Industrial control intrusion detection method based on ISAE auto-encoder and AFF feature fusion

Abstract

The invention discloses an industrial control intrusion detection method based on an ISAE auto-encoder and AFF feature fusion, and relates to the field of industrial control network security. The problem that a conventional intrusion detection algorithm is generally only based on a data set formed by original traffic data and manually extracted features, and due to the fact that traffic features cannot be deeply mined, obtained safety information is not comprehensive enough, and the effect of detecting partial attack traffic is poor is solved. The method comprises the steps of collecting original traffic data, obtaining corresponding artificial features according to the original traffic data, and constructing a training data set according to the artificial features; performing data preprocessing on the original flow data and the artificial features; constructing an intrusion detection model and training the intrusion detection model; and inputting the test set data into the trained intrusion detection model to obtain an intrusion detection result. The method is suitable for detecting and monitoring network intrusion, and the network intrusion risk is reduced.

Description

Technical Field

[0001] The present invention relates to the field of industrial control network security, and in particular to an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion. Background Art

[0002] With the rapid development of Internet technology, new industrial control network applications such as industrial Ethernet have been widely used in modern industrial systems, greatly improving production efficiency and intelligence. However, with the increasing popularity of industrial control networks, various attacks on industrial control networks have become more frequent, and the means have become more complex and diverse, and the threat situation has become increasingly severe. These attacks include worm virus attacks, ransomware attacks, zero-day vulnerability attacks, mining virus attacks, Trojan backdoors, distributed denial of service (DDoS) attacks, etc. Each attack method has its own unique propagation method and destructive power, which brings huge challenges to the security of industrial control systems.

[0003] At present, the security threats faced by industrial control networks are mainly due to the complexity of their system environment, the diversity of their structures, and the difficulties brought about by the high dimensionality of their traffic data characteristics. Industrial control networks are usually composed of multiple heterogeneous devices, including sensors, control systems, actuators, etc. These devices and systems are interconnected in the network, and the network topology is complex, and the traffic data volume is huge and diverse. This makes traditional network security intrusion detection technology often unable to effectively identify complex attack traffic. In addition, the serious imbalance of attack samples in industrial control networks is also a major problem, that is, attack traffic samples are often far less than normal traffic samples, making it difficult for traditional algorithms to accurately capture abnormal behavior.

[0004] In addition, most of the current network security data sets used for intrusion detection mainly include raw traffic data and manually extracted features. Conventional intrusion detection algorithms usually rely only on the features in these data sets for training and identification. This method often fails to fully explore the deep-level features of traffic, and the security information obtained is not comprehensive. Due to the failure to deeply analyze and understand the potential patterns in traffic data, the detection effect of some complex or new attacks is poor, or even unrecognizable. In particular, with the continuous evolution of attack technology, new attack methods are often highly concealed, and traditional detection methods based on simple rules or shallow learning models face huge challenges.

[0005] Therefore, improving the accuracy and effectiveness of industrial control network intrusion detection, especially traffic analysis in complex environments, has become a problem that needs to be solved urgently. Summary of the invention

[0006] In view of the problem that conventional intrusion detection algorithms are generally based only on data sets formed by raw traffic data and manually extracted features, and fail to deeply mine traffic features, the security information obtained is not comprehensive enough, resulting in poor detection effect on some attack traffic, the present invention proposes an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion, the method comprising:

[0007] S1: Collect original traffic data, obtain corresponding artificial features based on the original traffic data, and build a training data set based on the artificial features;

[0008] S2: Data preprocessing of raw traffic data and artificial features;

[0009] S3: Build an intrusion detection model, which includes an improved stacked autoencoder module ISAE that inputs artificial features, a CNN-LSTM module that inputs raw traffic data, an attention feature fusion module AFF, and a classifier;

[0010] S4: training intrusion detection model;

[0011] S5: Input the test set data into the trained intrusion detection model to obtain the intrusion detection results.

[0012] Furthermore, a preferred method is proposed, in which the data preprocessing in step S2 includes:

[0013] S21: Data cleaning, including: deleting or filling Nan data and missing data in artificial features; anonymizing the timestamps, IP addresses, and IP ports in the original traffic data and artificial features;

[0014] S22: data segmentation of the original traffic data;

[0015] S23: Perform one-hot encoding on the character-type discrete features in the artificial features, and perform numerical normalization on all numerical features;

[0016] S24: Process the imbalanced data, including: using random oversampling and undersampling to sample all types of samples to the same number;

[0017] S25: Divide into training set, validation set and test set.

