An industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion

Abstract

An industrial control intrusion detection method based on the fusion of ISAE autoencoders and AFF features relates to the field of industrial control network security. This method addresses the problem that conventional intrusion detection algorithms are generally based only on datasets formed by raw traffic data and manually extracted features. Because they fail to deeply explore traffic features, the security information obtained is not comprehensive, resulting in poor detection of some attack traffic. The method includes: collecting raw traffic data, obtaining corresponding artificial features based on the raw traffic data, and constructing a training dataset based on the artificial features; performing data preprocessing on the raw traffic data and the artificial features; constructing an intrusion detection model and training the intrusion detection model; and inputting the test set data into the trained intrusion detection model to obtain intrusion detection results. The present invention is suitable for detecting and monitoring network intrusions, reducing the risk of network intrusions.

Description

Technical Field

[0001] The present invention relates to the field of industrial control network security, and in particular to an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion. Background Art

[0002] With the rapid development of internet technology, new industrial control network applications, such as Industrial Ethernet, have been widely adopted in modern industrial systems, significantly improving production efficiency and intelligence. However, with the increasing popularity of industrial control networks, attacks targeting these networks are becoming increasingly frequent, with increasingly sophisticated and diverse methods, creating an increasingly severe threat landscape. These attacks include worms, ransomware, zero-day exploits, mining malware, Trojan backdoors, and distributed denial of service (DDoS) attacks. Each attack method has its own unique propagation and destructive power, posing significant challenges to the security of industrial control systems.

[0003] Currently, security threats facing industrial control networks are primarily due to the complexity of their system environments, the diversity of their structures, and the high dimensionality of their traffic data. Industrial control networks typically consist of multiple heterogeneous devices, including sensors, control systems, and actuators. These devices and systems are interconnected within the network, creating complex network topologies and a large and diverse flow of data. This makes traditional network security intrusion detection technologies often unable to effectively identify complex attack traffic. Furthermore, the significant imbalance in attack patterns within industrial control networks poses a significant challenge: attack traffic samples are often far fewer than normal traffic samples, making it difficult for traditional algorithms to accurately capture anomalous behavior.

[0004] Furthermore, most current network security datasets used for intrusion detection primarily consist of raw traffic data and manually extracted features. Conventional intrusion detection algorithms typically rely solely on features from these datasets for training and identification. This approach often fails to fully exploit the underlying characteristics of traffic, resulting in incomplete security information. This failure to deeply analyze and understand the underlying patterns in traffic data results in poor detection of certain complex or novel attacks, or even their identification. In particular, with the continuous evolution of attack techniques, new attack methods are often more concealed, posing significant challenges to traditional detection methods based on simple rules or shallow learning models.

[0005] Therefore, improving the accuracy and effectiveness of industrial control network intrusion detection, especially traffic analysis in complex environments, has become an urgent problem to be solved. Summary of the Invention

[0006] The present invention addresses the problem that conventional intrusion detection algorithms are generally based only on datasets formed by raw traffic data and manually extracted features. Due to the failure to deeply explore traffic features, the security information obtained is not comprehensive, resulting in poor detection of some attack traffic. In this paper, an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion is proposed. The method includes:

[0007] S1: Collect raw traffic data, obtain corresponding artificial features based on the raw traffic data, and construct a training dataset based on the artificial features;

[0008] S2: Data preprocessing of raw traffic data and artificial features;

[0009] S3: Build an intrusion detection model, which includes an improved stacked autoencoder module ISAE that inputs artificial features, a CNN-LSTM module that inputs raw traffic data, an attention feature fusion module AFF, and a classifier;

[0010] S4: training intrusion detection model;

[0011] S5: Input the test set data into the trained intrusion detection model to obtain the intrusion detection results.

[0012] Furthermore, a preferred method is proposed, in which the data preprocessing in step S2 includes:

[0013] S21: Data cleaning, including: deleting or filling in Nan data and missing data in artificial features; anonymizing the timestamps, IP addresses, and IP ports in the original traffic data and artificial features;

[0014] S22: data segmentation of the original traffic data;

[0015] S23: Perform one-hot encoding on the character-type discrete features in the artificial features and perform numerical normalization on all numerical features;

[0016] S24: Process the imbalanced data, including: using random oversampling and undersampling to sample all types of samples to the same number;

[0017] S25: Divide the training set, validation set and test set.

