A Triple CGAN model framework and method for intrusion detection in the Industrial Internet

Abstract

This invention proposes a Triple CGAN model framework and method for intrusion detection in the Industrial Internet. First, a Triple CGAN algorithm model is constructed, establishing a data space based on conditional generative adversarial networks (GANs), incorporating processors and classifiers, and optimizing the model loss combination calculation. Second, based on the UNSW_NB15 dataset, data classification and method comparison experiments are designed to evaluate model performance. The proposed method can not only further improve the detection performance of GAN-based intrusion detection algorithms but also adapt to the remaining degree of data imbalance after dataset balancing by learning the inherent characteristics of the generated data.

Description

Technical Field

[0001] This invention belongs to the field of industrial internet security technology, and in particular relates to a Triple CGAN model framework and method for intrusion detection in the industrial internet. Background Technology

[0002] The powerful feature extraction and classification capabilities of Artificial Intelligence (AI) have provided new directions for the development of intrusion detection technology. To achieve higher-performance intrusion detection technology, many scholars have applied machine learning and deep learning to intrusion detection, largely solving the bottlenecks of traditional intrusion detection techniques. The Industrial Internet, as an emerging application model and industrial ecosystem, exhibits many differences compared to traditional Internet applications, including a focus on real-time performance rather than security in communication protocols, differences in device types, numbers, and environmental complexity, and high network data noise in the Industrial Internet environment. Similarly, the Industrial Internet faces many challenges in intrusion detection, including attacks based on protocol vulnerabilities, insufficient processing performance due to complex data formats and large data volumes, and reduced sensitivity of intrusion detection systems. To address the high real-time and large-data processing requirements of Industrial Internet intrusion detection systems, many scholars have proposed various deep learning-based methods for Industrial Internet intrusion detection.

[0003] As technology continues to iterate and upgrade, cyberattacks are increasingly showing trends of diversified targets, high concealment, and high organization. The increasing complexity and timeliness of network traffic, coupled with the stringent requirements for efficiency in anomaly behavior analysis in the Industrial Internet, has increased the difficulty of feature extraction from traffic. Furthermore, while training deep learning models requires massive amounts of sample data, the sample sets used to store this data are characterized by uneven distribution and complex features.

[0004] With the continuous iteration and upgrading of advanced technologies such as artificial intelligence, cyberattacks are increasingly showing trends of diversified targets, strong concealment, and high organization. The increasing complexity and timeliness of network traffic, coupled with the stringent requirements for the efficiency of abnormal behavior analysis in the Industrial Internet, has increased the difficulty of feature extraction from traffic. Therefore, intrusion detection systems for the Industrial Internet need to continuously improve their identification accuracy and generalization capabilities to ensure the stable operation of the Industrial Internet. Against this background, this invention proposes a Triple CGAN model framework and method for intrusion detection in the Industrial Internet. Summary of the Invention

[0005] The purpose of this invention is to address the problems in existing technologies by proposing a Triple CGAN model framework and method for intrusion detection in the Industrial Internet. Specifically, in the field of intrusion detection in the Industrial Internet, a data space is established based on conditional generative adversarial networks, incorporating processors and classifiers, optimizing the model loss combination calculation, and continuously improving the identification accuracy and generalization response capability to ensure the stable operation of the Industrial Internet.

[0006] This invention is achieved through the following technical solution: This invention proposes a Triple CGAN model framework for intrusion detection in the Industrial Internet, the model framework including: generator, discriminator, classifier, processor and data space;

[0007] The generator's function is to receive random noise and label information, generate fake data for the discriminator to identify real and fake data, and for the classifier to classify the data.

[0008] The function of the discriminator is to receive the selection data input from the data space and to judge the authenticity of the received data;

[0009] The classifier's function is to receive the selected data input from the data space and classify the received data.

[0010] The processor's function is to receive all data features and data labels, perform preliminary calculations on the input, and then input the feature output results and label output results into the data space.