[0018] Furthermore, a preferred method is proposed, in step S3, the ISAE autoencoder is used to extract the preprocessed artificial features, map them to a deep low-dimensional space, and obtain a deep representation vector, including:

[0019] S31: The artificial features are passed through the fully connected layer, batch normalization layer and ReLU layer in sequence to calculate the low-dimensional features;

[0020] S32: Position encoding of low-dimensional features to retain the position information of each data within the feature;

[0021] S33: Perform a fully connected layer linear transformation on the position-encoded low-dimensional feature X to obtain a query vector Q, a key vector K, and a value vector V;

[0022] S34: perform dot product calculation on the query vector Q and the key vector K to obtain a similarity matrix between the query vector Q and the key vector K, perform Softmax normalization on the similarity matrix to obtain an attention weight, and use the attention weight to weight V to obtain an attention-optimized feature A;

[0023] S35: Repeat steps S31 to S34 three times to obtain the final low-dimensional features, and use the same method to obtain the reconstructed features, and calculate the reconstruction loss and KL loss of the reconstructed features and the input features.

[0024] Furthermore, a preferred method is proposed, in step S3, the CNN-LSTM module is used to extract features from the preprocessed raw traffic data, including:

[0025] Input the original traffic data into the word embedding layer and map it into two-dimensional data;

[0026] Inputting the two-dimensional data into three residual convolutional layers to extract deep spatial features, the residual convolutional layers are composed of two convolutional layers, a batch normalization layer, a maximum pooling layer and a residual connection;

[0027] The raw traffic data is input into the LSTM layer to extract deep temporal features.

[0028] Furthermore, a preferred method is proposed, in step S3, the attention feature fusion module AFF is used to fuse the deep representation vector of the artificial feature and the deep spatial and temporal features of the original traffic data to obtain a fused feature, including:

[0029] Reshape is used to expand the low-dimensional features obtained by the ISAE encoder module into two-dimensional features, and three residual convolutional layers are used for feature extraction to obtain artificial multi-channel two-dimensional features;

[0030] Add the deep spatial features and the artificial multi-channel two-dimensional features to calculate the local attention and global attention;

[0031] The sum of local and global attention is normalized to obtain the channel attention weight, and the deep spatial features and artificial multi-channel two-dimensional features are weighted summed to obtain the fusion features;

[0032] The fusion features and deep temporal features are input into the tiling layer and the global pooling layer in turn to obtain one-dimensional features. Finally, the two are fused by Concat to obtain the final fusion features.

[0033] Furthermore, a preferred method is proposed, wherein the sum of local and global attention is normalized to obtain the channel attention weight, and the deep spatial features and the artificial multi-channel two-dimensional features are weighted and summed to obtain the fusion features, including:

[0034] L(X)=B(PWConv2(δ(B(PWConv1(X)))))

[0035] g(X)=L(GAP(X))

[0036] M(X)=σ s (L(X)+g(X))

[0037]

[0038] Among them, L is the local attention weight, g is the global attention weight, M is the fusion attention weight, PWConv is a 1×1 point-by-point convolution layer; B is a BatchNorm layer; δ is a ReLU activation function; GAP is a global pooling layer; σ s is the Sigmoid activation function, X is the deep spatial feature extracted by the CNN network, and Y is the artificial multi-channel two-dimensional feature.

[0039] Furthermore, a preferred method is proposed, in which the classifier consists of two fully connected layers, a Dropout layer and a Softmax layer, and finally outputs the probability value of the classification detection to obtain the final detection result.

[0040] Furthermore, a preferred method is proposed, in which the training process of the intrusion detection model in step S4 is:

[0041] The training set samples are input into the model in batches, the classification prediction values ​​are output, the loss between the prediction value and the true value is calculated, and the model parameters are optimized through Adam optimizer training;

[0042] After each round of training, the model prediction effect is tested using the validation set, and the model with the best validation set effect is taken as the trained model.

[0043] Based on the same inventive concept, the present invention also proposes a computer device, including a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion as described in any one of the above items.

[0044] Based on the same inventive concept, the present invention also proposes a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion as described above are executed.

[0045] The present invention is beneficial in that:

[0046] The method proposed in the present invention solves the problem that conventional intrusion detection methods are usually only based on raw traffic data and manually extracted features, but fail to deeply explore the deep-level features of traffic data. By adopting an improved stacked autoencoder (ISAE), deep learning of traffic data is performed through the autoencoder, which can effectively extract potential, high-dimensional features from the raw traffic data, thereby providing more comprehensive and accurate traffic features.

[0047] The method proposed in this paper solves the problem that the samples of attack traffic in industrial control networks are usually far less than those of normal traffic, resulting in serious data imbalance. By using the ISAE autoencoder and CNN-LSTM module, it is possible to better identify and learn the minority attack traffic in the unbalanced data and enhance the ability to identify attack behaviors. In addition, the attention feature fusion module (AFF) is used to further optimize the weight distribution of features, effectively alleviating the impact of sample imbalance on model performance.