[0018] Furthermore, a preferred method is proposed, in step S3, the ISAE autoencoder is used to extract the preprocessed artificial features, map them to a deep low-dimensional space, and obtain a deep representation vector, including:

[0019] S31: The artificial features are passed through the fully connected layer, batch normalization layer and ReLU layer in sequence to calculate the low-dimensional features;

[0020] S32: Position encoding of low-dimensional features to retain the position information of each data within the feature;

[0021] S33: Perform a fully connected layer linear transformation on the position-encoded low-dimensional feature X to obtain the query vector Q, key vector K, and value vector V;

[0022] S34: Perform dot product calculation on the query vector Q and the key vector K to obtain a similarity matrix between the query vector Q and the key vector K, perform Softmax normalization on the similarity matrix to obtain an attention weight, and use the attention weight to weight V to obtain the attention-optimized feature A;

[0023] S35: Repeat steps S31 to S34 three times to obtain the final low-dimensional features, and use the same method to obtain the reconstructed features, and calculate the reconstruction loss and KL loss of the reconstructed features and the input features.

[0024] Furthermore, a preferred method is proposed, in step S3, the CNN-LSTM module is used to extract features from the preprocessed raw traffic data, including:

[0025] Input the original traffic data into the word embedding layer and map it into two-dimensional data;

[0026] The two-dimensional data is input into three residual convolutional layers to extract deep spatial features. The residual convolutional layers are composed of two convolutional layers, a batch normalization layer, a maximum pooling layer and a residual connection.

[0027] The raw traffic data is input into the LSTM layer to extract deep temporal features.

[0028] Furthermore, a preferred method is proposed, in step S3, the attention feature fusion module AFF is used to fuse the deep representation vector of the artificial feature and the deep spatial and temporal features of the original traffic data to obtain a fused feature, including:

[0029] Reshape is used to expand the low-dimensional features obtained by the ISAE encoder module into two-dimensional features, and three residual convolution layers are used for feature extraction to obtain artificial multi-channel two-dimensional features;

[0030] Add the deep spatial features and the artificial multi-channel two-dimensional features to calculate the local attention and global attention;

[0031] Normalize the sum of local and global attention to obtain channel attention weight, and perform weighted summation of deep spatial features and artificial multi-channel two-dimensional features to obtain fusion features;

[0032] The fusion features and deep temporal features are input into the tiling layer and the global pooling layer in sequence to obtain one-dimensional features. Finally, the two are fused by Concat to obtain the final fusion features.

[0033] Furthermore, a preferred method is proposed, wherein the sum of local and global attention is normalized to obtain channel attention weights, and the deep spatial features and artificial multi-channel two-dimensional features are weighted summed to obtain fusion features, including:

[0034] L(X)=B(PWConv2(δ(B(PWConv1(X)))))

[0035] g(X)=L(GAP(X))

[0036] M(X)=σ s (L(X)+g(X))

[0037]

[0038] Among them, L is the local attention weight, g is the global attention weight, M is the fusion attention weight, PWConv is a 1×1 point-by-point convolution layer; B is a BatchNorm layer; δ is a ReLU activation function; GAP is a global pooling layer; σ s is the Sigmoid activation function, X is the deep spatial feature extracted by the CNN network, and Y is the artificial multi-channel two-dimensional feature.

[0039] Furthermore, a preferred method is proposed, in which the classifier consists of two fully connected layers, a Dropout layer and a Softmax layer, and finally outputs the probability value of the classification detection to obtain the final detection result.

[0040] Furthermore, a preferred method is proposed, in which the training process of the intrusion detection model in step S4 is as follows:

[0041] The training set samples are input into the model in batches, the classification prediction values ​​are output, the loss between the predicted values ​​and the true values ​​is calculated, and the model parameters are optimized through Adam optimizer training;

[0042] After each round of training, the model prediction effect is tested using the validation set, and the model with the best validation set effect is taken as the trained model.

[0043] Based on the same inventive concept, the present invention also proposes a computer device, including a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion as described in any one of the above items.

[0044] Based on the same inventive concept, the present invention also proposes a computer-readable storage medium, which stores a computer program. When the computer program is run by a processor, it executes the steps of an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion as described above.

[0045] The present invention is beneficial in that:

[0046] The method proposed in the present invention solves the problem that conventional intrusion detection methods are usually based only on raw traffic data and manually extracted features, but fail to deeply explore the deep-level features of traffic data. It adopts an improved stacked autoencoder (ISAE) to perform deep learning on traffic data through the autoencoder, which can effectively extract potential, high-dimensional features from the raw traffic data, thereby providing more comprehensive and accurate traffic features.

[0047] The proposed method addresses the severe data imbalance problem in industrial control networks, where attack traffic samples are typically far fewer than normal traffic samples. By using the ISAE autoencoder and CNN-LSTM module, it can better identify and learn from the minority attack traffic in the imbalanced data, enhancing the ability to identify attack behaviors. Furthermore, the Attention Feature Fusion (AFF) module further optimizes feature weight distribution, effectively mitigating the impact of sample imbalance on model performance.

