A fine-grained attack intrusion detection method, system, storage medium and terminal device for an industrial control network

Abstract

The present application relates to the technical field of network intrusion detection, and in particular to a fine-grained attack intrusion detection method and system for industrial control network. The method comprises data preprocessing on the obtained network data; inputting the training samples of the network data into a neural network for training; and classifying the test set by using the trained neural network, wherein the decision boundary of unknown categories is determined by measuring the Mahalanobis distance of the feature representation of the test samples and the training samples, so as to realize the detection of unknown category attacks. The dynamic separation loss function proposed in the present application can guide the neural network to obtain more distinctive data representation features, and improve the classification performance of the model for fine-grained industrial protocol attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network intrusion detection, and in particular to a fine-grained attack intrusion detection method and system for an industrial control network. BACKGROUND

[0002] With the continuous enhancement of the intelligence level of industrial control networks, the "isolation" between traditional industrial control and information networks has been broken. This change has promoted the rapid development of industrial control networks, but also brought serious security challenges. In recent years, deep learning has brought new solutions to industrial control network intrusion detection due to its excellent feature extraction and classification ability. However, the increasing complexity of the network environment has significantly restricted its direct application in industrial control systems. First, with the continuous improvement of attacker skills, industrial control networks frequently encounter fine-grained industrial protocol attacks with clear purpose and direction. These attacks are very similar to normal communication traffic, and small changes in the fields of data packets can cause system crashes. Second, the increasing complexity of the network environment makes industrial control networks face many unknown network threats. Traditional classification models have limitations because they cannot cover all attack types. Finally, the attack data owned by different industrial enterprises is distributed differently. The data may be balanced or unbalanced, and traditional classification models cannot provide stable performance when dealing with such complex data distribution. Therefore, under such a complex background, it is a very challenging task to build an efficient industrial control network intrusion detection model.

[0003] Existing research proposes an integrated intrusion detection method based on extreme gradient boosting trees and LSTM neural networks. This method first uses gradient boosting trees to analyze the importance of network security data features, then inputs important features into a bidirectional LSTM neural network to identify attack categories, and uses a class-balanced (CB) loss to guide the gradient descent training of the neural network during this process to improve the classification ability of the detection model under unbalanced data. However, using class-balanced loss to increase the attention of the model to minority class samples can enhance the detection performance of the model under data imbalance. However, the data distribution owned by each industrial enterprise is not the same. This approach will negatively affect the model's performance in relatively balanced sample cases, and the model's generalization ability is weak.

[0004] And there is also a study that proposes a network unknown attack detection method in an open environment. The method first maps the attack sample data to a low-dimensional space. Then, using the idea of contrast learning, the distance function between the sample and the class center is learned from the training data to measure the difference between different classes, and the median absolute deviation is used to estimate whether the test sample is an outlier to determine the decision boundary of the model, so as to realize the detection of unknown network attacks. Although it can successfully detect unknown class data, when applied to fine-grained industrial protocol attack detection, it is difficult for the model to obtain more discriminative deep features, resulting in poor performance. In addition, this method will divide some known attacks into unknown attacks.

[0005] In summary, the existing industrial control network intrusion detection methods have the problems of poor practicability, weak model generalization ability, and one-sided consideration, which leads to low performance and difficulty in deployment and application in industrial control networks, and low practicability and reference value. SUMMARY

[0006] In order to solve the above-mentioned problems, the present application provides a fine-grained attack intrusion detection method and system for industrial control networks. The method can realize the detection of various data distribution fine-grained network attacks and effectively identify unknown attacks.

[0007] In the first aspect, the present application provides a fine-grained attack intrusion detection method for industrial control networks, which adopts the following technical scheme:

[0008] A fine-grained attack intrusion detection method for industrial control networks, comprising:

[0009] Obtaining network data and dividing the network data into test samples and training samples;

[0010] Data preprocessing is performed on the obtained network data;

[0011] The training samples of the network data are input into a neural network for training;

[0012] The trained neural network is used to classify the test set, wherein the Mahalanobis distance between the test sample and the training sample feature representation is measured to determine the decision boundary of the unknown class, thereby realizing the detection of unknown class attacks.