[0048] The method proposed in the present invention solves the problem that the existing intrusion detection methods often rely only on a single model or a single type of feature extraction method, resulting in weak generalization ability of the model and difficulty in handling complex attack modes. The present invention combines a variety of advanced technologies and uses an improved ISAE autoencoder module: through deep learning of the original traffic data, hidden traffic features can be efficiently extracted, and the CNN-LSTM module is further used to effectively capture the timing features in the traffic, thereby improving the response capability to dynamic attacks. The AFF feature fusion module weightedly fuses different features, automatically selects the most representative features, and improves the robustness of the model. Finally, the extracted features are input into the classifier to accurately determine whether the traffic belongs to attack traffic. This multi-module collaborative working method can analyze traffic data from multiple angles and levels, thereby improving the comprehensive performance of intrusion detection, especially in the face of complex attacks.

[0049] The method proposed in the present invention effectively improves the detection capability of unknown attack patterns by integrating deep learning technology, especially by using the combination of autoencoder and CNN-LSTM. In particular, in the absence of a large amount of labeled data, the deep learning method can mine potential attack patterns from massive traffic data through self-supervised learning and automatic feature extraction, significantly enhancing the system's ability to respond to new attacks.

[0050] The method proposed in the present invention reduces the need for manual intervention through an automated feature extraction process, and accelerates the speed of feature learning and model training by using deep learning methods. In addition, the combination of ISAE autoencoder and CNN-LSTM module enables the model to simultaneously consider the structural characteristics and temporal characteristics of traffic, optimizes the overall training process, and thus improves the accuracy of the final model.

[0051] The present invention is suitable for detecting and monitoring network intrusions and reducing the risk of network intrusions. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A flow chart of an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion as described in implementation mode 1;

[0053] Figure 2 This is a schematic diagram of the principle of the industrial control intrusion detection method described in Implementation Method 11. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0055] Implementation method 1, see Figure 1 The present embodiment describes an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion, the method comprising:

[0056] S1: Collect original traffic data, obtain corresponding artificial features based on the original traffic data, and build a training data set based on the artificial features;

[0057] S2: Data preprocessing of raw traffic data and artificial features;

[0058] S3: constructing an intrusion detection model, the intrusion detection model comprising: an improved stacked autoencoder module ISAE for inputting artificial features, a CNN-LSTM module for inputting raw traffic data, an attention feature fusion module AFF, and a classifier;

[0059] S4: training intrusion detection model;

[0060] S5: Input the test set data into the trained intrusion detection model to obtain the intrusion detection results.

[0061] The industrial control intrusion detection method proposed in this embodiment solves the problem that conventional intrusion detection methods are usually only based on raw traffic data and manually extracted features, but fail to deeply explore the deep-level features of traffic data. It adopts an improved stacked autoencoder (ISAE) to perform deep learning on traffic data through the autoencoder, which can effectively extract potential, high-dimensional features from the raw traffic data, thereby providing more comprehensive and accurate traffic features.

[0062] The industrial control intrusion detection method proposed in this embodiment solves the problem that the samples of attack traffic in industrial control networks are usually far less than normal traffic samples, and there is a serious data imbalance problem. By using the ISAE autoencoder and CNN-LSTM module, it can better identify and learn the minority attack traffic in the unbalanced data, and enhance the ability to identify attack behaviors. In addition, the attention feature fusion module (AFF) is used to further optimize the weight distribution of features, effectively alleviating the impact of sample imbalance on model performance.

[0063] The industrial control intrusion detection method proposed in this embodiment solves the problem that the existing intrusion detection methods often rely only on a single model or a single type of feature extraction method, resulting in weak generalization ability of the model and difficulty in handling complex attack modes. The present invention combines a variety of advanced technologies and uses an improved ISAE autoencoder module: through deep learning of the original traffic data, hidden traffic features can be efficiently extracted, and the CNN-LSTM module can further effectively capture the timing features in the traffic, thereby improving the response capability to dynamic attacks. The AFF feature fusion module weightedly fuses different features, which can automatically select the most representative features and improve the robustness of the model. Finally, the extracted features are input into the classifier to accurately determine whether the traffic belongs to attack traffic. This multi-module collaborative working method can analyze traffic data from multiple angles and levels, thereby improving the comprehensive performance of intrusion detection, especially when facing complex attacks.

[0064] The industrial control intrusion detection method proposed in this embodiment uses the ISAE autoencoder and the CNN-LSTM module to fully extract the deep feature information in the artificial features and the original traffic data, and uses the AFF feature fusion to fuse the two features, making full use of the information of the artificial features and the original traffic data, which is beneficial to improving the detection performance of network intrusion detection.