[0011] In the data space, the input data is first checked to see if there are any errors in the correspondence between features and labels. Then, the features and labels are combined and processed, and forwarded to the discriminator. The data with labels removed is forwarded to the classifier.

[0012] Furthermore, the input data is processed in parallel by the processor, output to the data space for feature and label combination processing, and then input to the discriminator for true / false judgment, thus forming the data discrimination calculation process; similarly, the data space is processed for feature and label separation, and then input to the classifier for classification calculation, thus forming the data classification calculation process.

[0013] This invention also proposes a Triple CGAN method for intrusion detection in the Industrial Internet. The method is based on the aforementioned Triple CGAN model framework and includes the following steps:

[0014] Step 1: Import the UNSW_NB15 dataset and perform dataset preprocessing;

[0015] Step 2: Split the dataset into a training part and a test part;

[0016] Step 3: The generator generates fake data based on the input random noise and conditional information, and then inputs it into the processor;

[0017] Step 4: The processor receives fake data and real data, calculates data features and labels respectively, and inputs them into the data space;

[0018] In Step 5, the input data is stored and statistically analyzed in the data space. The received data features are combined with the corresponding labels and processed into the discriminator. The feature parts are then separated and input into the classifier.

[0019] Step 6: The discriminator is responsible for identifying the authenticity of the input data, while the classifier classifies the input data into categories.

[0020] Step 7: Calculate the loss of each part and update and optimize the parameters of each part accordingly;

[0021] Step 8 initiates the early stopping method, checking whether the Triple CGAN model has met the triggering condition; if yes, training stops and proceeds to Step 10; otherwise, proceeds to Step 9.

[0022] Step 9: Determine if the preset model training period has been reached; if less, proceed to Step 3; otherwise, proceed to Step 10.

[0023] Step 10: Stop training and save model parameters;

[0024] Step 11: Load the test set and the saved model;

[0025] Step 12: The generator generates data based on random noise and conditional information, and inputs it into the processor;

[0026] Step 13 is the overall classification process that involves separate calculations by the processor for real data and generated data, feature and label separation in the data space, and classification calculations in the input classifier.

[0027] Step 14: Evaluate the performance of the Triple CGAN model;

[0028] Step 15 is complete.

[0029] Furthermore, the problem model for establishing the Triple CGAN model is as follows:

[0030] Let x, y, z, G, D, and C represent real data, label information, noisy data, generator, discriminator, and classifier, respectively:

[0031]

[0032] Equation (1) represents the optimization objective of G, which is to make the generated data closer to the real data; Equation (2) represents the optimization objective of D, which is to correctly distinguish between real and fake input data; Equation (3) represents the optimization objective of C, which is to correctly classify input data and learn the intrinsic characteristics of data from both real and generated data through a class adversarial mechanism with G; Equation (4) represents the overall optimization objective of the Triple CGAN model.

[0033] Furthermore, the losses during training are divided into generation loss, discrimination loss, and classification loss. The parameters of the generator, processor, discriminator, and classifier are updated based on these losses.

[0034] Furthermore, the loss required for generator parameter updates consists of two parts: the discriminator's judgment of false data as true or false and the classifier's classification of false data; the loss required for discriminator parameter updates consists of two parts: the discriminator's judgment of input true data and false data; the loss required for classifier parameter updates consists of two parts: the classifier's classification of input true data and false data; and the loss required for processor parameter updates consists of two parts: the discriminator's judgment of input data as true or false and the classifier's classification of input data.

[0035] Furthermore, in each iteration, the generator is trained first, then the processor and discriminator are trained together, and finally the processor and classifier are trained together. This process is repeated until the classifier loss stabilizes and the classifier's performance no longer improves.

[0036] Furthermore, the preprocessing of the dataset includes data cleaning, data encoding, dataset resampling, and data standardization.

[0037] The present invention also proposes an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the TripleCGAN method for intrusion detection in the Industrial Internet.