[0048] The method proposed in the present invention solves the problem that existing intrusion detection methods often rely only on a single model or a single type of feature extraction method, resulting in weak generalization ability of the model and difficulty in handling complex attack patterns. The present invention combines a variety of advanced technologies and utilizes an improved ISAE autoencoder module: through deep learning of the original traffic data, hidden traffic features can be efficiently extracted, and the CNN-LSTM module can further effectively capture the time series features in the traffic, thereby improving the response capability to dynamic attacks. The AFF feature fusion module performs weighted fusion of different features, which can automatically select the most representative features and improve the robustness of the model. Finally, the extracted features are input into the classifier to accurately determine whether the traffic belongs to attack traffic. This multi-module collaborative working method can analyze traffic data from multiple angles and multiple levels, thereby improving the comprehensive performance of intrusion detection, especially when facing complex attacks.

[0049] The proposed method effectively improves the detection capability of unknown attack patterns by integrating deep learning techniques, particularly the combination of autoencoders and CNN-LSTM. In particular, in the absence of large amounts of labeled data, deep learning methods, through self-supervised learning and automatic feature extraction, can mine potential attack patterns from massive amounts of traffic data, significantly enhancing the system's ability to respond to new attacks.

[0050] The proposed method reduces the need for manual intervention by automating the feature extraction process and accelerates feature learning and model training using deep learning methods. Furthermore, the combination of the ISAE autoencoder and the CNN-LSTM module enables the model to simultaneously consider both the structural and temporal characteristics of traffic, optimizing the overall training process and ultimately improving the accuracy of the final model.

[0051] The present invention is suitable for detecting and monitoring network intrusions, and reduces the risk of network intrusions. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a flow chart of an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion as described in embodiment 1;

[0053] Figure 2 Schematic diagram of the principle of the industrial control intrusion detection method described in embodiment eleven. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in combination with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0055] Implementation method 1, see Figure 1 This embodiment describes an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion, the method comprising:

[0056] S1: Collect raw traffic data, obtain corresponding artificial features based on the raw traffic data, and construct a training dataset based on the artificial features;

[0057] S2: Data preprocessing of raw traffic data and artificial features;

[0058] S3: Constructing an intrusion detection model, the intrusion detection model includes: an improved stacked autoencoder module ISAE that inputs artificial features, a CNN-LSTM module that inputs raw traffic data, an attention feature fusion module AFF, and a classifier;

[0059] S4: training intrusion detection model;

[0060] S5: Input the test set data into the trained intrusion detection model to obtain the intrusion detection results.

[0061] The industrial control intrusion detection method proposed in this embodiment solves the problem that conventional intrusion detection methods are usually only based on raw traffic data and manually extracted features, but fail to deeply explore the deep-level features of traffic data. It adopts an improved stacked autoencoder (ISAE) to perform deep learning on traffic data through the autoencoder, which can effectively extract potential, high-dimensional features from the raw traffic data, thereby providing more comprehensive and accurate traffic features.

[0062] The industrial control intrusion detection method proposed in this embodiment addresses the severe data imbalance problem in industrial control networks, where attack traffic samples are typically far fewer than normal traffic samples. By using the ISAE autoencoder and CNN-LSTM module, it can better identify and learn from the minority attack traffic in the imbalanced data, enhancing the ability to identify attack behaviors. Furthermore, the Attention Feature Fusion (AFF) module further optimizes feature weight distribution, effectively mitigating the impact of sample imbalance on model performance.

[0063] The industrial control intrusion detection method proposed in this embodiment solves the problem that existing intrusion detection methods often rely only on a single model or a single type of feature extraction method, resulting in weak generalization ability of the model and difficulty in handling complex attack patterns. The present invention combines a variety of advanced technologies and utilizes an improved ISAE autoencoder module: through deep learning of the original traffic data, hidden traffic features can be efficiently extracted, and the CNN-LSTM module can further effectively capture the time series features in the traffic, thereby improving the response capability to dynamic attacks. The AFF feature fusion module performs weighted fusion of different features, which can automatically select the most representative features and improve the robustness of the model. Finally, the extracted features are input into the classifier to accurately determine whether the traffic belongs to attack traffic. This multi-module collaborative working method can analyze traffic data from multiple angles and multiple levels, thereby improving the comprehensive performance of intrusion detection, especially when facing complex attacks.

[0064] The industrial control intrusion detection method proposed in this embodiment uses the ISAE autoencoder and CNN-LSTM module to fully extract the deep feature information in the artificial features and the original traffic data, and uses AFF feature fusion to fuse the two features, making full use of the information of the artificial features and the original traffic data, which is conducive to improving the detection performance of network intrusion detection.