[0065] Implementation method 2: This implementation method further limits the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in implementation method 1. The data preprocessing in step S2 includes:

[0066] S21: Data cleaning, including: deleting or filling Nan data and missing data in artificial features; anonymizing the timestamps, IP addresses, and IP ports in the original traffic data and artificial features;

[0067] S22: data segmentation of the original traffic data;

[0068] S23: Perform one-hot encoding on the character-type discrete features in the artificial features, and perform numerical normalization on all numerical features;

[0069] S24: Processing imbalanced data, including: using random oversampling and undersampling to sample all types of samples to the same number;

[0070] S25: Divide into training set, validation set and test set.

[0071] In this embodiment, by deleting or filling Nan data and missing data, the integrity of the data can be improved, and the accuracy of the data during the training and reasoning process of the model can be guaranteed. By anonymizing the timestamp, IP address and IP port, the problem of privacy leakage can be avoided, and the data bias can be reduced, so that the model pays more attention to the traffic characteristics themselves during training, rather than information related to the specific identity of the user or device. Character-type discrete features are encoded in a unique hot way, and the discrete features can be converted into numerical data. At the same time, the numerical features are normalized, and all features can be adjusted to the same dimension. By fusing multiple types of features (such as network traffic and artificial features), the perception ability of the model is improved, more intrusion patterns are captured, and the accuracy of detection is improved. The number of samples in each category is balanced by random oversampling and undersampling to avoid the situation of class imbalance in the data set, which causes the model to tend to predict categories with a large number of samples.

[0072] Implementation method 3: This implementation method is a further limitation of the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in implementation method 1. In step S3, the ISAE autoencoder is used to extract the preprocessed artificial features, map them to a deep low-dimensional space, and obtain a deep representation vector, including:

[0073] S31: The artificial features are passed through the fully connected layer, batch normalization layer and ReLU layer in sequence to calculate the low-dimensional features;

[0074] S32: Position encoding of low-dimensional features to retain the position information of each data within the feature;

[0075] S33: Perform a fully connected layer linear transformation on the position-encoded low-dimensional feature X to obtain a query vector Q, a key vector K, and a value vector V;

[0076] S34: perform dot product calculation on the query vector Q and the key vector K to obtain a similarity matrix between the query vector Q and the key vector K, perform Softmax normalization on the similarity matrix to obtain an attention weight, and use the attention weight to weight V to obtain an attention-optimized feature A;

[0077] S35: Repeat steps S31 to S34 three times to obtain the final low-dimensional features, and use the same method to obtain the reconstructed features, and calculate the reconstruction loss and KL loss of the reconstructed features and the input features.

[0078] Through the deep mapping of the ISAE autoencoder, the original features are converted into low-dimensional representations, which not only helps to reduce the computational complexity, but also effectively removes redundant information. By adding position encoding to the low-dimensional features, the temporal information in the feature data (such as the order of data packets, the temporal characteristics of events, etc.) is retained. By repeating multiple feature extraction and optimization (loops from S31 to S34), the expressiveness and robustness of the features are further improved. While extracting low-dimensional features, the ISAE autoencoder further ensures the degree of fit of the model to the data distribution by calculating the reconstruction loss and KL divergence loss between the input features and the reconstructed features. This dual loss setting not only enhances the robustness of the features, but also improves the generalization ability of the model. By minimizing the reconstruction loss, the model is more accurate in reconstructing the input data and can effectively capture the different characteristics of normal data and abnormal data. The KL loss helps the model avoid overfitting and ensures that the model has better recognition ability when dealing with new attacks.

[0079] Implementation 4: This implementation is a further limitation of the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in Implementation 1. In step S3, the CNN-LSTM module is used to extract features from the preprocessed raw traffic data, including:

[0080] Input the original traffic data into the word embedding layer and map it into two-dimensional data;

[0081] Inputting the two-dimensional data into three residual convolutional layers to extract deep spatial features, the residual convolutional layers are composed of two convolutional layers, a batch normalization layer, a maximum pooling layer and a residual connection;

[0082] The raw traffic data is input into the LSTM layer to extract deep temporal features.

[0083] This embodiment is explained in conjunction with the first embodiment. In this embodiment, spatial features and temporal features are combined, and through the joint application of CNN and LSTM, information can be extracted at different levels. The spatial features are processed by the convolution layer, and the temporal features are modeled by the LSTM layer, and finally the reconstruction features of the ISAE autoencoder can be combined to form a multi-dimensional feature representation. This method can effectively deal with intrusion behaviors in complex and changeable industrial control environments, especially for covert attack behaviors (such as slow or imperceptible attacks). LSTM's modeling ability for time series data can help identify continuously changing traffic patterns, while the convolutional network can quickly locate potential abnormal spatial features, which provides effective support for intrusion detection in industrial control systems.

