Autonomous intrusion detection method for industrial control system based on AutoML

Abstract

The invention relates to the technical field of information security, and provides an AutoML-based industrial control system autonomous intrusion detection method, which comprises the following steps: automatic data preprocessing: preprocessing a network traffic data set; automatic feature engineering: calculating the importance of features to a classification task and calculating the linear relation strength between two feature variables; performing automatic basic model learning and hyper-parameter optimization, and performing automatic hyper-parameter optimization by adopting five tree-based ML models and through a CMA-ES algorithm; automatic model selection: selecting three ML models after hyper-parameter optimization; and automatic model integration: stacking and gradually optimizing the three ML models after hyper-parameter optimization for automatic intrusion detection. Through automatic data preprocessing, automatic feature engineering, automatic basic model learning and hyper-parameter optimization, automatic model selection and automatic model integration, autonomous network security of a next-generation industrial control system is realized.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to an autonomous intrusion detection method for industrial control systems based on AutoML. Background Art

[0002] Intrusion detection is fundamental to ensuring the smooth operation of smart industry and is one of its most important tasks. In smart factories, leveraging industrial control system network traffic data to monitor the security status of production systems in real time and respond promptly is key to ensuring high-quality production.

[0003] Traditional intrusion detection methods primarily determine whether a single variable parameter in a system exceeds a threshold, thereby further identifying system anomalies. This approach not only has a high false positive rate but also suffers from low time complexity. Because it struggles to detect anomalies associated with multiple variables in complex industrial control systems, it is also unsuitable for the development requirements of smart factories.

[0004] Furthermore, traditional intrusion detection methods primarily focus on complex neural networks, relying on extensive training of models with large amounts of data to update model parameters over a long period of time, requiring significant computing power. Traditional machine learning algorithms exhibit significant variability across different datasets, and the type of models and hyperparameters often rely on human expertise and domain knowledge. This limitation significantly restricts their effectiveness in industrial scenarios. Because network traffic data from different industrial control systems varies significantly in terms of feature distribution, data size, and noise interference, traditional algorithms lack adaptive adjustment capabilities. This results in models performing well on one dataset but experiencing a sharp decline in performance when migrating to other datasets, making them unable to meet the real-time monitoring requirements of smart factories across multiple scenarios and operating conditions. Furthermore, with the exponential growth in industrial data volume and the increasing diversity of data types, manually designed approaches are increasingly difficult to quickly adapt to new data features and changing trends. This makes traditional algorithms unable to detect anomalies promptly and accurately when processing multivariate network traffic data, thus impacting the safe and stable operation of production systems. Summary of the Invention

[0005] In view of the above-mentioned shortcomings of the existing technology, the present invention proposes an autonomous intrusion detection method for industrial control systems based on AutoML to address the challenges faced by traditional machine learning, such as complex data preprocessing, difficult model selection, inefficient hyperparameter optimization, insufficient model interpretability, and difficulty in adapting to data imbalance and noise interference. The technical solution designed by the present invention includes the following steps: S10: Automatic data preprocessing, including preprocessing of network traffic datasets; S20: Automatic feature engineering, including reducing data complexity by calculating the importance of features for classification tasks and calculating the strength of the linear relationship between two feature variables; S30: Automated basic model learning and hyperparameter optimization, including the use of five tree-based ML models and automatic hyperparameter optimization using the CMA-ES algorithm; S40: Automated model selection, including selecting three ML models after hyperparameter optimization; S50: Automated model integration, including stacking and gradually optimizing the three ML models after hyperparameter optimization using the proposed Stair Stacking model to form an integrated IDS model for industrial control systems for automatic intrusion detection.

[0006] Preferably, the S10 includes: Automatic data conversion, automatic data interpolation, automatic standardization and automatic data balancing of network traffic data; The automatic data conversion includes converting non-numerical features into numerical features using an automatic encoding method; The automatic data interpolation includes checking whether there are missing values ​​in the data and filling the missing values ​​with 0; The automatic standardization includes using Shapiro-Wilk to test whether the data obeys the normal distribution. If so, Z-score standardization is selected, otherwise min-max standardization is selected; The automatic data balancing includes calculating the number of samples of two categories, evaluating whether the data set is unbalanced, and balancing the data set using the SMOTE oversampling method.