[0065] Implementation 2: This implementation further limits the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in Implementation 1. The data preprocessing in step S2 includes:

[0066] S21: Data cleaning, including: deleting or filling in Nan data and missing data in artificial features; anonymizing the timestamps, IP addresses, and IP ports in the original traffic data and artificial features;

[0067] S22: data segmentation of the original traffic data;

[0068] S23: Perform one-hot encoding on the character-type discrete features in the artificial features and perform numerical normalization on all numerical features;

[0069] S24: Process the imbalanced data, including: using random oversampling and undersampling to sample all types of samples to the same number;

[0070] S25: Divide the training set, validation set and test set.

[0071] In this embodiment, by deleting or filling Nan data and missing data, the integrity of the data can be improved and the accuracy of the data during the training and reasoning process of the model can be guaranteed. By anonymizing the timestamp, IP address and IP port, the problem of privacy leakage can be avoided, and the data bias can be reduced, so that the model pays more attention to the traffic characteristics themselves during training, rather than information related to the specific identity of the user or device. Character-type discrete features are uniquely encoded to convert discrete features into numerical data. At the same time, the numerical features are normalized to adjust all features to the same dimension. By fusing multiple types of features (such as network traffic and artificial features), the perception ability of the model is improved, more intrusion patterns are captured, and the accuracy of detection is improved. The number of samples in each category is balanced by random oversampling and undersampling to avoid category imbalance in the data set, which causes the model to tend to predict categories with a larger number of samples.

[0072] Implementation method 3: This implementation method further limits the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in implementation method 1. In step S3, the ISAE autoencoder is used to extract the preprocessed artificial features, map them to a deep low-dimensional space, and obtain a deep representation vector, including:

[0073] S31: The artificial features are passed through the fully connected layer, batch normalization layer and ReLU layer in sequence to calculate the low-dimensional features;

[0074] S32: Position encoding of low-dimensional features to retain the position information of each data within the feature;

[0075] S33: Perform a fully connected layer linear transformation on the position-encoded low-dimensional feature X to obtain the query vector Q, key vector K, and value vector V;

[0076] S34: Perform dot product calculation on the query vector Q and the key vector K to obtain a similarity matrix between the query vector Q and the key vector K, perform Softmax normalization on the similarity matrix to obtain an attention weight, and use the attention weight to weight V to obtain the attention-optimized feature A;

[0077] S35: Repeat steps S31 to S34 three times to obtain the final low-dimensional features, and use the same method to obtain the reconstructed features, and calculate the reconstruction loss and KL loss of the reconstructed features and the input features.

[0078] Through deep mapping in the ISAE autoencoder, raw features are converted into low-dimensional representations. This not only helps reduce computational complexity but also effectively removes redundant information. By adding positional encoding to the low-dimensional features, temporal information in the feature data (such as packet order and event temporal characteristics) is preserved. Repeated feature extraction and optimization (loop S31 to S34) further enhances the expressiveness and robustness of the features. While extracting low-dimensional features, the ISAE autoencoder calculates the reconstruction loss and the KL divergence loss between the input features and the reconstructed features to further ensure the model's fit to the data distribution. This dual loss setting not only enhances feature robustness but also improves the model's generalization ability. By minimizing the reconstruction loss, the model achieves more accurate reconstruction of the input data and effectively captures the distinct characteristics of normal and abnormal data. The KL loss helps the model avoid overfitting, ensuring its robustness against new attacks.

[0079] Implementation 4: This implementation further limits the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in Implementation 1. In step S3, the CNN-LSTM module is used to extract features from the preprocessed raw traffic data, including:

[0080] Input the original traffic data into the word embedding layer and map it into two-dimensional data;

[0081] The two-dimensional data is input into three residual convolutional layers to extract deep spatial features. The residual convolutional layers are composed of two convolutional layers, a batch normalization layer, a maximum pooling layer and a residual connection.

[0082] The raw traffic data is input into the LSTM layer to extract deep temporal features.

[0083] This embodiment is explained in conjunction with the first embodiment. In this embodiment, spatial features and temporal features are combined, and through the joint application of CNN and LSTM, information can be extracted at different levels. The spatial features are processed by the convolution layer, and the temporal features are modeled by the LSTM layer, and finally the reconstruction features of the ISAE autoencoder can be combined to form a multi-dimensional feature representation. This method can effectively deal with intrusion behaviors in complex and changeable industrial control environments, especially has a strong detection capability for covert attack behaviors (such as slow or imperceptible attacks). LSTM's modeling ability for time series data can help identify continuously changing traffic patterns, while the convolutional network can quickly locate potential abnormal spatial features, which provides effective support for intrusion detection in industrial control systems.

