graph attention network and a gated recurrent unit; secondly, in view of the lack of continuity in graph structure updates in the graph attention network, the present invention proposes a graph structure learning process that can be continuously updated; then, the present invention proposes a composite discriminator that combines thresholds and approximate entropy to filter false alarms caused by noise, further improving the detection performance; finally, the present invention proposes a method based on aggregated neighbor anomaly scores to improve the interpretability of the model.

[0007] The present invention proposes an explainable industrial control intrusion detection method based on a graph attention network, which comprises the following steps: improving the graph attention network, compound anomaly judgment based on threshold and entropy, and an anomaly interpretation method of aggregating neighbor anomaly scores.

[0008] The steps to improve the graph attention network are as follows: Since the performance of the graph attention network depends largely on the structure of the graph, in some cases, if the graph structure is not accurate enough or there is noise, the attention mechanism may aggravate the impact of these structural problems, thereby reducing the detection performance of the model. The present invention proposes a method for continuously updating the graph structure to maintain the continuity of the graph structure learning process and reduce the introduction of noise nodes. The basic principle is that each round of graph structure update is performed under the constraints of the previous round of graph structure, maintaining the continuity of graph structure learning. And by setting a threshold to screen neighbor nodes with higher correlation, the introduction of redundant neighbor nodes is reduced, while also streamlining the graph structure and reducing the complexity of calculation. First, set the similarity loss function Used to constrain the difference between the graph structure of the previous round and the graph structure of the current round, similarity constraint L simIt is used to minimize the gap between the two matrices. During the training process, M is dynamically adjusted by minimizing this loss function, so that the final generated graph structure reaches the optimal one. Next, neighbor nodes are selected through the threshold strategy to generate the adjacency matrix A representing the graph structure. A threshold ε is set. The calculation process of the adjacency matrix A is as follows: It means that only when the similarity between two nodes is greater than or equal to this threshold, there will be a connection between them. By combining local similarity constraints and threshold-based node neighbor selection, the noise nodes introduced by the discontinuity of graph structure learning can be reduced. This method can more accurately reflect the interactions and dependencies between sensors in time series data, thereby improving the performance of intrusion detection.

[0009] The steps of composite anomaly judgment based on threshold and entropy are as follows: In a complex industrial environment, due to the presence of a large amount of noise and interference, simply relying on the threshold to judge whether the data sequence is invaded may result in a high false alarm rate. In order to effectively solve this problem, the present invention proposes a two-stage anomaly discrimination strategy, including a threshold-based discriminator and an entropy-based discriminator, to enhance the recognition ability of intrusion situations and reduce false alarms. First, a threshold is set to determine whether it is higher than the threshold. When the error exceeds the threshold, it means that an abnormal situation that may be caused by intrusion is detected. By setting a parameter θ as the threshold in the intrusion detection algorithm, if the anomaly score exceeds the threshold, the time t is placed in the filter window, and then further judgment is made based on the approximate entropy of the sequence in the filter window. Then the approximate entropy in the filter window is calculated, and the size of the approximate entropy is judged and compared with the entropy threshold τ. Among them, τ is set to the average value of the approximate entropy of the corresponding error sequence in the data that generates false positives during the model training process. Finally, the time t when the intrusion is determined and the number of the sensor whose approximate entropy exceeds the threshold are recorded.

[0010] The steps of the anomaly explanation method of aggregated neighbor anomaly scores are as follows: In order to allow engineers to quickly locate and maintain specific abnormal devices when the model detects an anomaly, it is necessary to explain the anomalies detected in the system. It is mainly divided into two steps: First, make a preliminary judgment and make a preliminary diagnosis of the sensor with the largest current anomaly score. If the sensor is not the root cause of the anomaly, further analysis is required. Then calculate the aggregated neighbor anomaly scores of all sensors, find the neighbor sensors of a certain sensor through the adjacency matrix A learned by GAT, and further weight the anomaly scores of the direct neighbors of sensor i according to the size of the correlation. Among them, R i (t) is the anomaly score after aggregating the one-hop neighbors of sensor i. N(i) represents the neighbor nodes related to sensor i, which is obtained through the neighbor matrix learned by GAT, that is, N(i) = {j|A ij =1},αij is the attention coefficient learned in GAT, which represents the influence of node j on i. By weighting the abnormal scores of neighboring nodes with the attention coefficient, we can further measure the influence of abnormal scores of nodes with different association degrees on the current node. Finally, according to the abnormal score R i (t) Sort all sensors and obtain the abnormal sorting table A s (t). The sensors in the sorting table are arranged according to the size of the anomaly score, that is, the sensors with high anomaly scores are at the front. This is because if the anomaly score of a sensor's neighbor node is higher, then the probability of an anomaly in this sensor is greater.

[0011] The positive effects of the present invention are:

[0012] 1. By using a continuous graph structure learning process, the problem that the graph attention network may introduce noise nodes during the training process is solved.

[0013] 2. Using the approximate entropy filtering method, the system anomalies caused by noise are eliminated, which reduces the false alarm rate of the system, improves the accuracy of intrusion detection, and thus reduces the losses caused by factory shutdowns.

[0014] 3. The anomaly is located by using the interpretation method of aggregated neighbor anomaly scores, which reduces the work of manual anomaly investigation and improves the production efficiency of the factory. The method proposed in the present invention was compared with other intrusion detection methods of graph attention networks for many times. The results show that the present invention can perform intrusion detection and anomaly location in large industrial control systems with high noise, and ensure good intrusion detection accuracy, which proves the effectiveness of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a structural diagram of the intrusion detection model based on the improved graph attention network of the present invention.