[0007] Preferably, the importance of the calculated features to the classification task in S20 includes: For network traffic datasets, including samples, each sample has features and a target variable, the dataset Represented as a feature matrix and a label vector ,in Indicates the The first sample eigenvalues, Indicates the The label variable value of each sample; The feature importance is calculated using an algorithm based on gradient boosting decision tree, assuming that A decision tree, for the decision tree, The importance score of a feature is expressed as , No. Importance score of a feature It is obtained by summing the importance scores of all decision trees, and the formula is as follows:

[0008] Score the features according to their importance Sort in descending order to obtain a sorted feature sequence, normalize the feature importance scores so that the sum of the importance scores of all features is 1. Features, their normalized importance scores The formula is as follows:

[0009] Set a significance threshold , select those whose cumulative importance score is less than or equal to , and remove features with cumulative importance scores greater than characteristics.

[0010] Preferably, the calculating of the linear relationship strength between the two characteristic variables in S20 includes: The Pearson correlation coefficient is used to measure the linear correlation between two feature variables. and , calculate the Pearson correlation coefficient , the formula is as follows:

[0011] Where, for and The covariance of and They are and The standard deviation of and They are and The mean of is the mathematical expectation; For the feature matrix The two eigenvectors in and , calculate the Pearson correlation coefficient , the formula is as follows:

[0012] Where, and Respectively The sample in and The value of the feature, and Respectively and The sample mean of the features, is the sample size; By calculating the Pearson correlation coefficient between all feature pairs, we can get the correlation coefficient matrix ,in ,and , only considering the upper triangular part of the matrix, excluding the diagonal elements, by constructing an upper triangular matrix To extract the upper triangular part of the correlation coefficient matrix, set a correlation coefficient threshold , for an upper triangular matrix Each element in ,if , then it is considered that and There is a high linear correlation between the features, indicating that the two are redundant, and one feature is selected to be removed.

[0013] Preferably, the tree-based ML model in S30 includes: Five tree-based basic ML models were selected, including Random Forest, Xgboost, GradientBoosting, Decision Tree, and LightGBM.

[0014] Preferably, the automatic hyperparameter optimization based on the CMA-ES algorithm in S30 includes: The optimization problem definition includes setting the hyperparameter vector to , is the number of hyperparameters, and the calculation can make the objective function The optimal hyperparameter vector to minimize , the formula is as follows:

[0015] Parameter initialization, including through multivariate Gaussian distribution to sample the hyperparameter vector, is the mean vector, which is used to initialize the center of the search space or randomly select a reasonable initial point. is the step size, which is used to control the distribution range of sampling points in the search space. The initial value is set according to experience or the size of the search space. is the covariance matrix, initially set to the unit matrix , indicating that the hyperparameters are independent of each other; Sampling, including at each generation In the current multivariate Gaussian distribution mid-sampling hyperparameter vector , where the generation method of each sample is as follows:

[0016] Where, is from the zero vector as the mean, is sampled from the multivariate Gaussian distribution of the covariance matrix; Evaluation, for each sampled hyperparameter vector , use the corresponding tree-type ML model and calculate the loss function value on the validation set ; Select, sort the sampled hyperparameter vectors according to the loss function value, and select The optimal vector, , recorded as ; Parameter updates, including mean vector updates, step size updates, and covariance matrix updates; Iteration, the iterative process continues until the termination condition is met and the maximum number of iterations is reached , or step length Less than a certain threshold , or the change in the loss function value is less than a certain threshold.

[0017] Preferably, the mean vector update, step size update and covariance matrix update include: The mean vector is updated to include the new mean vector is the weighted average of the optimal samples, and the formula is as follows:

[0018] Where, is the weight, satisfying , and the weight decreases with the performance of the sample, and the better the performance, the greater the weight of the sample; The step size update includes updating the step size according to the evolution path, which is reduced when approaching the optimal solution and increased when approaching the optimal solution. The formula is as follows:

[0019]

[0020] Where, is the learning rate for step size update, is the step damping parameter, is the cumulative evolutionary path; The covariance matrix is ​​updated, including updating the accumulated evolutionary path , and then update the accumulated evolutionary path , the formula is as follows:

[0021]

[0022] Where, To update the accumulated evolutionary path, and The learning rate for covariance matrix updates.

[0023] Preferably, the S40 includes: All tree-based ML models are automatically tuned for hyperparameters using CMA-ES, and the top three best-performing models are selected based on the F1-score indicator as base models.