[0038] The present invention also proposes a computer-readable storage medium for storing computer instructions, which, when executed by a processor, implement the steps of the Triple CGAN method for intrusion detection in the Industrial Internet.

[0039] The beneficial effects of this invention are as follows:

[0040] (1) A Triple CGAN model is proposed, which integrates a classifier to perform input flow classification calculation and a processor to perform preliminary calculation of input data and labels, and establishes a data space for data processing such as checking, splitting and combining input data and labels. At the same time, the loss combination calculation of Triple CGAN is optimized to adapt to the optimized model structure, thereby comprehensively improving its training stability and detection performance.

[0041] (2) The Triple CGAN model was trained and tested based on the UNSW_NB15 public intrusion detection dataset. It was compared and analyzed with traditional machine learning methods and existing intrusion detection methods using general deep learning evaluation metrics to verify the practicality and applicability of the model in industrial Internet intrusion detection systems. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0043] Figure 1 Here is a framework diagram of the Triple CGAN model;

[0044] Figure 2 This is a flowchart of the Triple CGAN method for intrusion detection in the industrial internet as described in this invention;

[0045] Figure 3 This is a graph showing the sample proportions of the original dataset.

[0046] Figure 4 This is a graph showing the sample proportions of the current dataset.

[0047] Figure 5 Here is a diagram of the generator neural network structure;

[0048] Figure 6 This is a diagram of the neural network structure for the classifier.

[0049] Figure 7 This is a diagram of the discriminator neural network structure.

[0050] Figure 8 This is a diagram of the processor's neural network structure.

[0051] Figure 9 This is a trend chart of the training loss of the model;

[0052] Figure 10 Performance analysis graph for the model training set;

[0053] Figure 11 This is a comparison chart of Triple CGAN and machine learning models;

[0054] Figure 12 This is a comparison chart of Triple CGAN and existing models. Detailed Implementation

[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] This invention leverages the higher accuracy of GAN-based industrial internet intrusion detection methods in identifying potential threats and their generalization ability in the face of diverse attack methods. Aiming at accurately identifying malicious attacks, it overcomes the challenges of model training by proposing the Triple CGAN method using Conditional Generative Adversarial Networks (CGANs). First, this invention constructs the Triple CGAN algorithm model, establishing a data space based on the CGAN framework, incorporating a processor and classifier, and optimizing the model loss combination calculation. Second, based on the UNSW_NB15 dataset, a data classification and method comparison experiment is designed to evaluate the model performance.

[0057] Specifically, in combination Figures 1-12 This invention proposes a Triple CGAN model framework for intrusion detection in the Industrial Internet, such as... Figure 1 The diagram shows the model framework of Triple CGAN, which includes: a generator, a discriminator, a classifier, a processor, and a data space.

[0058] The generator's function is to receive random noise and label information, generate fake data for the discriminator to identify real and fake data, and for the classifier to classify the data.

[0059] The function of the discriminator is to receive the selection data input from the data space and to judge the authenticity of the received data;

[0060] The classifier's function is to receive the selected data input from the data space and classify the received data.

[0061] The processor's function is to receive all data features and data labels, perform preliminary calculations on the input, and then input the feature output results and label output results into the data space.

[0062] In the data space, the input data is first checked to see if there are any errors in the correspondence between features and labels. Then, the features and labels are combined and processed, and forwarded to the discriminator. The data with labels removed is forwarded to the classifier.

[0063] Input data is processed in parallel by the processor, output to the data space for feature and label combination processing, and then input to the discriminator for true / false judgment, thus forming the data discrimination calculation process; similarly, feature and label separation processing is performed in the data space, and then input to the classifier for classification calculation, thus forming the data classification calculation process.