[0084] Implementation 5: This implementation further limits the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in Implementation 4. In step S3, the attention feature fusion module AFF is used to fuse the deep representation vector of the artificial feature and the deep spatial and temporal features of the original traffic data to obtain a fused feature, including:

[0085] The reshape function is used to expand the low-dimensional features obtained by the ISAE encoder module into two-dimensional features, and three residual convolution layers are used for feature extraction to obtain artificial multi-channel two-dimensional features;

[0086] Add the deep spatial features and the artificial multi-channel two-dimensional features to calculate the local attention and global attention;

[0087] Normalize the sum of local and global attention to obtain channel attention weight, and perform weighted summation of deep spatial features and artificial multi-channel two-dimensional features to obtain fusion features;

[0088] The fusion features and deep temporal features are input into the tiling layer and the global pooling layer in sequence to obtain one-dimensional features. Finally, the two are fused by Concat to obtain the final fusion features.

[0089] In this embodiment, the attention feature fusion module AFF is used to fuse artificial features and deep spatial and temporal features of the original traffic data, which can effectively combine information from two different sources. Artificial features usually include analysis of expert knowledge of industrial control systems, network behavior, etc., while deep spatial and temporal features can extract hidden patterns from traffic data. This fusion enables the intrusion detection model to better adapt to different types of attacks. Furthermore, Reshape is used to expand the low-dimensional features obtained by the ISAE encoder into two-dimensional features, and feature extraction is performed through three residual convolution layers. The neural network can better mine the nonlinear relationship between features, which helps to capture detailed information in the data and further improve the recognition of attack behavior. At the same time, the introduction of local attention and global attention and the weighting of different features can enable the intrusion detection model to better focus on features related to attack behavior in complex intrusion detection tasks, thereby improving the accuracy and robustness of detection. Combining deep spatial features with deep temporal features and further processing them through tiling layers and global pooling layers can make full use of the spatial and temporal structure of the data. This process not only enables the model to obtain important pattern information in the spatial dimension, but also captures the dynamic changes of attack behavior through the temporal dimension, enhancing the model's temporal perception ability.

[0090] The industrial control intrusion detection method proposed in this embodiment fuses multiple feature sources, making the resulting fused features more comprehensive and diverse. By fusing deep spatial features and deep temporal features through the concat method, the fused features are richer and better adapted to various attack modes. This diverse feature combination improves the model's generalization capabilities and demonstrates superior detection results even in the face of unknown attacks.

[0091] Implementation 6. This implementation further limits the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in Implementation 5. The sum of local and global attention is normalized to obtain channel attention weights, and the deep spatial features and artificial multi-channel two-dimensional features are weighted and summed to obtain fusion features, including:

[0092] L(X)=B(PWConv2(δ(B(PWConv1(X)))))

[0093] g(X)=L(GAP(X))

[0094] M(X)=σ s (L(X)+g(X))

[0095]

[0096] Among them, L is the local attention weight, g is the global attention weight, M is the fusion attention weight, PWConv is a 1×1 point-by-point convolution layer; B is a BatchNorm layer; δ is a ReLU activation function; GAP is a global pooling layer; σ s is the Sigmoid activation function, X is the deep spatial feature extracted by the CNN network, and Y is the artificial multi-channel two-dimensional feature.

[0097] Implementation method seven. This implementation method further limits the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in implementation method one. The classifier consists of two fully connected layers, a Dropout layer and a Softmax layer, and finally outputs the probability value of the classification detection to obtain the final detection result.

[0098] Implementation 8: This implementation further limits the industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion described in Implementation 1. The training process of the intrusion detection model in step S4 is as follows:

[0099] The training set samples are input into the model in batches, the classification prediction values ​​are output, the loss between the predicted values ​​and the true values ​​is calculated, and the model parameters are optimized through Adam optimizer training;

[0100] After each round of training, the model prediction effect is tested using the validation set, and the model with the best validation set effect is taken as the trained model.

[0101] Implementation method nine: A computer device described in this implementation method includes a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion as described in any one of implementation methods one to seven.

[0102] Implementation method ten, a computer-readable storage medium described in this implementation method, on which a computer program is stored, and when the computer program is executed by a processor, the steps of an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion as described in any one of implementation methods one to seven are executed.

[0103] Implementation method 11, see Figure 2 This embodiment provides a specific example of the industrial control intrusion detection method based on the ISAE autoencoder and AFF feature fusion described in the first embodiment, and is also used to explain the second to eighth embodiments. Specifically:

[0104] This example is based on the UNSW-NB15 dataset. The original traffic data collected by the network sniffing device in step S1 and the artificial features obtained by the network traffic analysis software are both provided in the dataset. Considering the characteristics of industrial control networks, some artificial features that require special attention are given:

[0105] Proto: transmission protocol type; Dur: total record duration; Sbytes: number of bytes processed from source to target; Dbytes: number of bytes processed from target to source; Sttl: lifetime from source to target; Dttl: lifetime from target to source; Service: network service type; State: network connection status; Sjit: source jitter time (milliseconds); Djit: target jitter time (milliseconds).