[0013] Further, the network data is obtained, including obtaining a pipeline data set and a honeypot data set, the pipeline data set including network traffic features, load features and state features, and the honeypot data set including communication strategy features, communication intensity features and communication content features.

[0014] Further, the data preprocessing of the obtained network data comprises converting all character type features in the data set into numerical type features through one-hot encoding, normalizing all numerical type features, and normalizing the normalized features.

[0015] Further, the inputting of the training sample of the network data into the neural network for training comprises inputting the training sample into two parallel CNN networks with convolution kernel sizes of 2 and 4 respectively, then performing vector splicing on local features obtained after convolution, then inputting the spliced feature vector into a bidirectional GRU network with 128 neurons, and finally inputting the GRU hidden layer feature vector into a fully connected layer with 64 neurons to obtain sample feature representation.

[0016] Further, the inputting of the training sample of the network data into the neural network for training further comprises adopting a center loss to measure the difference between the true value and the predicted value, wherein a separation loss function is proposed on the basis of the center loss, the separation loss function is used to gradually expand the distance between samples of adjacent classes to obtain more distinguishable sample feature representation, and a dynamic separation loss function with better generalization ability is proposed by combining the separation loss and the class balance loss, so as to promote the model to learn the features of majority class samples in the early training stage and improve the model performance.

[0017] Further, the training of the neural network by using the training sample of the network data further comprises performing a loss function gradient descent algorithm on each training sample i and updating the neural network model parameters, and the gradient descent formula is:

[0018]

[0019] wherein e represents the current training round of the neural network, v i is the feature representation of the i th sample;

[0020] The neural network model parameters are updated, and the formula is:

[0021]

[0022] wherein μ = 0.01 is the learning rate, w e is the neural network model parameter of this round, w e+1 is the updated neural network model parameter.

[0023] Further, the decision boundary of the unknown class is determined by measuring the Mahalanobis distance between the test sample and the feature representation of the training sample, including for the test sample d, obtaining the feature representation of the sample by loading the trained model parameters, calculating the Mahalanobis distance between the multivariate Gaussian distribution of all known classes and the feature representation v d of the test sample, and the calculation method is as follows:

[0024] L = {l1, l2,..., ln} N}

[0025]

[0026] wherein l j represents the Mahalanobis distance between the multivariate Gaussian distribution of the jth sample and the feature representation of the test sample, u j is the mean of the multivariate Gaussian distribution of the jth sample, u i,j represents the feature representation of the ith sample in the jth class, and Σ j is the covariance matrix of the multivariate Gaussian distribution of the jth sample.

[0027] Further, the decision boundary of the unknown class is determined by measuring the Mahalanobis distance between the test sample and the feature representation of the training sample, including judging the class to which the test sample belongs, when all distance values in the Mahalanobis distance set L are greater than 95% of the chi-square distribution of each known class, that is , the sample is determined as an unknown class, otherwise it will output the known class result through the Softmax function, and the calculation method is as follows:

[0028] wherein v d is the feature representation of the sample d, and p d,j represents the probability that the sample d belongs to the jth class.

[0029] Secondly, a fine-grained attack intrusion detection system for an industrial control network comprises:

[0030] A data acquisition module configured to acquire network data and divide the network data into test samples and training samples;

[0031] A preprocessing module configured to perform data preprocessing on the acquired network data;

[0032] A training module configured to input the training samples of the network data to a neural network for training;

[0033] A classification module configured to classify the test set using the trained neural network, wherein the decision boundary of the unknown class is determined by measuring the Mahalanobis distance between the test sample and the feature representation of the training sample, thereby realizing the detection of unknown class attacks.

[0034] In a third aspect, the present application provides a computer readable storage medium, wherein a plurality of instructions are stored, the instructions being adapted to be loaded by a processor of a terminal device and to execute the method for fine-grained attack intrusion detection of an industrial control network.

[0035] In a fourth aspect, the present application provides a terminal device, comprising a processor and a computer readable storage medium, the processor being configured to implement the instructions, and the computer readable storage medium being configured to store a plurality of instructions, the instructions being adapted to be loaded by the processor and to execute the method.