[0024] Preferably, the S50 includes: Build The ladder structure of the layers, each layer contains multiple base models, and integrates the output of the previous layer through adaptive weights. Layer Base Model , , the input of this layer is the previous layer Output , the first layer input is the original data , calculate each base model in the The output of the layer is as follows:

[0025]

[0026] The inter-layer connection function integrates the output of all base models of this layer into the input of the next layer. The formula is as follows:

[0027] Adaptive weight allocation mechanism is used to dynamically adjust layer weights according to different data characteristics. Output of the layer , whose contribution to the final prediction is determined by the weight function The decision formula is as follows:

[0028] Where, It is a learnable scoring function implemented by a neural network; Combining the outputs of all layers, we get the final detection result: .

[0029] Beneficial effects: This application proposes an autonomous intrusion detection method for industrial control systems based on AutoML, which achieves autonomous network security for the next generation of industrial control systems through automatic data preprocessing (AutoDP), automatic feature engineering (AutoFE), automated basic model learning and hyperparameter optimization, automated model selection, and automated model integration. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a flow chart of a preferred embodiment of the present invention; Figure 2 It is a schematic diagram of the overall framework of a preferred embodiment of the present invention; Figure 3 This is a schematic diagram of the comparison results of the performance evaluation of the Power dataset basic model in a preferred embodiment of the present invention; Figure 4 This is a schematic diagram of the comparison results of the performance evaluation of the basic model of the SWaT dataset according to a preferred embodiment of the present invention; Figure 5 This is a schematic diagram of the comparative results of the performance evaluation of the basic model of the Batadal dataset according to a preferred embodiment of the present invention; Figure 6 This is a schematic diagram of the comparison results of the performance evaluation of the basic model of the WADI dataset according to a preferred embodiment of the present invention; Figure 7 This is a comparative result of the performance evaluation of the basic model of the IoT Network Intrusion dataset of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0031] The embodiments of the present invention are described in detail below. The following embodiments are implemented based on the technical solutions of the present invention, and provide detailed implementation methods and specific operating procedures. However, the protection scope of the present invention is not limited to the following embodiments.

[0032] This paper designs an autonomous intrusion detection method for industrial control systems based on AutoML, such as Figure 1-2 As shown, the technical solution includes the following steps, specifically including: S10: Automatic data preprocessing, including preprocessing of network traffic datasets; S20: Automatic feature engineering, including reducing data complexity by calculating the importance of features for classification tasks and calculating the strength of the linear relationship between two feature variables; S30: Automated basic model learning and hyperparameter optimization, including the use of five tree-based ML models and automatic hyperparameter optimization using the CMA-ES algorithm; S40: Automated model selection, including selecting three ML models after hyperparameter optimization; S50: Automated model integration, including stacking and gradually optimizing the three ML models after hyperparameter optimization using the proposed Stair Stacking model to form an integrated IDS model for industrial control systems for automatic intrusion detection.

[0033] Preferably, S10 includes: Automatic data conversion, automatic data interpolation, automatic standardization and automatic data balancing of network traffic data; Automatic data transformation, including the use of automatic encoding methods to convert non-numerical features into numerical features; Automatic data interpolation, which includes checking for missing values ​​in the data and filling them with 0; Automatic standardization, including using the Shapiro-Wilk test to determine whether the data follow a normal distribution. If so, select Z-score standardization; otherwise, select min-max standardization. Automatic data balancing, including calculating the number of samples in the two categories, evaluating whether the dataset is imbalanced, and balancing the dataset using the SMOTE oversampling method.

[0034] Specifically, for S10, it is the AutoDP stage. The data preprocessing in the AutoDP stage has become an important part of automatic machine learning. It mainly determines the quality of the model input data and improves the performance of the intrusion detection model. This process is huge, time-consuming and requires professional knowledge. In order to solve this problem, this patent adopts the AutoDP method to ensure that the intrusion detection model can learn useful patterns. In the box proposed in the text, the AutoDP stage mainly performs automatic data conversion, automatic data interpolation, automatic standardization and automatic data balancing operations. Among them, it evaluates whether the data set is unbalanced, and the abnormal / normal ratio is less than the threshold, and the threshold is set to 0.5.