[0084] Implementation mode 5: This implementation mode is a further limitation of the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in implementation mode 4. In step S3, the attention feature fusion module AFF is used to fuse the deep representation vector of the artificial feature and the deep spatial and temporal features of the original traffic data to obtain a fusion feature, including:

[0085] The low-dimensional features obtained by the ISAE encoder module are expanded into two-dimensional features using the reshape function Reshape, and three residual convolutional layers are used for feature extraction to obtain artificial multi-channel two-dimensional features;

[0086] Add the deep spatial features and the artificial multi-channel two-dimensional features to calculate the local attention and global attention;

[0087] The sum of local and global attention is normalized to obtain the channel attention weight, and the deep spatial features and artificial multi-channel two-dimensional features are weighted summed to obtain the fusion features;

[0088] The fusion features and deep temporal features are input into the tiling layer and the global pooling layer in turn to obtain one-dimensional features. Finally, the two are fused by Concat to obtain the final fusion features.

[0089] In this embodiment, the artificial features and the deep space-time features of the original traffic data are fused through the attention feature fusion module AFF, which can effectively combine information from two different sources. Artificial features usually include analysis of expert knowledge of industrial control systems, network behavior, etc., while deep space-time features can extract hidden patterns from traffic data. This fusion enables the intrusion detection model to better adapt to different types of attacks. Further, Reshape is used to expand the low-dimensional features obtained by the ISAE encoder into two-dimensional features, and feature extraction is performed through three residual convolution layers. The nonlinear relationship between the features is better mined through the neural network, which helps to capture the detailed information in the data and further improve the recognition of attack behavior. At the same time, the introduction of local attention and global attention, and the weighting of different features can enable the intrusion detection model to better focus on the features related to the attack behavior in complex intrusion detection tasks, thereby improving the accuracy and robustness of detection. Combining deep spatial features with deep temporal features and further processing them through tiling layers and global pooling layers can make full use of the spatial and temporal structure of the data. This process not only enables the model to obtain important pattern information in the spatial dimension, but also captures the dynamic changes of attack behavior through the temporal dimension, enhancing the model's temporal perception ability.

[0090] The industrial control intrusion detection method proposed in this embodiment fuses multiple feature sources to make the final fused features more comprehensive and diverse. By fusing deep spatial features and deep temporal features in a Concat manner, the fused features are richer and can better adapt to various attack modes. This diverse feature combination can improve the generalization ability of the model and can also show better detection effects when facing unknown attacks.

[0091] Implementation 6. This implementation is a further limitation of the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in Implementation 5. The sum of local and global attention is normalized to obtain channel attention weights, and the deep spatial features and artificial multi-channel two-dimensional features are weighted and summed to obtain fusion features, including:

[0092] L(X)=B(PWConv2(δ(B(PWConv1(X)))))

[0093] g(X)=L(GAP(X))

[0094] M(X)=σ s (L(X)+g(X))

[0095]

[0096] Among them, L is the local attention weight, g is the global attention weight, M is the fusion attention weight, PWConv is a 1×1 point-by-point convolution layer; B is a BatchNorm layer; δ is a ReLU activation function; GAP is a global pooling layer; σ s is the Sigmoid activation function, X is the deep spatial feature extracted by the CNN network, and Y is the artificial multi-channel two-dimensional feature.

[0097] Implementation method seven. This implementation method is a further limitation of the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in implementation method one. The classifier consists of two fully connected layers, a Dropout layer and a Softmax layer, and finally outputs the probability value of the classification detection to obtain the final detection result.

[0098] Implementation 8: This implementation is a further limitation of the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in Implementation 1. The training process of the intrusion detection model in step S4 is:

[0099] The training set samples are input into the model in batches, the classification prediction values ​​are output, the loss between the prediction value and the true value is calculated, and the model parameters are optimized through Adam optimizer training;

[0100] After each round of training, the model prediction effect is tested using the validation set, and the model with the best validation set effect is taken as the trained model.

[0101] Embodiment 9. A computer device described in this embodiment includes a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion as described in any one of embodiments 1 to 7.

[0102] Embodiment 10. A computer-readable storage medium described in this embodiment stores a computer program, and when the computer program is executed by a processor, the steps of an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion as described in any one of embodiments 1 to 7 are executed.

[0103] Implementation Method 11: See Figure 2 This embodiment provides a specific example of an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in the first embodiment, and is also used to explain the second to eighth embodiments, specifically:

[0104] This example is based on the UNSW-NB15 dataset. The original traffic data collected by the network sniffing device in step S1 and the artificial features obtained by the network traffic analysis software are given in the dataset. Combined with the characteristics of the industrial control network, some artificial features that need special attention are given:

[0105] Proto: transmission protocol type; Dur: total record duration; Sbytes: number of bytes processed from source to target; Dbytes: number of bytes processed from target to source; Sttl: survival time from source to target; Dttl: survival time from target to source; Service: network service type; State: network connection status; Sjit: source jitter time (milliseconds); Djit: target jitter time (milliseconds).