[0036] In summary, the present application has the following beneficial technical effects:

[0037] The dynamic separation loss function can guide the neural network to obtain more distinctive data representation features, and improve the classification performance of the model for fine-grained industrial protocol attacks.

[0038] The present application proposes a dynamic separation loss training method based on the separation loss, which divides the training process and enables the model to dynamically adjust the attention to the samples during the training process, thereby improving the performance of the model on different data partitions and showing better generalization ability.

[0039] The model proposed in the present application can dynamically adjust the attention of the model to different categories of data during the training process, improve the performance of the model under different data distributions, and show stronger generalization ability. The model can obtain more accurate known category boundaries, thereby improving the detection performance of the model for unknown categories.

[0040] The present application proposes an unknown attack recognition method, which divides the decision boundary by measuring the Mahalanobis distance between the sample feature representations in the high-dimensional space, thereby realizing the detection of unknown attacks. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 Flowchart for fine-grained attack intrusion detection of industrial control network

[0042] Figure 2 Structure diagram of hybrid neural network

[0043] Figure 3 Optimization idea diagram of separation loss function

[0044] Figure 4 Multi-phase variation trend diagram in separation loss

[0045] Figure 5 Dynamic separation loss variation trend diagram

[0046] Figure 6A case illustration diagram for the industrial honeypot dataset

[0047] Figure 7 A case illustration diagram for the natural gas pipeline dataset

[0048] Figure 8 A detection effect diagram of the separation loss on the known class;

[0049] Figure 9 A feature representation visualization diagram of the honeypot dataset;

[0050] Figure 10 A feature representation visualization diagram of the natural gas pipeline dataset;

[0051] Figure 11 A detection effect diagram of different loss functions on each data partition of the honeypot dataset;

[0052] Figure 12 A detection effect diagram of different loss functions on each data partition of the natural gas pipeline dataset;

[0053] Figure 13 A detection effect diagram of different methods on the unknown class;

[0054] Figure 14 A confusion matrix diagram of Fuzzing as the unknown class in the honeypot dataset;

[0055] Figure 15 A confusion matrix diagram of NMRI as the unknown class in the natural gas pipeline dataset. DETAILED DESCRIPTION

[0056] The application will be further described in detail below with reference to the accompanying drawings.

[0057] Embodiment 1

[0058] Reference Figure 1 The fine-grained attack intrusion detection method for the industrial control network of the embodiment includes:

[0059] Obtain network data and divide the network data into test samples and training samples;

[0060] Perform data preprocessing on the obtained network data;

[0061] Input the training samples of the network data into a neural network for training;

[0062] Classify the test set by using the trained neural network, wherein the decision boundary of the unknown class is determined by measuring the Mahalanobis distance of the feature representation of the test samples and the training samples, so as to realize the detection of the unknown class attack.

[0063] The method includes the following steps:

[0064] The natural gas pipeline dataset disclosed by Mississippi State University and the honeypot dataset disclosed by Northeastern University in the United States. The former has 97019 data, each data containing 26-dimensional features, including 10 network traffic features (device ID, register position, register byte number, packet length, packet time interval, CRC error rate, etc.), 8 load features (function code, physical measurement value, control mode, water pump state, etc.), and 8 industrial process state features (pipeline pressure, control scheme, solenoid valve state, PID controller state and parameter, etc.). The latter has 57549 data, each data containing 11 features, including 3 communication strategy features (packet sequence number, whether to respond, transmission layer protocol), 4 communication intensity features (packet length, packet number, link sequence number, link number), and 4 communication content features (transaction identifier, unit identifier, function code, and pre-packet unit value). The features of the two datasets include both numerical and character types, and are stored in CSV files. 80% of the data in the two datasets are used for training, and 20% of the data are used for testing.

[0065] Step one: data preprocessing of the dataset to obtain the input data of the neural network, the specific steps are as follows:

[0066] (1) All character type features in the dataset are converted into numerical type features by one-hot encoding.

[0067] (2) Standardize all numerical features, the formula is as follows:

[0068]

[0069] Where r is the original feature value, μ is the average value of the feature, s is the standard deviation of the feature, and z is the standardized feature value.