[0035] Preferably, the importance of the calculated features for the classification task in S20 includes: For network traffic datasets, including samples, each sample has features and a target variable, the dataset Represented as a feature matrix and a label vector ,in Indicates the The first sample eigenvalues, Indicates the The label variable value of each sample; The feature importance is calculated using an algorithm based on gradient boosting decision tree, assuming that A decision tree, for the decision tree, The importance score of a feature is expressed as , No. Importance score of a feature It is obtained by summing the importance scores of all decision trees, and the formula is as follows:

[0036] Score the features according to their importance Sort in descending order to obtain a sorted feature sequence, normalize the feature importance scores so that the sum of the importance scores of all features is 1. Features, their normalized importance scores The formula is as follows:

[0037] Set a significance threshold , select those whose cumulative importance score is less than or equal to , and remove features with cumulative importance scores greater than characteristics.

[0038] Preferably, calculating the linear relationship strength between the two characteristic variables in S20 includes: The Pearson correlation coefficient is used to measure the linear correlation between two feature variables. and , calculate the Pearson correlation coefficient , the formula is as follows:

[0039] Where, for and The covariance of and They are and The standard deviation of and They are and The mean of is the mathematical expectation; For the feature matrix The two eigenvectors in and , calculate the Pearson correlation coefficient , the formula is as follows:

[0040] Where, and Respectively The sample in and The value of the feature, and Respectively and The sample mean of the features, is the sample size; By calculating the Pearson correlation coefficient between all feature pairs, we can get the correlation coefficient matrix ,in ,and , only considering the upper triangular part of the matrix, excluding the diagonal elements, by constructing an upper triangular matrix To extract the upper triangular part of the correlation coefficient matrix, set a correlation coefficient threshold , for an upper triangular matrix Each element in ,if , then it is considered that and There is a high linear correlation between the features, indicating that the two are redundant, and one feature is selected to be removed.

[0041] Specifically, for S20, after the AutoDP stage, AutoFE is another key component of the proposed AutoML framework. Feature engineering (FE) involves extracting and selecting the most informative and relevant features from a dataset, as raw features are often suboptimal for a specific dataset. This process enhances the performance of ML models. AutoFE aims to automate the traditional feature engineering process and minimize the human effort required for feature engineering tasks. In the proposed framework, AutoFE focuses on the feature selection (FS) process, which aims to identify and select the most relevant features to build efficient and accurate ML models.

[0042] Among them, the feature importance is calculated using an algorithm based on the Gradient Boosting Decision Tree (GBDT). In GBDT, each decision tree attempts to fit the residual of the previous tree. During the construction of the decision tree, features are continuously split to minimize a certain loss function (such as mean square error, etc.). At each node of the decision tree, a feature and a split point are selected to maximize the reduction in impurity of the child node after the split. The importance of a feature can be measured by the number of times the feature is used for splitting in all decision trees, the sum of the reduction in impurity brought about by the split, etc. In addition, an importance threshold is set. is 0.9.

[0043] Preferably, the tree-based ML model in S30 includes: Five tree-based basic ML models were selected, including Random Forest, Xgboost, GradientBoosting, Decision Tree, and LightGBM.

[0044] Preferably, the automatic hyperparameter optimization based on the CMA-ES algorithm in S30 includes: The optimization problem definition includes setting the hyperparameter vector to , is the number of hyperparameters, and the calculation can make the objective function The optimal hyperparameter vector to minimize , the formula is as follows:

[0045] Parameter initialization, including through multivariate Gaussian distribution to sample the hyperparameter vector, is the mean vector, which is used to initialize the center of the search space or randomly select a reasonable initial point. is the step size, which is used to control the distribution range of sampling points in the search space. The initial value is set according to experience or the size of the search space. is the covariance matrix, initially set to the unit matrix , indicating that the hyperparameters are independent of each other; Sampling, including at each generation In the current multivariate Gaussian distribution mid-sampling hyperparameter vector , where the generation method of each sample is as follows:

[0046] Where, is from the zero vector as the mean, is sampled from the multivariate Gaussian distribution of the covariance matrix; Evaluation, for each sampled hyperparameter vector , use the corresponding tree-type ML model and calculate the loss function value on the validation set ; Select, sort the sampled hyperparameter vectors according to the loss function value, and select The optimal vector, , recorded as ; Parameter updates, including mean vector updates, step size updates, and covariance matrix updates; Iteration, the iterative process continues until the termination condition is met and the maximum number of iterations is reached , or step length Less than a certain threshold , or the change in the loss function value is less than a certain threshold.