[0106] Step S2, preprocessing the UNSW-NB15 dataset, including:

[0107] Data cleaning: delete and fill in Nan data and missing data in artificial features, anonymize redundant features such as timestamps, IP addresses, and IP ports in raw traffic data and artificial features. After data cleaning, the dimension of artificial features is 41.

[0108] The original traffic data is segmented. The original traffic data packets have different lengths and cannot be directly input into the neural network. Therefore, each original traffic data sample is segmented according to the specification of 40×128.

[0109] Since artificial features contain discrete character features such as 'proto', 'state' and 'sevice', the model can only process numerical inputs and cannot process discrete character features. Therefore, one-hot encoding is used to encode discrete features into multi-dimensional numerical features, and the feature dimension is expanded from 41 dimensions to 66 dimensions.

[0110] The numerical ranges of artificial features vary, which is not conducive to model training. Therefore, all features are normalized by Z-Score. The normalization formula is:

[0111]

[0112] Among them, μ is the mean value of the feature; σ is the standard deviation of the feature;

[0113] In addition, the number of samples provided by the UNSW-NB15 data has a serious long-tail distribution characteristic, which will cause the model training process to focus too much on large-number samples and result in poor detection results for small-number samples. Therefore, random oversampling and undersampling are used to sample all types of samples to 10,000;

[0114] Finally, the dataset is divided into training, validation and test sets in a ratio of 8:1:1.

[0115] Step S3, constructing an intrusion detection model. The intrusion detection model mainly consists of four parts: ISAE autoencoder module, CNN-LSTM module, AFF feature fusion module and classifier.

[0116] The ISAE autoencoder module consists of three encoder layers and decoder layers. Each encoder and decoder consists of a fully connected layer, a batch normalization layer, a ReLU layer, and a self-attention layer. Its function is to extract the preprocessed artificial features, map them to a deep low-dimensional space, and obtain a deep representation vector. The specific process is as follows:

[0117] C301, the artificial features are passed through the fully connected layer, batch normalization layer and ReLU layer in sequence to calculate the low-dimensional features. The calculation formulas of the fully connected layer, batch normalization layer and ReLU layer are:

[0118] y=Wx+b

[0119]

[0120] Where W is the weight matrix; b is the bias vector; μ B is the statistical mean of the batch samples; σ β is the statistical standard deviation of the batch samples;

[0121] C302, position encoding of low-dimensional features, retaining the position information of each data in the feature, reducing the interference of the same numerical data at different positions on the model. Its calculation formula is:

[0122]

[0123] Where PE(pos,2i) and PE(pos,2i+1) are the 2i-th and (2i+1)-th components of the encoding vector with position index pos, respectively, and dmodel is the dimension of the position vector;

[0124] C303, there are important features and redundant interference features in the low-dimensional features. In order to highlight the important features and ignore the redundant interference features, the attention mechanism is used to improve the encoder layer. First, the low-dimensional feature X after position encoding is linearly transformed in the fully connected layer to obtain the query vector Q, key vector K and value vector V. The calculation formula is:

[0125] Q=XW q

[0126] K=XW k

[0127] V=XWv

[0128] Among them, W q , W k , W v are the weight matrices of Q, K, and V respectively.

[0129] C304, perform dot product calculation on Q and K to obtain the similarity matrix of Q and K, then perform Softmax normalization on the similarity matrix to obtain the attention weight and weight V. The calculation formula is:

[0130]

[0131] Among them, A is the weighted feature, Dk is the length of K, which is used to normalize the variance of the similarity matrix.

[0132] C305, repeat the C301-C304 process three times, the feature dimensions of each layer are 45, 35, and 25 respectively, and finally obtain 25-dimensional low-dimensional features. Use the same method to obtain 66-dimensional reconstructed features, calculate the reconstruction loss and KL loss of the reconstructed features and input features, and the calculation formula is:

[0133]

[0134]

[0135] Among them, y is the original feature; σ(z) is the reconstructed feature; n is the feature dimension.

[0136] The CNN-LSTM module consists of two branches, CNN and LSTM. Its function is to extract features from the preprocessed raw traffic data and extract its deep spatial and temporal features. The specific process is as follows:

[0137] C401, inputs the original traffic data into the word embedding layer and maps it into two-dimensional data X2d, the size of which is 40×128×128;

[0138] C402, two-dimensional data X 2d Input to three residual convolution layers to extract deep spatial features Xcnn. The deep spatial size is 128×4×4. The feature residual convolution layer consists of two convolution layers, a batch normalization layer, a maximum pooling layer and a residual connection. The calculation formula of the convolution layer is:

[0139]

[0140] in, is the output feature of the l-th layer convolution; * is the convolution operation; σ is the activation function; M j is the feature set of the previous layer; is the convolution kernel; is the offset.