[0106] Step S2: preprocess the UNSW-NB15 dataset, including:

[0107] Data cleaning: Delete and fill in Nan data and missing data in artificial features, and anonymize redundant features such as timestamps, IP addresses, and IP ports in raw traffic data and artificial features. After data cleaning, the dimension of artificial features is 41.

[0108] The original traffic data is segmented. The length of the original traffic data packets varies and cannot be directly input into the neural network. Therefore, each original traffic data sample is segmented according to the specification of 40×128;

[0109] Since artificial features contain discrete character features such as 'proto', 'state', and 'sevice', the model can only process numerical inputs and cannot process discrete character features. Therefore, one-hot encoding is used to encode discrete features into multi-dimensional numerical features, expanding the feature dimension from 41 to 66.

[0110] The numerical ranges of artificial features vary, which is not conducive to model training. Therefore, all features are normalized by Z-Score. The normalization formula is:

[0111]

[0112] Among them, μ is the mean value of the feature; σ is the standard deviation of the feature;

[0113] In addition, the number of samples provided by the UNSW-NB15 data has a serious long-tail distribution characteristic, which will cause the model training process to focus too much on large samples and lead to poor detection results for small samples. Therefore, random oversampling and undersampling are used to sample all types of samples to 10,000;

[0114] Finally, the dataset is divided into training, validation and test sets in a ratio of 8:1:1.

[0115] Step S3: construct an intrusion detection model. The intrusion detection model mainly consists of four parts: ISAE autoencoder module, CNN-LSTM module, AFF feature fusion module and classifier.

[0116] The ISAE autoencoder module consists of three encoder and decoder layers. Each encoder and decoder layer consists of a fully connected layer, a batch normalization layer, a ReLU layer, and a self-attention layer. Its function is to extract the preprocessed artificial features, map them to a deep low-dimensional space, and obtain a deep representation vector. The specific process is as follows:

[0117] C301, the artificial features are passed through the fully connected layer, batch normalization layer and ReLU layer in sequence to calculate the low-dimensional features. The calculation formulas of the fully connected layer, batch normalization layer and ReLU layer are:

[0118] y=Wx+b

[0119]

[0120] Where W is the weight matrix; b is the bias vector; μ B is the statistical mean of the batch samples; σ β is the statistical standard deviation of the batch sample;

[0121] C302 performs position encoding on low-dimensional features, retains the position information of each data within the feature, and reduces the interference of the same numerical data at different positions on the model. Its calculation formula is:

[0122]

[0123] Where PE(pos,2i) and PE(pos,2i+1) are the 2i-th and (2i+1)-th components of the encoding vector at position index pos, respectively, and dmodel is the dimension of the position vector;

[0124] C303, low-dimensional features contain both important features and redundant interference features. In order to highlight important features and ignore redundant interference features, the attention mechanism is used to improve the encoder layer. First, the low-dimensional feature X after position encoding is linearly transformed in the fully connected layer to obtain the query vector Q, key vector K and value vector V. The calculation formula is:

[0125] Q=XW q

[0126] K=XW k

[0127] V=XWv

[0128] Among them, W q 、W k 、W v are the weight matrices of Q, K, and V respectively.

[0129] C304, performs dot product calculation on Q and K to obtain the similarity matrix of Q and K, then performs Softmax normalization on the similarity matrix to obtain the attention weight and weight V. The calculation formula is:

[0130]

[0131] Among them, A is the weighted feature, Dk is the length of K, which is used to normalize the variance of the similarity matrix.

[0132] C305, repeat the C301-C304 process three times, with the feature dimensions of each layer being 45, 35, and 25 respectively, and finally obtaining a 25-dimensional low-dimensional feature. The same method is used to obtain a 66-dimensional reconstructed feature, and the reconstruction loss and KL loss of the reconstructed feature and the input feature are calculated. The calculation formula is:

[0133]

[0134]

[0135] Among them, y is the original feature; σ(z) is the reconstructed feature; n is the feature dimension.

[0136] The CNN-LSTM module consists of two branches, CNN and LSTM. Its function is to extract features from the preprocessed raw traffic data and extract its deep spatial and temporal features. The specific process is as follows:

[0137] C401, inputs the original traffic data into the word embedding layer and maps it into two-dimensional data X2d, with a size of 40×128×128;

[0138] C402, two-dimensional data X 2d Input to three residual convolution layers to extract deep spatial features Xcnn. The deep spatial size is 128×4×4. The feature residual convolution layer consists of two convolution layers, a batch normalization layer, a maximum pooling layer, and a residual connection. The calculation formula of the convolution layer is:

[0139]

[0140] in, is the output feature of the l-th layer convolution; * is the convolution operation; σ is the activation function; M j is the feature set of the previous layer; is the convolution kernel; is the offset.