[0064] This invention also proposes a Triple CGAN method for intrusion detection in the Industrial Internet. The method is based on the aforementioned Triple CGAN model framework and includes the following steps:

[0065] Step 1: Import the UNSW_NB15 dataset and perform dataset preprocessing;

[0066] Step 2: Split the dataset into a training part and a test part;

[0067] Step 3: The generator generates fake data based on the input random noise and conditional information, and then inputs it into the processor;

[0068] Step 4: The processor receives fake data and real data, calculates data features and labels respectively, and inputs them into the data space;

[0069] In Step 5, the input data is stored and statistically analyzed in the data space. The received data features are combined with the corresponding labels and processed into the discriminator. The feature parts are then separated and input into the classifier.

[0070] Step 6: The discriminator is responsible for identifying the authenticity of the input data, while the classifier classifies the input data into categories.

[0071] Step 7: Calculate the loss of each part and update and optimize the parameters of each part accordingly;

[0072] Step 8 initiates the early stopping method, checking whether the Triple CGAN model has met the triggering condition; if yes, training stops and proceeds to Step 10; otherwise, proceeds to Step 9.

[0073] Step 9: Determine if the preset model training period has been reached; if less, proceed to Step 3; otherwise, proceed to Step 10.

[0074] Step 10: Stop training and save model parameters;

[0075] Step 11: Load the test set and the saved model;

[0076] Step 12: The generator generates data based on random noise and conditional information, and inputs it into the processor;

[0077] Step 13 is the overall classification process that involves separate calculations by the processor for real data and generated data, feature and label separation in the data space, and classification calculations in the input classifier.

[0078] Step 14: Evaluate the performance of the Triple CGAN model;

[0079] Step 15 is complete.

[0080] Building upon CGAN, this paper incorporates processor optimization into the training process to enhance generalization ability; integrates a classifier and generator to form an adversarial mechanism, improving the simulation accuracy of generated data and the classifier's classification ability; establishes a data space to enhance flexibility and prevent overfitting caused by the classifier's over-reliance on label information; and optimizes the loss combination calculation of Triple CGAN to adapt to the optimized model structure, thereby improving model stability. In summary, the problem model for establishing the Triple CGAN model is as follows:

[0081] Let x, y, z, G, D, and C represent real data, label information, noisy data, generator, discriminator, and classifier, respectively:

[0082]

[0083] Equation (1) represents the optimization objective of G, which is to make the generated data closer to the real data; Equation (2) represents the optimization objective of D, which is to correctly distinguish between real and fake input data; Equation (3) represents the optimization objective of C, which is to correctly classify input data and learn the intrinsic characteristics of data from both real and generated data through a class adversarial mechanism with G; Equation (4) represents the overall optimization objective of the Triple CGAN model.

[0084] Triple CGAN consists of four networks: a generator, a discriminator, a classifier, and a processor. Assume the generator has l layers, each containing n neurons. The computational cost of each layer during forward propagation is O(n^2). 2 Therefore, the forward propagation complexity is O(l*n). 2 The computational cost of each layer during backpropagation reaches O(n^2); 2 Therefore, the backpropagation complexity of the generator is O(l*n). 2 Similarly, assuming the processor, discriminator, and classifier have x, y, and z layers respectively, then the forward propagation complexity is O(x*n). 2O(y*n) 2 O(z*n) 2 The backpropagation complexity is O(x*n). 2 O(y*n) 2 O(z*n) 2 In summary, the time complexity of the Triple CGAN model algorithm is O(n^2). 3 ).

[0085] The Triple CGAN algorithm proposed in this invention optimizes the model's training process by improving processor and data space, thereby enhancing the model's flexibility. It borrows the adversarial mechanism from generative adversarial networks to form a similar adversarial mechanism between the generator and classifier, and optimizes the model's loss calculation method. This not only further improves the detection performance of GAN-based intrusion detection algorithms but also adapts to the remaining imbalance in data distribution after dataset balancing by learning the inherent characteristics of the generated data.