[0070] (3) Normalize the standardized features, the formula is as follows:

[0071]

[0072] Where Z min is the minimum value of the feature, Z max is the maximum value of the feature, and x is the normalized feature value.

[0073] Step two: constructing a neural network

[0074] In order to effectively extract the feature representation of the attack sample, the present application designs a hybrid neural network structure for the fine-grained attack sample of the industrial control network, as shown in Figure 2As shown, it is composed of three modules of spatial feature extraction, sequence feature extraction and feature fusion. The industrial control network attack often shows local feature coordination anomaly, the application extracts the correlation between adjacent features from different spatial scales by using two parallel CNN networks, the convolution kernel size of the two CNNs is 3 and 5 respectively, and the number of convolution kernels is 16. The attack on the industrial control network has the characteristics of multi-step complexity, and the application effectively captures the time sequence relationship between the features by two bidirectional GRU networks, each bidirectional GRU network is composed of 64 neurons. The feature fusion module is composed of a 4-head self-attention network, two residual blocks and an average pooling layer. The 4-head self-attention network is used to quantify the correlation between spatial features and sequence features, and to suppress the influence of noise features on the performance of the model. In order to alleviate the gradient disappearance problem in the neural network, the two residual blocks will respectively accept the outputs of the spatial and sequence feature modules to retain the original features, and combine the outputs of the self-attention network to improve the generalization ability of the model. The average pooling layer is used to reduce the model parameters and give the feature representation of the sample.

[0075] Step three: input the data processed in step one into the neural network for training, the specific steps are as follows:

[0076] (1) For sample i, input it into the two parallel CNN networks of the spatial feature extraction module to extract local features, the calculation formula is as follows:

[0077]

[0078] Where, b is the serial number of the sample, c is the convolution kernel serial number, p is the output position index, and k is the weight index in the convolution kernel. conv3 And W conv5 represent the weight matrix of the two CNN networks, the initial value is a random matrix, b conv3 And b conv5 are the convolution bias items of the two CNN networks, H conv3 And H conv5 are the feature vectors of the two CNN networks, and ReLU(·) is the activation function.

[0079] (2) The features obtained after convolution are spliced, and the calculation formula is as follows:

[0080] H space = Concat(H conv3 ,H conv5 ) (4)

[0081] (3) Input sample X into the two serial bidirectional GRU networks of the sequence feature extraction module to extract the dependency between features, the calculation formula is as follows:

[0082] Hgru1 = BiGRU1(H

[0083] H seq = BiGRU2(H gru1 ) (5)

[0084] where H gru1 and H seq are the feature vectors of two bidirectional GRU networks

[0085] (4) The feature vectors obtained by the spatial feature extraction module and the sequence feature extraction module are spliced, and the calculation formula is as follows:

[0086] H fusion = Concat(H space ,H seq ) (6)

[0087] (5) The spliced feature vector is input into the 4-head self-attention network in the feature fusion module to capture the complex dependency relationship between the two kinds of features. Each head will calculate the query, key, value and weight matrix of attention, and splice the output of each head, and the calculation formula is as follows:

[0088]

[0089] Head n = A n V n

[0090] H atten = Concat(Head1,Head2,Head3,Head4)(7)

[0091] where n is the attention head number, are the projection matrices of the query, key and value of the nth head. A n is the weight matrix of the nth head, d = 24 is the scaling factor, and Head n is the output feature of the nth head.

[0092] (6) The spliced feature vector is input into two residual blocks with the spatial features obtained in (2) and the sequence features obtained in (3) to solve the problem of feature information loss caused by network depth.

[0093] The calculation formula is as follows:

[0094] H res1 = ReLU(H space +H atten )

[0095] H res2= ReLU(H seq + H atten ) (8)

[0096] where ReLU(·) is an activation function.

[0097] (7) The feature vectors of the two residual blocks are input into the average pooling layer to reduce the dimension of the features and retain the global feature information. The calculation formula is as follows:

[0098]

[0099] where N is the number of features of the data, which determines the value of the time step T, v i is the feature representation obtained after the sample X is processed by the hybrid neural network.

