Industrial control network intrusion detection method based on litude particle swarm optimization selection

Abstract

The invention relates to an industrial control network intrusion detection method, in particular to an industrial control network intrusion detection method based on altricity particle swarm optimization selection, which provides a double-layer intrusion detection model, improves the recognition capability of novel and rare attacks under the condition of keeping high recognition rate of common attacks, and improves the recognition efficiency of the novel and rare attacks. Aiming at unique requirements of an industrial control network environment, the invention provides a network intrusion detection model based on a double-layer architecture, and effectively solves the key problems of poor detection effect of minority attacks, data imbalance, difficulty in processing complex traffic characteristics and the like in the industrial control network. The overall performance of the industrial control network intrusion detection system is effectively improved, a new technical scheme is provided for guaranteeing the continuity and safety of industrial production, and the industrial control network intrusion detection system has important practical significance and wide application prospects.

Description

Technical Field

[0001] The invention relates to an industrial control network intrusion detection method, in particular to an industrial control network intrusion detection method based on altruistic particle swarm optimization selection. Background Art

[0002] With the continuous development of industrial automation and intelligent technology, industrial control networks (ICS) have become the core infrastructure of modern industrial production. ICS are widely used in power, oil, gas, manufacturing and other fields. The security of these systems is directly related to the stable operation of national infrastructure and social and economic security. However, while enjoying the convenience brought by intelligence, industrial control networks are also facing increasingly severe network security threats. Especially when connected to the public Internet or other external networks, ICS are facing more and more network attacks and intrusions, threatening the normal operation of equipment, data integrity and system security.

[0003] Traditional industrial control network security protection measures mainly rely on firewalls, intrusion detection systems (IDS) and other rule-based monitoring methods. However, the particularity of ICS determines that its traditional network defense methods have many shortcomings. For example, ICS traffic usually contains a large amount of time-sensitive data, which makes it difficult for traditional signature and rule-based detection methods to accurately identify new and variant attacks. In addition, there are many types of equipment in industrial control networks, complex and non-standard protocols, and traffic data often has a high degree of time sequence and dependence, which makes traditional intrusion detection methods have weak processing capabilities for these complex data, especially for the identification of minority attacks. Summary of the invention

[0004] The purpose of the present invention is to provide an industrial control network intrusion detection method based on altruistic particle swarm optimization selection. The present invention proposes a network intrusion detection model based on a two-layer architecture, which effectively solves the key problems such as poor detection effect of minority attacks in industrial control networks, data imbalance and difficulty in processing complex traffic characteristics, and effectively improves the overall performance of the industrial control network intrusion detection system.

[0005] The objective of the present invention is achieved through the following technical solutions:

[0006] An industrial control network intrusion detection method based on altruistic particle swarm optimization selection is proposed. The method includes proposing a two-layer intrusion detection model to improve the recognition ability of new and rare attacks while maintaining a high recognition rate for common attacks. The execution process of the model is as follows:

[0007] First, the traffic data is preprocessed and the APSO algorithm is used for feature selection, and then the traffic is hierarchically classified;

[0008] The first-layer classification uses a model that combines a convolutional neural network (CNN) and a bidirectional long short-term memory network (BiLSTM) to perform coarse-grained classification of traffic, dividing it into normal traffic, common attack categories, and merged minority attack categories; the second-layer classification uses a stacked ensemble learning method to perform fine-grained classification of minority attacks transmitted by the first layer;

[0009] The output of the second layer in the running process of the two-layer intrusion detection model not only includes the subdivided minority attack classes, but also some normal or mainstream attack classes; the first layer correctly classifies all normal and mainstream attack traffic, and the output merged minority attacks only include minority attacks. In the second layer, the traffic that was misclassified in the first layer is reclassified to improve the recognition rate of suspicious traffic.

[0010] The advantages and effects of the present invention are:

[0011] 1. The dual-layer network intrusion detection model of the present invention fully considers the particularity of industrial control networks. By combining the powerful capabilities of deep learning in feature extraction and temporal pattern recognition with the classification advantages of multi-model fusion of stacked ensemble learning under small sample sizes, it solves the problem of difficulty in identifying minority attacks in the ICS environment. This model can not only effectively deal with the complex traffic characteristics and attack patterns in ICS, but also has high robustness, can adapt to traffic data in different industrial environments, and improve the overall intrusion detection accuracy and real-time performance. Through the present invention, the security protection capability of the industrial control network has been significantly improved, which can better deal with new network attacks, zero-day attacks and variant attacks, and ensure the continuity and security of industrial production.