[0086] Experimental Analysis

[0087] The experimental environment is shown in Tables 1 and 2. The code implementation of the Triple CGAN algorithm was performed on the personal computer configured as shown in Table 1, and the computation was carried out by uploading the code file to the experimental environment configured as shown in Table 2.

[0088] Table 1 Code Implementation Environment

[0089]

[0090] Table 2 Code Computing Environment

[0091]

[0092] This invention uses the UNSW_NB15 dataset for intrusion detection experiments. The statistical results of the recorded samples before and after preprocessing are shown in Table 3.

[0093] Table 3. Dataset Distribution (Data Points / Items)

[0094]

[0095] The preprocessing of the dataset includes data cleaning, data encoding, dataset resampling, and data standardization.

[0096] (1) Data cleaning: fill missing values ​​in the feature columns of the dataset with NaN values, and delete columns with disputed values.

[0097] (2) Regarding data encoding, the character-type discrete features in the One-Hot Encoding dataset are then subjected to dimensionality reduction using Principal Component Analysis (PCA). The character-type discrete label columns are then labeled.

[0098] (3) Regarding dataset resampling, duplicates were first removed, and then a hybrid sampling technique was used to perform a combination of oversampling and undersampling on the UNSW-NB15 dataset. The proportion of records in the preprocessed dataset compared to the original dataset is as follows: Figure 3 and Figure 4 As shown.

[0099] (4) In terms of data standardization, the StandardScaler method is used to unify the range of all feature values ​​in the dataset.

[0100] The initial parameter settings for Triple CGAN are shown in Table 4. In each iteration, the generator is trained first, then the processor and discriminator are trained together, and finally the processor and classifier are trained together. This process is repeated until the classifier loss stabilizes and the classifier's performance no longer improves.

[0101] Table 4 Initial Parameter Settings

[0102]

[0103]

[0104] The network structure and loss combination calculation of the Triple CGAN model are as follows:

[0105] (1) The loss during training is divided into generation loss, discrimination loss and classification loss. The parameters of the generator, processor, discriminator and classifier are updated according to the above losses.

[0106] (2) Generator network structure as follows Figure 5 As shown, the loss required for updating the generator parameters consists of two parts: the discriminator's judgment of whether the fake data is true or false, and the classifier's classification of the fake data.

[0107] (3) The discriminator network structure is as follows: Figure 6 As shown, the loss required for discriminator parameter updates is calculated based on the discriminator's discrimination of input real and fake data.

[0108] (4) Classifier network structure as follows Figure 7 As shown, the loss required for updating the classifier parameters is calculated based on the classifier's classification of the input true and false data.

[0109] (5) Processor network structure as follows Figure 8 As shown, the loss required for processor parameter updates consists of two parts: the discriminator's determination of the input data as true or false, and the classifier's calculation of the input data as true or false.

[0110] The training loss of the Triple CGAN algorithm model is as follows: Figure 9 As shown, the vertical axis C_loss represents the loss tendency of the classifier, and the horizontal axis EPOCH represents the number of rounds of the algorithm model from the start to the end of training. Figure 9 As shown, the overall trend of C_loss no longer decreases steadily around epoch=1028. This indicates that the early stopping method detects that the model performance is no longer steadily improving, and training stops when the patience value is reached at epoch=1066.

[0111] To comprehensively evaluate the model's characteristics, performance, and optimization effects, and to understand its strengths and limitations, accuracy, recall, and F1 score were used to evaluate the performance of Triple CGAN. Figure 10 The image shows the performance data of Triple CGAN during training. From... Figure 10 As can be seen, Triple CGAN achieved accuracy, recall, and F1 score of 82.47%, 82.57%, and 82.25% respectively during training. This indicates that Triple CGAN demonstrated good overall performance during training.

[0112] This invention compares and analyzes Triple CGAN with Naive Bayes (NB), Logistic Regression (LR), and Decision Tree (DT) to further evaluate the performance and applicability of Triple CGAN. The comparison results and their visualization are shown in Table 5. Figure 11 As shown.