[0100] (8) Calculate the loss function of the neural network. When performing fine-grained attack classification, the center loss is usually used to measure the difference between the true value and the predicted value, and the calculation formula is as follows:

[0101]

[0102] where y i,j represents the value of the jth class in the true label of the ith sample, which is 0 or 1. p i,j represents the probability that the model predicts that the ith sample belongs to the jth class, M is the number of training samples, N is the number of known classes, v i is the feature representation of the ith sample, c i,j represents the center feature of the jth class to which the sample i belongs, λ C = 0.02 is a hyperparameter.

[0103] However, when using center loss for industrial control network fine-grained attack detection, its performance is low, mainly due to the following two reasons.

[0104] First, the feature representation obtained by the center loss model fails to fully demonstrate good feature discrimination, resulting in significant overlap between the feature representations of different classes, which in turn negatively affects the overall classification performance, as shown in Figure 9 (a) and Figure 10 (a). Second, in the data imbalance intrusion detection task, the center loss gives all data the same weight, which limits the model's ability to recognize minority classes. Although the current class balancing loss can be used to reweight minority class samples to improve the model's performance in data imbalance situations, this method may have the opposite effect in relatively balanced data. The calculation method of the class balancing loss is as follows:

[0105]

[0106] where nj represents the total number of the jth class sample, L C is the center loss, and β = 0.9 is used to control the degree of class balance, and the value closer to 1 represents the higher weight given to the minority class.

[0107] To solve the above two problems, the present application first proposes a separation loss function based on the center loss, and proposes that the loss function should maximize the distance d between different class samples during model training to make different class samples distinguishable, as shown in Figure 3 Based on this idea, the separation loss proposed by the present application is calculated as follows:

[0108]

[0109] where represents the center representation feature of the other class closest to sample i except the jth class. λ S = 0.01 is a hyperparameter. During the loss function minimization process, the polynomial L1 should decrease, and the distance between samples of adjacent classes should increase, as shown in Figure 4 The separation loss helps the model to obtain more distinguishable sample feature representations, as shown in Figure 9 (b) and Figure 10 (b).

[0110] Secondly, to adapt to the complex data partition situation in different industrial control networks, the present application proposes a more general dynamic separation loss function by combining the separation loss and the class balance loss, and proposes that the attention to the minority class samples should be gradually increased during neural network training to help the network continuously learn complex feature patterns and improve the generalization ability of the model. And at the end stage, the neural network is fine-tuned to improve the model performance. The calculation method is as follows:

[0111] L DS = εL S +(1-ε)L BS

[0112]

[0113] where L DS is the dynamic separation loss proposed by the present application, L S is the separation loss represented by formula (12), and L BS is the L C in the class balance loss of formula (11) replaced by L SThe following represents the current training round number of the neural network, E=50 is the total number of training rounds of the neural network, and ε is a dynamically changing balancing factor whose value depends on η. η=4 determines the division of the training process, that is, in the first 1 / 4 stage of the training process, the loss function will be changed from L... S Gradually towards L BS During the transition, in the last three-quarters of the training process, the loss function will be changed again by L. BS To L S Transition, the process is as follows Figure 5 As shown. This loss function dynamically adjusts the separation loss to enable the model to learn the features of the majority class samples in the early stages of training, thereby improving model performance. It then gradually shifts its focus to the minority class samples to enhance the model's generalization ability. Finally, in the last stage of training, it learns the features of the majority class samples again to fine-tune the model.

[0114] (9) Perform the gradient descent algorithm on the loss function for each sample i to make the model converge, as shown in the following formula:

[0115]

[0116] Where e represents the current training round number of the neural network, v i Let L be the feature representation of the i-th sample, where the polynomial L is... s and L BS For sample features v i The result of the derivative is shown in the following equation:

[0117]

[0118] The result is a continuous function, which indicates that the dynamic separation loss function proposed in this invention can be applied to the gradient descent algorithm of neural networks.