[0141] C403, inputs the original traffic data into the LSTM layer to extract the deep time feature X lstm , the size of the deep temporal feature is 40×128, and its internal calculation formula is:

[0142] i t =σ(W ix x t +W ih h t-1 +b i )

[0143] f t =σ(W fx x t +W fh h t-1 +b f )

[0144] o t =σ(W ox x t +W of h t-1 )+b o

[0145] h t =o t e tanh(C t )

[0146] C t =f t e C t-1 +i t e tanh(W cx x t +W ch h t-1 +b c )

[0147] Y t =φ(W yh h t +b y )

[0148] Where: I t 、f t 、o t are the states of the input gate, forget gate, and output gate at time t; σ is the Sigmoid activation function; φ is the Softmax activation function; e is the matrix element multiplication; W ix 、W fx 、W ox 、W cx is the input-state weight matrix; Wih 、W fh 、W of 、W ch is the state-state weight matrix; b i 、b f 、b o 、b c is the offset; Y t is the output result at time t.

[0149] The function of the AFF feature fusion module is to fuse the deep representation vector of the artificial feature and the deep spatiotemporal features of the original traffic data to obtain the fused feature. The specific process is as follows:

[0150] C501, uses Reshape to expand the low-dimensional features obtained by the ISAE encoder network into 5×5 two-dimensional features, and uses the convolutional network designed in C402 for feature extraction to obtain the multi-channel two-dimensional features Y of the artificial features, with a feature format of 128×4×4;

[0151] C502, the deep spatial feature X cnn And the artificial multi-channel two-dimensional feature Y is added to calculate its local attention and global attention, and then the sum of local and global attention is normalized to obtain the channel attention weight ω, which is used for the deep spatial feature X cnn The weighted summation of the artificial multi-channel two-dimensional feature Y is used to obtain the fusion feature, and its calculation formula is:

[0152] L(X)=B(PWConv2(δ(B(PWConv1(X)))))

[0153] g(X)=L(GAP(X))

[0154] M(X)=σ s (L(X)+g(X))

[0155]

[0156] Among them, L, g and M are local attention, global attention and fusion attention weights; PWConv is a 1×1 point-by-point convolution layer; B is a BatchNorm layer; δ is a ReLU activation function; GAP is a global pooling layer; σ s is the Sigmoid activation function.

[0157] C503, the fusion feature obtained by C502 and the deep time feature X lstm The features are input into the tiling layer and the global pooling layer in sequence to obtain one-dimensional features of length 16. Finally, the two are fused by Concat to obtain the final fused features of length 32.

[0158] The classifier consists of two fully connected layers, a dropout layer, and a softmax layer, ultimately outputting the expected probability values ​​for each category to obtain the final detection result. The output feature lengths of each fully connected layer are 16 and 5 respectively; the parameter of the dropout layer is 0.2.

[0159] In step S4, the hardware configuration for model training is Ubuntu 20.04, Intel(R) Core(TM) i9-10900KF CPU @ 3.70GHz, GPU: GeForce RTX 3090. The initial learning rate is 0.001, the batch size is 128, the learning rate optimization strategy is StepLR, and the L2 decay weight is 1e -4 , the number of training rounds is 100. The specific model training process is as follows:

[0160] C701 divides the training set data into multiple batches based on the batch size, inputs the data into the model in batches, outputs the classification prediction value, calculates the loss between the predicted value and the true value, and uses the Adam optimizer to optimize the model parameters based on the loss value. Parameter optimization is performed once for each batch of data input. The loss calculation formula is:

[0161]

[0162] Among them, Loss cla is the classification loss, is the cross entropy loss between the prediction and the true label; Loss AE is the autoencoder loss, which is the sum of the reconstruction loss and KL loss calculated in C305; ω is the classification loss weight coefficient; detach() is the tensor separation function so that it does not participate in back propagation.

[0163] C702: The model completes one training run for the entire training set, called one round, or 1 epoch. After each epoch, the model's prediction performance is tested on the validation set, and the model with the best validation set performance is selected as the trained model.

[0164] In step S5, the test set data pre-processed in step S2 is input into the trained intrusion detection model to obtain the intrusion detection results and performance of the model in the actual environment.

[0165] Those skilled in the art will appreciate that embodiments of the present disclosure may be provided as methods, systems, or computer program products. Thus, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0166] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including the instruction device, which implements the function specified in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0168] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present disclosure and are not intended to limit its scope of protection. Although the present disclosure has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that after reading the present disclosure, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the invention, but these changes, modifications or equivalent substitutions are all within the scope of protection of the disclosed claims.