[0012] 2. Aiming at the unique needs of industrial control network environment, the present invention proposes a network intrusion detection model based on a two-layer architecture, which effectively solves key problems such as poor detection of minority attacks, data imbalance and difficulty in handling complex traffic characteristics in industrial control networks, effectively improves the overall performance of the industrial control network intrusion detection system, and provides a new technical solution to ensure the continuity and security of industrial production. It has important practical significance and broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 For the present invention Figure 1 APSO algorithm execution flow chart;

[0014] Figure 2 This is a flow chart of the operation of the double-layer intrusion detection model of the present invention. DETAILED DESCRIPTION

[0015] The present invention will be described in detail below with reference to the embodiments shown in the accompanying drawings.

[0016] Based on the altruistic particle swarm optimization algorithm (APSO), in industrial control networks, attackers often penetrate the system through carefully designed minority attacks (such as port scanning, slow DDoS attacks, etc.). The characteristics of these attacks are relatively hidden, and the traffic data of the industrial control network itself is also very complex. Therefore, by intelligently selecting and optimizing features and screening out the features that are most helpful for classification tasks, the recognition ability of the model can be effectively improved.

[0017] In the traditional PSO algorithm, the particle swarm often converges too quickly in the search space and is prone to falling into the local optimal solution. There is a phenomenon in nature that some individuals will make sacrifices for the benefit of the group. We introduce this altruistic behavior into PSO. Let particles with better performance help particles with poorer performance, thereby improving the group's search ability.

[0018] The Altruistic Particle Swarm Optimization (APSO) algorithm starts with the initialization phase. It first randomly generates the position and velocity vectors of the particle swarm, calculates the initial fitness value for each particle, and sets important parameters such as inertia weight, individual learning factor (C1), group learning factor (C2), particle swarm size (N), maximum number of iterations, etc. These parameters determine the search behavior of the particles and the global and local balance of the algorithm. After initialization, the algorithm enters the iterative optimization phase, which is the core part of the algorithm.

[0019] In each iteration, the speed of the particle is first adjusted by the speed update formula of the standard PSO, which combines the inertia term, the individual cognitive term, and the social cognitive term, corresponding to the particle's own experience and the group experience, respectively. Then, the position of the particle is adjusted according to the updated speed to ensure that the particle moves in the solution space to explore potential optimal solutions. After the speed and position update is completed, the fitness values ​​of all particles are recalculated, and the individual optimal position and the global optimal position are recorded. The goal of this stage is to maintain the basic optimization ability of the algorithm through the mechanism of the standard PSO.

[0020] Since the direction of particle movement is determined by its previous best particle position and the global best position, the calculation of speed is the same as direction. Specifically, it is to comprehensively consider the three factors of the current speed of the particle, the distance between the particle and the best position, and the speed of the particle at the global best position, so as to obtain a reasonable speed for the next iteration. After obtaining the new speed and direction, the new particle position can be determined. Therefore, ideally, each particle explores everywhere to find the optimal solution. However, in reality, the global optimal solution found by the particle is often a local optimal solution, and subsequent particle updates will be adjusted based on this position. Since PSO lacks a mechanism to jump out of the local optimum, the particle swarm may explore around the local optimal solution and cannot continue to explore other potential global optimal solutions. Therefore, we need to explore ways to jump out of the local optimal solution.

[0021] Next, APSO introduces its core altruism mechanism to enhance the search capability and jump out of the local optimal solution. First, all particles are sorted by the current fitness value, and the top k% particles with the best performance are selected as elite particles. These elite particles will not participate in the altruistic process to ensure that they can stably converge to the global optimal solution. For the remaining non-elite particles, they are further divided into the upper group (better performing particles) and the lower group (poorer performing particles) according to the fitness value. Through pairing, the upper group of particles forms a one-to-one relationship with the lower group of particles, and passes some of their own characteristics and speed to the lower group of particles.

[0022] In the pairing process, instead of simply transmitting all information, the speed and characteristics of the "better performing particle" are used to determine whether to transmit the corresponding speed and characteristics to the "poorer performing particle", as shown in formula (1). Among them, rand(x) is a random number function used to generate a random number in the interval [0,1]. a is an editable parameter, and the efficiency of information transmission during the pairing process can be adjusted by adjusting the size of a.