[0016] Figure 2 It is a schematic diagram of the abnormal interpretation process involved in the present invention. DETAILED DESCRIPTION

[0017] The present invention mainly aims at the problem that the existing intrusion detection model in large-scale industrial control systems fails to fully extract the spatiotemporal characteristics of sensor data, and the model lacks the interpretability of anomalies, and proposes an interpretable intrusion detection algorithm based on a graph attention network. The present invention is further described below in conjunction with the accompanying drawings.

[0018] like Figure 1As shown, in stage 1, the present invention preprocesses the data set. Since there are large differences between the data value ranges of different feature attributes in the intrusion detection data set, in order to construct data that is convenient for subsequent intrusion detection model processing, the original data is normalized. At the same time, in order to construct a data set suitable for spatiotemporal series prediction, a sliding window is used for data sampling, and the training data set and the test data set are processed into multivariate time series data.

[0019] like Figure 1 As shown, in stage 2, the spatial features of sensor data are extracted mainly through the improved graph attention network method proposed in the present invention, and the temporal features are extracted in combination with the gated recurrent unit. In industrial control environments, there is often correlation between devices. Graph neural networks are a method commonly used to obtain correlation between devices. However, existing research based on graph neural networks still has room for optimization. Therefore, in this stage, the limitations of the graph attention network are first explained; then how to improve it is described in detail; at the same time, a prediction network based on the improved GAT combined with the gated recurrent unit is proposed to realize the extraction of spatiotemporal features of sensor data and the prediction of sensor values.

[0020] like Figure 1 As shown, in stage 3, the present invention mainly judges and locates the anomaly. Since there is noise in the industrial control environment, the noise will also cause anomalies in the equipment data, resulting in a higher false alarm rate of the algorithm. Therefore, in this stage, the present invention proposes a composite discriminator based on threshold and approximate entropy. Its discrimination strategy is to first filter out sequences that may be abnormal through the threshold, then calculate the approximate entropy of these sequences, and filter out the anomalies caused by noise; finally, the anomaly is explained by the method of aggregating neighbor anomaly scores.

[0021] like Figure 2 As shown, the present invention uses an anomaly interpretation method of aggregated neighbor anomalies to interpret and locate anomalies. First, the anomaly scores of all sensors are calculated, and then a preliminary judgment is made to find sensors with high anomaly scores and perform anomaly investigation. If the sensor is not abnormal, further judgment is required. Next, the aggregated neighbor anomaly scores of all sensors are calculated. Since sensors often influence each other in complex systems, an abnormality of a sensor may be caused by other sensors. In this case, although the anomaly scores of some sensors are very high, they may not be the root cause of the anomaly, but only a reflection of the abnormal symptoms. Therefore, the anomaly location can be performed by calculating the anomaly scores of aggregated one-hop neighbors. The calculation formula is: Then according to the anomaly score R i (t) Sort all sensors and provide the sorted list to the system operator for abnormality location. The sensors at the front of the list are more likely to be the root cause of the abnormality.

Claims

1. An interpretable industrial control intrusion detection method based on graph attention network, characterized in that: The method is specifically divided into the following steps: Step 1: SC-GRN model prediction: construct the graph structure between sensors according to the continuous graph structure update process, combine the improved graph attention network and gated recurrent unit, and then predict the system data to calculate the error sequence between the predicted sequence and the actual sequence; Step 2: Preliminary abnormality judgment. After generating the real-time error sequence of the entire industrial control system, the algorithm finally uses the threshold to make a preliminary abnormality judgment on the system status. Step 3: Based on the composite anomaly judgment of the threshold and approximate entropy, further judgment is made on the sequence initially judged as abnormal, the approximate entropy of the abnormal sequence is calculated, and the intrusion anomaly and the noise anomaly are further distinguished; Step 4: Anomaly location and explanation: locate the abnormal sensor of the system that has been determined to be invaded, and use the algorithm of aggregated neighbor anomaly scores to calculate the sensor with the highest anomaly score, which is the sensor most likely to be invaded.

2. According to the method of claim 1, in step 1, the graph structure is generated by continuously updating the graph structure. First, a global correlation matrix M and a local similarity matrix S are constructed to represent the graph structure learned in the previous round and the graph structure in the current round, respectively; then a similarity constraint is constructed to minimize the gap between the two matrices, and it is expressed as During the training process, M is dynamically adjusted by minimizing the loss function so that the final generated graph structure is optimal.

3. According to the method of claim 1, in step 3, the present invention uses approximate entropy to filter out abnormalities caused by noise. First, it is determined whether there is an abnormality based on the comparison between the abnormality score and the preset threshold. The abnormality at this time includes intrusion abnormality and noise abnormality; then the approximate entropy of the abnormal sequence is calculated. If the approximate entropy is greater than the threshold, it means noise. and filter it.

4. According to claim 1, the abnormal location and interpretation of the sensor is realized by the aggregated neighbor anomaly algorithm in step 4, and the specific process is as follows: First, in the abnormality identification stage, the sensor i with the largest abnormality score of the single sensor is calculated = argmax (err i (t)), and then make a preliminary diagnosis. If the sensor is not the root cause of the anomaly, further analysis is required; next, the aggregated neighbor anomaly score of all sensors is calculated. in, R i (t) is the anomaly score after aggregating the one-hop neighbors of sensor i, N(i) represents the neighbor nodes related to sensor i, which is obtained through the neighbor matrix learned by GAT, that is, N(i) = {j|A ij =1}, α ij is the attention coefficient learned in GAT, representing the influence of node j on i; according to the anomaly score R i (t) Sort all sensors and obtain the abnormal sorting table A s (t); Provide the sorted list to the system operator for abnormality location. The sensors at the front of the list are more likely to be the root cause of the abnormality. The flowchart of system abnormality interpretation is shown in Figure 2.

Images