[0119] (10) Update the in-class center of each category, calculated using the following formula:

[0120]

[0121] Where μ = 0.01 is the learning rate, and Δc j The distance between all samples and the class center is calculated as follows:

[0122]

[0123] Where y i For the true label of sample i, when term is true,

[0124] φ(term) = 1, otherwise φ(term) = 0

[0125] (11) Update the neural network model parameters. The calculation formula is as follows:

[0126]

[0127] where W e is the neural network model parameter of the current round, W e+1 is the updated neural network model parameter.

[0128] (12) Repeat (1)-(11) until the maximum number of training rounds E = 50 is reached.

[0129] Step three: classify the test sample. The traditional neural network model uses the Softmax function to normalize the sample feature representation to obtain the output probability of each class. However, when the test sample is of an unknown class, the Softmax function will still divide it into known classes. To solve this problem, the invention measures the Mahalanobis distance between the test sample and the training sample feature representation to determine the decision boundary of the unknown class, thereby realizing the detection of unknown attacks. The specific steps are as follows:

[0130] (1) For the test sample d, obtain the sample feature representation v d by loading the trained model parameters.

[0131] (2) Calculate the Mahalanobis distance between the multivariate Gaussian distribution of all known classes and the test sample feature representation v d , and the calculation method is as follows:

[0132]

[0133] where l j represents the Mahalanobis distance between the multivariate Gaussian distribution of the jth class sample and the test sample feature representation, is the mean of the multivariate Gaussian distribution of the jth class sample, u i,j represents the feature representation of the ith sample in the jth class, and Σ j is the covariance matrix of the multivariate Gaussian distribution of the jth class sample.

[0134] (3) Calculate the rejection threshold of each known class by the chi-square distribution, and the calculation method is as follows:

[0135]

[0136] where represents the chi-square distribution of the jth class sample, I is the feature dimension, and 0.95 is the critical value quantile.

[0137] (4) Determine the class to which the test sample belongs. When all distance values in the Mahalanobis distance set L are greater than the rejection threshold of each known class in K, that is, If so, the sample is determined as unknown class. Otherwise, it will output the known class result through the Softmax function, and the calculation method is as follows:

[0138]

[0139] Where p d,j represents the probability that the sample d belongs to the jth class.

[0140] Experimental verification

[0141] In order to verify the effectiveness of the method proposed in the present application, the model is verified on the published natural gas pipeline and industrial honeypot data sets, respectively, wherein the natural gas pipeline data set contains 7 attack types and normal samples, and the industrial honeypot data set contains 4 attack types. The attacks of the two data sets are implemented by using industrial protocols. The details of the two data sets are shown in Figure 6 and Figure 7 .

[0142] The present application first evaluates the effectiveness of the separation loss on the two data sets. 80% of the data in the data set is used for training, and 20% of the data is used for testing. The experiment is carried out for 5 times, and the average value of each evaluation index is calculated, and the result is shown in Figure 8 . The separation loss enhances the inter-class separability, and achieves the optimal result on the two data sets, and improves the detection effect of the model on the known class. At the same time, in order to verify the role of the separation loss, the present application visualizes the sample feature representation of the two data sets, and the result is shown in Figure 9 and Figure 10 . Among them, the intra-class distance represents the average distance of each sample to its class center, and the inter-class distance represents the average distance of each sample to the nearest other class center. It can be found that the model using the center loss has more overlap between different classes, especially on the natural gas pipeline data set, this phenomenon is particularly obvious, almost all the NMRI samples are covered by the normal samples, which leads to the difficulty of the model to accurately identify the two classes. The separation loss can ensure obvious distinction between classes, compared with the center loss, the inter-class distance is increased by 0.45 and 0.21 respectively, which improves the detection effect of the model.

[0143] Secondly, the application evaluates the effect of dynamic separation loss by dividing different data partitions for each data set. Taking the natural gas pipeline data set as an example, the division methods include balance, 100-imbalance, 200-imbalance, 500-imbalance and extreme imbalance. In the balance scenario, the data amount of each category is the same. Extreme imbalance will use all the data for training. 100-imbalance represents that the data of each category is increased by 100, and the rest of the division methods are similar to the 100-imbalance, only the data difference increase amplitude is different. The division method of industrial honeypot data is similar to that of natural gas pipeline, and the data increase amplitude is set to 1000, 2000 and 3000 respectively. 80% of the data of each division method is used for training, and 20% of the data is used for testing. The experiment is also carried out for 5 times, and the average value of the evaluation results is taken, as shown in Figure 11 and Figure 12 The dynamic center loss in the figure can be regarded as a dynamic combination version of the center loss and the category balance loss.