[0113] Table 5 Comparison of Triple CGAN and Machine Learning Models

[0114]

[0115] As shown in Table 5, the Triple CGAN method achieved an accuracy of 81.91%, a recall of 82.09%, and an F1 score of 82.20%. Compared to the Naive Bayes method, the Triple CGAN method improved accuracy by 16.33%, recall by 16.51%, and F1 score by 19.94%; compared to logistic regression, it improved accuracy by 11.59%, recall by 11.77%, and F1 score by 17.94%; and compared to decision tree methods, it improved accuracy by 9.91%, recall by 10.09%, and F1 score by 11.49%. Therefore, Triple CGAN demonstrates certain advantages over traditional machine learning models in intrusion detection applications.

[0116] This invention selects performance data recorded from three existing methods—AnoGAN, BiGAN, and MAD-GAN—for comparative analysis to deeply evaluate the performance and practicality of the Triple CGAN method in industrial internet intrusion detection systems. The comparison results and their visualization are shown in Table 6. Figure 12 As shown.

[0117] Table 6. Comparison of Triple CGAN with existing models

[0118]

[0119] As shown in Table 6, compared with the AnoGAN method, Triple CGAN improved accuracy by 6.59%, recall by 7.52%, and F1 score by 7.25%. Compared with the BiGAN method, Triple CGAN improved accuracy by 6.44%, recall by 7.93%, and F1 score by 7.39%; however, compared with the MAD-GAN method, Triple CGAN's overall performance was slightly lower. Therefore, Triple CGAN also has certain advantages over existing intrusion detection methods.

[0120] Based on the comparative experimental results above, Triple CGAN demonstrates relatively balanced overall performance and exhibits good classification ability for minority classes in the UNSW_NB15 dataset, making it practical and applicable for intrusion detection.

[0121] This invention proposes a Triple CGAN framework and method for industrial internet intrusion detection systems. This method optimizes the model training process by incorporating a processor and establishing a data space, thereby improving the flexibility and stability of model training. Furthermore, by integrating a classifier and a generator to form a class adversarial mechanism, it optimizes loss calculation and improves the detection performance of the algorithm model on the UNSW-NB15 dataset.

[0122] To verify the performance, practicality, and applicability of Triple CGAN, comparative experiments were conducted with traditional machine learning models and existing models applied to intrusion detection, demonstrating its improvement in general-purpose evaluation metrics. In conclusion, applying the Triple CGAN method to industrial internet intrusion detection systems is feasible and practical. This invention provides research ideas and feasible solutions for further in-depth development of industrial internet intrusion detection technology.

[0123] The present invention also proposes an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the TripleCGAN method for intrusion detection in the Industrial Internet.

[0124] The present invention also proposes a computer-readable storage medium for storing computer instructions, which, when executed by a processor, implement the steps of the Triple CGAN method for intrusion detection in the Industrial Internet.

[0125] The memory in this application embodiment can be volatile memory or non-volatile memory, or it can include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DRRAM). It should be noted that the memory used in the methods described in this invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0126] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0127] In implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or by a combination of hardware and software modules in the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, detailed descriptions are omitted here.

[0128] It should be noted that the processor in the embodiments of this application can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method embodiments can be completed by the integrated logic circuitry in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above methods.