[0023]

[0024] In addition, the inertia weight coefficient is updated in a linear decreasing manner according to formula (2).

[0025]

[0026] where w k is the inertia weight at the kth iteration, w max is the initial inertia weight w min is the minimum inertia weight, k is the current iteration number (from k to K), and K is the maximum iteration number. In general, the algorithm performs best when w max =0.9,w min =0.4.

[0027] After the altruistic process is completed, the individual optimal positions and global optimal positions of all particles are updated. At this point, the global optimal position reflects the overall optimization level of the current particle swarm. The above process is repeated iteratively until the termination condition is met. Common termination conditions include reaching the maximum number of iterations or the change in the global optimal solution is less than the preset threshold. In the last step of the algorithm, the global optimal position and its corresponding objective function value are returned as the final optimization result. See Figure 1 APSO algorithm execution process

[0028] By introducing the altruism mechanism, the APSO algorithm significantly improves the learning efficiency of low-fitness particles while retaining the global exploration capability of the standard PSO, thereby accelerating the convergence speed and effectively avoiding falling into the local optimum. In addition, the elite protection strategy ensures the continuous optimization of high-fitness particles, allowing the entire group to evolve stably towards the optimal solution.

[0029] Two-layer intrusion detection model,The traffic characteristics of industrial control networks usually contain a lot of time series information. At the same time, the attack patterns in ICS networks are diverse and complex, and minority attacks (such as advanced persistent threats, zero-day attacks, etc.) are very rare in the data. Traditional rule-based intrusion detection methods cannot accurately identify new attacks and have great limitations in identifying minority attacks.

[0030] Therefore, the present invention proposes a two-layer intrusion detection model, which improves the recognition ability of new and rare attacks while maintaining a high recognition rate for common attacks. The execution process of the model is as follows: Figure 2 As shown in the figure, the traffic data is first preprocessed, and the APSO algorithm is used for feature selection, and then the traffic is hierarchically classified.

[0031] The first-layer classification uses a model that combines a convolutional neural network (CNN) and a bidirectional long short-term memory network (BiLSTM) to perform coarse-grained classification of traffic, dividing it into normal traffic, common attack categories, and merged minority attack categories. By introducing the attention mechanism, the first layer can better capture the temporal characteristics of traffic and improve the accuracy of classification.

[0032] The second layer of classification uses a stacked ensemble learning approach to perform fine-grained classification of minority attacks passed from the first layer. In the first layer, minority attacks are merged into one class, but these attacks are often highly variable and complex. A single classification model may not be able to accurately distinguish between different types of minority attacks, so a more sophisticated classification step is needed to perform fine-grained identification of minority attacks to ensure that high-risk attacks in ICS environments can be identified. Stacked ensemble learning combines the prediction results of multiple models and the advantages of multiple basic classifiers to more stably classify minority attacks. See Figure 2 Two-layer intrusion detection model operation process.

[0033] It is not difficult to find that the output of the second layer contains not only the subdivided minority attacks, but also some normal or mainstream attack classes. Ideally, the first layer correctly classifies all normal and mainstream attack traffic, and the output of the merged minority attacks only contains minority attacks, but in reality, the classification process of the first layer will more or less produce some errors, and some non-minority attacks will be mistakenly passed to the second layer. Therefore, in the second layer, we will reclassify the traffic that was misclassified in the first layer, so as to further improve the recognition rate of suspicious traffic.

Claims

1. An industrial control network intrusion detection method based on altruistic particle swarm optimization selection, characterized in that: The method proposes a two-layer intrusion detection model, which improves the recognition ability of new and rare attacks while maintaining a high recognition rate for common attacks. The execution process of the model is as follows: First, the traffic data is preprocessed and the APSO algorithm is used for feature selection, and then the traffic is hierarchically classified; The first-level classification uses a model that combines a convolutional neural network (CNN) and a bidirectional long short-term memory network (BiLSTM) to perform coarse-grained classification of traffic, dividing it into normal traffic, common attack categories, and merged minority attack categories; The second layer of classification uses a stacked ensemble learning method to perform fine-grained classification of minority class attacks passed from the first layer; The output of the second layer in the running process of the two-layer intrusion detection model not only includes the subdivided minority attack classes, but also some normal or mainstream attack classes; the first layer correctly classifies all normal and mainstream attack traffic, and the output merged minority attacks only include minority attacks. In the second layer, the traffic that was misclassified in the first layer is reclassified to improve the recognition rate of suspicious traffic.

Images