[0144] Dynamic separation loss exhibits excellent performance in almost all data partitions. For relatively balanced data, its performance is comparable to that of separation loss, and is significantly better than that of other methods. Category balance loss exhibits better performance when the data is imbalanced, and is better than separation loss and center loss on the natural gas data set. This shows that in the case of data imbalance, the re-weighting method is more effective than obtaining a more discriminative feature representation. In addition, similar to the comparison results of dynamic separation loss and separation loss, dynamic center loss exhibits better generalization ability than center loss.

[0145] Finally, to simulate unknown attacks, the application alternately adds the attack classes in the two data sets to the test data set as unknown classes, and removes them from the corresponding training set, to test the discrimination effect of the model on unknown attacks, and the results are shown in Figure 13 Since separation loss obtains a more discriminative sample feature representation, its decision boundary is clearer, thereby enhancing the discrimination ability of the model for unknown attacks, and achieving the optimal effect. At the same time, in order to verify the recognition effect of the model on known categories, the application gives the classification result confusion matrix when removing the Fuzzing category data in the honeypot data and removing the NMRI data in the natural gas pipeline, as shown in Figure 14 and Figure 15The proposed method only misclassified 3.94% of the samples in the industrial honeypot dataset, while the other methods reached 6.82%, 8.45% and 7.13%, respectively. Except for the proposed method, all other methods mislabeled most of the NMRI samples in the gas pipeline dataset as normal samples. In addition, the CADE method showed overconfidence in normal samples, and most of the misclassified samples were classified into the normal class. The proposed method showed the best performance.

[0146] The above preferred embodiments are only for illustrating the technical concept and characteristics of the present application, and the purpose is to enable those skilled in the art to understand the content of the present application and implement it, and cannot limit the protection scope of the present application. Any equivalent changes or modifications made according to the essence of the present application shall fall within the protection scope of the present application.

[0147] Embodiment 2

[0148] The embodiment provides a fine-grained attack intrusion detection system for an industrial control network.

[0149] A computer readable storage medium, wherein a plurality of instructions are stored, the instructions are suitable for being loaded and executed by a processor of a terminal device, and the instructions are used to implement the fine-grained attack intrusion detection method for the industrial control network.

[0150] A terminal device, comprising a processor and a computer readable storage medium, wherein the processor is used to implement instructions, and the computer readable storage medium is used to store a plurality of instructions, the instructions are suitable for being loaded and executed by the processor, and the instructions are used to implement the fine-grained attack intrusion detection method for the industrial control network.

[0151] The above are preferred embodiments of the present application, and do not limit the protection scope of the present application. Any equivalent changes or modifications made according to the structure, shape and principle of the present application shall be covered within the protection scope of the present application.