[0141] C403, input the original traffic data into the LSTM layer to extract the deep time feature X lstm , the depth time feature size is 40×128, and its internal calculation formula is:

[0142] i t =σ(W ix x t +W ih h t-1 +b i )

[0143] f t =σ(W fx x t +W fh h t-1 +b f )

[0144] o t =σ(W ox x t +W of h t-1 )+b o

[0145] h t =o t e tanh(C t )

[0146] C t =f t e C t-1 +i t e tanh(W cx x t +W ch h t-1 +b c )

[0147] Y t =φ(W yh h t +b y )

[0148] Where: I t 、f t , o t are the states of the input gate, forget gate, and output gate at time t; σ is the Sigmoid activation function; φ is the Softmax activation function; e is the matrix element multiplication; W ix , W fx , W ox , W cx is the input-state weight matrix; Wih , W fh , W of , W ch is the state-state weight matrix; b i 、b f 、b o 、b c is the offset; Y t is the output result at time t.

[0149] The function of the AFF feature fusion module is to fuse the deep representation vector of the artificial feature and the deep spatiotemporal features of the original traffic data to obtain the fused feature. The specific process is as follows:

[0150] C501, uses Reshape to expand the low-dimensional features obtained by the ISAE encoder network into 5×5 two-dimensional features, and uses the convolutional network designed by C402 for feature extraction to obtain the multi-channel two-dimensional features Y of the artificial features, with a feature format of 128×4×4;

[0151] C502, the deep spatial feature X cnn And the artificial multi-channel two-dimensional feature Y is added to calculate its local attention and global attention, and then the sum of local and global attention is normalized to obtain the channel attention weight ω, which is used for the deep spatial feature X cnn The weighted sum of the artificial multi-channel two-dimensional feature Y is used to obtain the fusion feature, and its calculation formula is:

[0152] L(X)=B(PWConv2(δ(B(PWConv1(X)))))

[0153] g(X)=L(GAP(X))

[0154] M(X)=σ s (L(X)+g(X))

[0155]

[0156] Among them, L, g and M are local attention, global attention and fusion attention weights; PWConv is a 1×1 point-by-point convolution layer; B is a BatchNorm layer; δ is a ReLU activation function; GAP is a global pooling layer; σ s is the Sigmoid activation function.

[0157] C503, the fusion feature obtained by C502 and the deep time feature X lstm The features are input into the tiling layer and the global pooling layer in sequence to obtain one-dimensional features of length 16. Finally, the two are fused by Concat to obtain the final fused features of length 32.

[0158] The classifier consists of two fully connected layers, a Dropout layer, and a Softmax layer, and finally outputs the expected probability value of each category to obtain the final detection result. The output feature length of each fully connected layer is 16 and 5 respectively; the parameter of the Dropout layer is 0.2.

[0159] In step S4, the hardware configuration for model training is Ubuntu 20.04, Intel (R) Core (TM) i9-10900KF CPU @ 3.70GHz, GPU: GeForce RTX 3090. The initial learning rate is 0.001, the batch size is 128, the learning rate optimization strategy is StepLR, and the L2 decay weight is 1e -4 , the number of training rounds is 100. The specific model training process is:

[0160] C701, the training set data is divided into multiple batches according to the batch size, the data is input into the model in batches, the classification prediction value is output, and the loss between the prediction value and the true value is calculated. The Adam optimizer optimizes the model parameters through the loss value, and the parameters are optimized once for each batch of data input. The loss calculation formula is:

[0161]

[0162] Among them, Loss cla is the classification loss, and is the cross entropy loss between the predicted and true labels; Loss AE is the autoencoder loss, which is the sum of the reconstruction loss and KL loss calculated in C305; ω is the classification loss weight coefficient; detach() is the tensor separation function so that it does not participate in back propagation.

[0163] C702: The model completes training of all training sets once, which is called one round, which can be referred to as 1 epoch. After each 1 epoch of training, the validation set is used to test the model prediction effect, and the model of the epoch with the best validation set effect is taken as the trained model.

[0164] Step S5, input the test set data preprocessed by S2 into the trained intrusion detection model to obtain the intrusion detection results and performance of the model in the actual environment.

[0165] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0166] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0168] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present disclosure rather than to limit its protection scope. Although the present disclosure has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that after reading the present disclosure, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the invention, but these changes, modifications or equivalent substitutions are all within the protection scope of the disclosed claims to be approved.