[0129] The above provides a detailed description of the Triple CGAN model framework and method for intrusion detection in the Industrial Internet proposed in this invention. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A Triple CGAN model framework for industrial internet intrusion detection, characterized in that, The model framework comprises a generator, a discriminator, a classifier, a processor and a data space; The function of the generator is to receive random noise and label information, generate false data for the discriminator to identify true and false, and the classifier to classify the data; The function of the discriminator is to receive the selected data input of the discriminator in the data space, and judge the true and false of the received data; The function of the classifier is to receive the selected data input of the classifier in the data space, and classify the received data; the classifier and the generator form a class confrontation mechanism; The function of the processor is to receive all data features and data labels, perform preliminary calculation on the input, and then input the feature output result and the label output result into the data space; In the data space, first check the correspondence between the input data, features and labels for errors, then combine the features and labels, forward them to the discriminator, and forward the data without labels to the classifier; The input data is calculated by the parallel calculation of the processor, output to the data space for feature and label combination processing, and then input to the discriminator for true and false discrimination, finally forming the discrimination calculation process of the data; similarly, the features and labels in the data space are separated and input to the classifier for classification calculation, forming the classification calculation process of the data; The problem model of the Triple CGAN model is established, specifically: Let us assume x , y , z , G, D and C respectively denote real data, label information, noise data, generator, discriminator, classifier: Formula (1) represents G the optimization target of making the generated data close to the real data; formula (2) represents D the optimization target of being able to correctly distinguish true and false for the input data; formula (3) represents C the optimization target of being able to correctly classify the input data and learn the inherent characteristics of the data from the real data and the generated data through the formation of a class confrontation mechanism with G formula (4) represents the overall optimization target of the Triple CGAN model. 2.A Triple CGAN method for industrial internet intrusion detection, characterized in that, The method is implemented based on the Triple CGAN model framework of claim 1, and the method comprises the following steps: Step 1 Import the UNSW_NB15 dataset and perform dataset preprocessing; Step 2 split the dataset into a training part and a test part; Step 3 a generator generates fake data according to input random noise and conditional information, and inputs a processor; Step 4 The processor receives false data and real data, respectively calculates data features and labels, and inputs them to the data space; Step 5 In the data space, the input data is stored and counted, the received data features are combined with the corresponding labels to process the input discriminator, and the feature part is separated to input the classifier. Step 6 The discriminator is responsible for recognizing the authenticity of the input data, while the classifier classifies the input data; Step 7. Calculate the loss of each part, and update the optimization of each parameter; Step 8. Start early stop method, check whether the Triple CGAN model reaches the trigger condition; yes, then the training stops, go to Step 10; no, go to Step 9. Step 9. Determine whether a preset model training period is reached; if not, go to Step 3; otherwise, go to Step 10. Step 10 stop training, save model parameters; Step 11 Load test set and saved model; Step 12 a generator generates data from random noise and conditional information, and inputs a processor; Step 13 The overall classification flow of real data and generated data from separate calculation of processors, to feature and label separation processing in data space, to classification calculation in input classifier; Step 14 Evaluate Triple CGAN model performance; The losses in the training process are divided into generation loss, discrimination loss and classification loss, and the parameters of the generator, processor, discriminator and classifier are updated according to the above losses. 15 End.

3. The method of claim 2, wherein, The loss required for generator parameter updating is composed of two parts: the true and false discrimination of the discriminator on false data and the classification of the classifier on false data; the loss required for discriminator parameter updating is composed of the discrimination calculation of the discriminator on input true data and false data; the loss required for classifier parameter updating is composed of the classification calculation of the classifier on input true data and false data; the loss required for processor parameter updating is composed of two parts: the true and false discrimination of the discriminator on input data and the classification calculation of the classifier on input data.

4. The method of claim 3, wherein, In each iteration process, the generator is first trained, then the processor and the discriminator are jointly trained, and finally the processor and the classifier are jointly trained, and this process is repeated until the classifier loss tends to be stable and the performance of the classifier no longer improves.

5. The method of claim 2, wherein, The preprocessing of the data set comprises data cleaning, data encoding, data set resampling and data standardization.

6. The method of claim 2, wherein, The processor implements the steps of the method of any one of claims 2-6 when executing the computer program. 7.An electronic device comprising a memory and a processor, the memory storing a computer program, wherein, The computer instructions implement the steps of the method of any one of claims 2-6 when executed by the processor.

8. A computer readable storage medium for storing computer instructions, characterized in that, ​

Images