Claims

1. A fine-grained attack and intrusion detection method for industrial control networks, characterized in that, include: Acquire network data and divide it into test samples and training samples; Preprocess the acquired network data; The training samples of network data are input into the neural network for training; The test set is classified using a trained neural network. The decision boundary of the unknown category is determined by measuring the Mahalanobis distance between the feature representations of the test samples and the training samples, thereby enabling the detection of attacks on the unknown category. The step of inputting training samples of network data into a neural network for training includes inputting the training samples into two parallel CNN networks with convolution kernel sizes of 2 and 4 respectively, then concatenating the local features obtained after convolution into vectors, then inputting the concatenated feature vectors into a bidirectional GRU network with 128 neurons, and finally inputting the GRU hidden layer feature vectors into a fully connected layer with 64 neurons to obtain the sample feature representation; The step of inputting training samples of network data into the neural network for training also includes obtaining a dynamic separation loss function by combining separation loss and class balance loss. By making the separation loss dynamic, the model learns the features of the majority class samples in the early stage of training. The dynamic separation loss function is calculated as follows: ， in For dynamic separation loss, For separation loss, It is class balance loss. Representing the The total number of class samples, Used to control the degree of class balance This indicates the current training round number of the neural network. The representative model predicts the first The sample belongs to the first The probability of a class This represents the total number of training rounds for the neural network. It is a dynamically changing balance factor. The method for dividing the training process is determined; that is, in the first quarter of the training process, the loss function will be... Gradually towards During the transition, in the last three-quarters of the training process, the loss function will be changed again. Towards transition; The separation loss The calculation method is as follows: ， ， in, Loss at the center Representing the The true label of the sample is the first The values ​​that a class can take. The number of training samples. Given the number of categories, For the first Feature representation of a sample Representative sample Category The central feature, For hyperparameters; Representative except the first Outside the class, the closest sample Other categories of central representation features, For hyperparameters, during the minimization of the loss function, the polynomial... Reduce the distance between samples from adjacent categories. Increase.

2. The fine-grained attack and intrusion detection method for industrial control networks according to claim 1, characterized in that, The data preprocessing of the acquired network data includes converting all character features in the dataset into numerical features through one-hot encoding, standardizing all numerical features, and then normalizing the standardized features.

3. The fine-grained attack and intrusion detection method for industrial control networks according to claim 2, characterized in that, The step of inputting training samples of network data into the neural network for training also includes processing each training sample. Execute the gradient descent algorithm for the loss function and update the neural network model parameters. The gradient descent formula is: ， in This indicates the current training round number of the neural network. For the first Feature representation of each sample; The formula for updating neural network model parameters is: ， in For learning rate, These are the parameters of the neural network model for this round. These are the updated neural network model parameters.

4. The fine-grained attack and intrusion detection method for industrial control networks according to claim 3, characterized in that, The decision boundary for the unknown category is determined by measuring the Mahalanobis distance between the feature representations of the test samples and the training samples, including for the test samples... The feature representation of the samples is obtained by loading the parameters of the trained model, and the multivariate Gaussian distribution of all known classes is calculated along with the feature representation of the test samples. The Mahalanobis distance is calculated as follows: ， Where L is the set of Mahalanobis distances. The Mahalanobis distance between the multivariate Gaussian distribution representing the j-th class of samples and the feature representation of the test samples. It is the first The mean of a multivariate Gaussian distribution for a sample. This represents the feature representation of the i-th sample in the j-th class. For the first The covariance matrix of a multivariate Gaussian distribution for a sample.

5. A fine-grained attack and intrusion detection method for industrial control networks according to claim 4, characterized in that, The method of determining the decision boundary of the unknown category by measuring the Mahalanobis distance between the feature representations of the test sample and the training sample also includes determining the category to which the test sample belongs, when the Mahalanobis distance set When all distance values ​​are greater than 95% of the chi-square distribution for each known category, that is... , I If the feature dimension is specified, the sample is classified as an unknown category; otherwise, the known category result will be output through the Softmax function, calculated as follows: ， in, It is a sample Feature representation, This represents the probability that sample d belongs to class j.

6. A fine-grained attack and intrusion detection system for industrial control networks, executing the fine-grained attack and intrusion detection method for industrial control networks as described in claim 1, characterized in that, include: The data acquisition module is configured to acquire network data and divide the network data into test samples and training samples. The preprocessing module is configured to preprocess the acquired network data. The training module is configured to input training samples of network data into the neural network for training; The classification module is configured to classify the test set using a trained neural network. It determines the decision boundary of the unknown category by measuring the Mahalanobis distance between the feature representations of the test samples and the training samples, thereby enabling the detection of attacks on the unknown category.

7. A computer-readable storage medium storing a plurality of instructions, characterized in that, The instructions are adapted to be loaded by the processor of the terminal device and executed as described in claim 1.

8. A terminal device, comprising a processor and a computer-readable storage medium, wherein the processor is configured to implement instructions; and the computer-readable storage medium is configured to store multiple instructions, characterized in that, The instructions are adapted to be loaded by a processor and executed as described in claim 1.

Images