Claims

1. An industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion, characterized in that: The method comprises: S1: Collect original traffic data, obtain corresponding artificial features based on the original traffic data, and build a training data set based on the artificial features; S2: Data preprocessing of raw traffic data and artificial features; S3: Construct an intrusion detection model, including: an improved stacked autoencoder module ISAE that inputs artificial features, a CNN-LSTM module that inputs raw traffic data, an attention feature fusion module AFF, and a classifier; S4: training intrusion detection model; S5: Input the test set data into the trained intrusion detection model to obtain the intrusion detection results.

2. According to claim 1, an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion is characterized in that: The data preprocessing in step S2 includes: S21: Data cleaning, including: deleting or filling Nan data and missing data in artificial features; anonymizing the timestamps, IP addresses, and IP ports in the original traffic data and artificial features; S22: data segmentation of the original traffic data; S23: Perform one-hot encoding on the character-type discrete features in the artificial features, and perform numerical normalization on the numerical features; S24: Imbalanced processing of data; S25: Divide into training set, validation set and test set.

3. According to claim 1, the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion is characterized in that: In step S3, the ISAE autoencoder is used to extract the preprocessed artificial features, map them to a deep low-dimensional space, and obtain a deep representation vector, including: S31: The artificial features are passed through the fully connected layer, batch normalization layer and ReLU layer in sequence to calculate the low-dimensional features; S32: low-dimensional features are used for position encoding; S33: Perform a fully connected layer linear transformation on the position-encoded low-dimensional feature X to obtain a query vector Q, a key vector K, and a value vector V; S34: perform dot product calculation on the query vector Q and the key vector K to obtain a similarity matrix between the query vector Q and the key vector K, perform Softmax normalization on the similarity matrix to obtain an attention weight, and use the attention weight to weight V to obtain an attention-optimized feature; S35: Repeat steps S31 to S34 three times to obtain the final low-dimensional features, and use the same method to obtain the reconstructed features, and calculate the reconstruction loss and KL loss of the reconstructed features and the input features.

4. According to claim 1, the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion is characterized in that: In step S3, the CNN-LSTM module is used to extract features from the preprocessed raw traffic data, including: Input the original traffic data into the word embedding layer and map it into two-dimensional data; Inputting the two-dimensional data into three residual convolutional layers to extract deep spatial features, the residual convolutional layers are composed of two convolutional layers, a batch normalization layer, a maximum pooling layer and a residual connection; The raw traffic data is input into the LSTM layer to extract deep temporal features.

5. The industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion according to claim 4 is characterized in that: In step S3, the attention feature fusion module AFF is used to fuse the deep representation vector of the artificial feature and the deep spatial and temporal features of the original traffic data to obtain a fused feature, including: Reshape is used to expand the low-dimensional features obtained by the ISAE encoder module into two-dimensional features, and three residual convolutional layers are used for feature extraction to obtain artificial multi-channel two-dimensional features; Add the deep spatial features and the artificial multi-channel two-dimensional features to calculate the local attention and global attention; The sum of local and global attention is normalized to obtain the channel attention weight, and the deep spatial features and artificial multi-channel two-dimensional features are weighted summed to obtain the fusion features; The fusion features and deep temporal features are input into the tiling layer and the global pooling layer in turn to obtain one-dimensional features. Finally, the two are fused by Concat to obtain the final fusion features.

6. The industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion according to claim 5 is characterized in that: The sum of local and global attention is normalized to obtain the channel attention weight, and the deep spatial features and the artificial multi-channel two-dimensional features are weighted and summed to obtain the fusion features, including: L(X)=B(PWConv2(δ(B(PWConv1(X))))) g(X)=L(GAP(X)) M(X)=σ s (L(X)+g(X)) Among them, L is the local attention weight, g is the global attention weight, M is the fusion attention weight, PWConv is a 1×1 point-by-point convolution layer; B is a BatchNorm layer; δ is a ReLU activation function; GAP is a global pooling layer; σ s is the Sigmoid activation function, X is the deep spatial feature extracted by the CNN network, and Y is the artificial multi-channel two-dimensional feature.

7. The industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion according to claim 1 is characterized in that: The classifier consists of two fully connected layers, a Dropout layer and a Softmax layer, and finally outputs the probability value of classification detection to obtain the final detection result.

8. The industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion according to claim 1 is characterized in that: The training process of the intrusion detection model in step S4 is: The training set samples are input into the model in batches, the classification prediction values ​​are output, the loss between the prediction value and the true value is calculated, and the model parameters are optimized through Adam optimizer training; After each round of training, the model prediction effect is tested using the validation set, and the model with the best validation set effect is taken as the trained model.

9. A computer device, characterized in that: It includes a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion as described in any one of claims 1-7.

Images