Claims

1. An industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion, characterized in that: The method comprises: S1: Collect raw traffic data, obtain corresponding artificial features based on the raw traffic data, and construct a training dataset based on the artificial features; S2: Data preprocessing of raw traffic data and artificial features; S3: Build an intrusion detection model, including: an improved stacked autoencoder module ISAE that inputs artificial features, a CNN-LSTM module that inputs raw traffic data, an attention feature fusion module AFF, and a classifier; S4: training intrusion detection model; S5: Input the test set data into the trained intrusion detection model to obtain the intrusion detection results; In step S3, the ISAE autoencoder is used to extract the preprocessed artificial features, map them to a deep low-dimensional space, and obtain a deep representation vector, including: S31: The artificial features are passed through the fully connected layer, batch normalization layer and ReLU layer in sequence to calculate the low-dimensional features; S32: Position encoding of low-dimensional features; S33: Perform a fully connected layer linear transformation on the position-encoded low-dimensional feature X to obtain the query vector Q, key vector K, and value vector V; S34: Perform dot product calculation on the query vector Q and the key vector K to obtain a similarity matrix between the query vector Q and the key vector K, perform Softmax normalization on the similarity matrix to obtain an attention weight, and use the attention weight to weight V to obtain the attention-optimized feature; S35: Repeat steps S31 to S34 three times to obtain the final low-dimensional features, and use the same method to obtain the reconstructed features, and calculate the reconstruction loss and KL loss of the reconstructed features and the input features; In step S3, the CNN-LSTM module is used to extract features from the preprocessed raw traffic data, including: Input the original traffic data into the word embedding layer and map it into two-dimensional data; The two-dimensional data is input into three residual convolutional layers to extract deep spatial features. The residual convolutional layers are composed of two convolutional layers, a batch normalization layer, a maximum pooling layer and a residual connection. Input the raw traffic data into the LSTM layer to extract deep temporal features; In step S3, the attention feature fusion module AFF is used to fuse the deep representation vector of the artificial feature and the deep spatial and temporal features of the original traffic data to obtain a fused feature, including: Reshape is used to expand the low-dimensional features obtained by the ISAE encoder module into two-dimensional features, and three residual convolution layers are used for feature extraction to obtain artificial multi-channel two-dimensional features; Add the deep spatial features and the artificial multi-channel two-dimensional features to calculate the local attention and global attention; Normalize the sum of local and global attention to obtain channel attention weight, and perform weighted summation of deep spatial features and artificial multi-channel two-dimensional features to obtain fusion features; The fusion features and deep temporal features are input into the tiling layer and the global pooling layer in sequence to obtain one-dimensional features. Finally, the two are fused by Concat to obtain the final fusion features.

2. The industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion according to claim 1 is characterized in that: The data preprocessing in step S2 includes: S21: Data cleaning, including: deleting or filling Nan data and missing data in artificial features; anonymizing the timestamps, IP addresses, and IP ports in the original traffic data and artificial features; S22: data segmentation of the original traffic data; S23: Perform one-hot encoding on the character-type discrete features in the artificial features and perform numerical normalization on the numerical features; S24: Process the data imbalance; S25: Divide the training set, validation set and test set.

3. The industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion according to claim 1 is characterized in that: The sum of local and global attention is normalized to obtain channel attention weights, and the deep spatial features and artificial multi-channel two-dimensional features are weighted and summed to obtain fusion features, including: Among them, L is the local attention weight, g is the global attention weight, M is the fusion attention weight, PWConv is a 1×1 point-by-point convolution layer; B is a BatchNorm layer; δ is a ReLU activation function; GAP is a global pooling layer; σ s is the Sigmoid activation function, X is the deep spatial feature extracted by the CNN network, and Y is the artificial multi-channel two-dimensional feature.

4. The industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion according to claim 1 is characterized in that: The classifier consists of two fully connected layers, a Dropout layer and a Softmax layer, and finally outputs the probability value of the classification detection to obtain the final detection result.

5. The industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion according to claim 1 is characterized in that: The training process of the intrusion detection model in step S4 is: The training set samples are input into the model in batches, the classification prediction values ​​are output, the loss between the predicted values ​​and the true values ​​is calculated, and the model parameters are optimized through Adam optimizer training; After each round of training, the model prediction effect is tested using the validation set, and the model with the best validation set effect is taken as the trained model.

6. A computer device, characterized in that: The invention comprises a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion according to any one of claims 1 to 5.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of an industrial control intrusion detection method based on ISAE autoencoder and AFF feature fusion according to any one of claims 1 to 5.

Images