[0047] Preferably, the mean vector update, step size update and covariance matrix update include: Mean vector update, including the new mean vector is the weighted average of the optimal samples, and the formula is as follows:

[0048] Where, is the weight, satisfying , and the weight decreases with the performance of the sample, and the better the performance, the greater the weight of the sample; Step size update includes updating the step size according to the evolution path, decreasing it when approaching the optimal solution and increasing it when approaching the optimal solution. The formula is as follows:

[0049]

[0050] Where, is the learning rate for step size update, is the step damping parameter, is the cumulative evolutionary path; Covariance matrix update, including updating the accumulated evolutionary path , and then update the accumulated evolutionary path , the formula is as follows:

[0051]

[0052] Where, To update the accumulated evolutionary path, and The learning rate for covariance matrix updates.

[0053] Specifically, for S30, after the data is processed by AutoDP and AutoFE, it is trained using a supervised ML algorithm to ultimately detect attack behaviors. This patent selects five tree-based basic ML models, namely, Random Forest, Xgboost, Gradient Boosting, Decision Tree, and LightGBM. The main reasons are: (1) Random Forest, XGBoost, LightGBM, and Gradient Boosting are all integrated models based on Decision Tree, which can effectively process nonlinear and high-dimensional data in the industrial field; (2) Tree-based ML algorithms support parallel computing, effectively improving the training efficiency of industrial control system data sets; (3) The randomness in the process of constructing tree-based models improves the robustness of the generalization ability of the integrated model. HPO is a key step in deploying effective ML models to specific industrial systems or data sets. Automatically adjusting and optimizing hyperparameter combinations through hyperparameter optimization algorithms can improve the detection performance of the model. This patent uses the Covariance Matrix Adaptation Evolution Strategy (CMA-ES), a powerful gradient-free optimization algorithm based on the idea of ​​evolutionary strategy, which simulates the biological evolution process and approaches the optimal solution through continuous iterative search. It is widely used in fields such as hyperparameter optimization.

[0054] Preferably, S40 includes: All tree-based ML models are automatically tuned for hyperparameters using CMA-ES, and the top three best-performing models are selected based on the F1-score indicator as base models.

[0055] Specifically, for S40, these selected models will enter the subsequent model integration step to build the final intrusion detection system (IDS) integration model to improve the accuracy of classifying normal data and abnormal data.

[0056] Preferably, S50 includes: Build The ladder structure of the layers, each layer contains multiple base models, and integrates the output of the previous layer through adaptive weights. Layer Base Model , , the input of this layer is the previous layer Output , the first layer input is the original data , calculate each base model in the The output of the layer is as follows:

[0057]

[0058] The inter-layer connection function integrates the output of all base models of this layer into the input of the next layer. The formula is as follows:

[0059] Adaptive weight allocation mechanism is used to dynamically adjust layer weights according to different data characteristics. Output of the layer , whose contribution to the final prediction is determined by the weight function The decision formula is as follows:

[0060] Where, It is a learnable scoring function implemented by a neural network.

[0061] Combining the outputs of all layers, we get the final detection result: .

[0062] Specifically, for S50, in the IDS based on the AutoML framework, an ensemble learning method based on adaptive weight allocation is proposed, called "Stair Stacking". In the integration process, multiple base models are combined in a hierarchical iterative manner to form a strong classifier with a ladder structure. It mainly introduces hierarchical parameter optimization and adaptive weight allocation mechanism to improve the detection ability and stability of the model. Stair Stacking mainly transforms the traditional Stacking into Layered structure.

[0063] In addition, the experimental environment settings, data sets, and performance evaluation indicators of this application are as follows: Experimental environment setup: All experiments were run on high-performance machines. The software used Python 3.7 and PyTorch 1.12.0 as the primary framework. All experiments in this patent were run on high-performance machines. The experiments were developed in Python, primarily utilizing the Scikit-Learn and Hyperopt libraries. The specific experimental environment is shown in Table 1 below.

[0064] Table 1 Experimental environment

[0065] Datasets,This application is evaluated on five public datasets: Power, SWaT, Batadal, WADI, and IoT Network Intrusion datasets.,Details of these datasets are shown in Table 2.

[0066] Table 2 Dataset information

[0067] To evaluate the effectiveness of the model, this application provides various performance evaluation metrics derived from the confusion matrix: accuracy, precision, recall, F1 score, and detection time. These metrics are calculated using the following formulas.

[0068] The accuracy rate indicates the ratio of correctly classified samples to the total number of samples, and is calculated as follows:

[0069] Precision indicates the proportion of samples classified as abnormal that are actually abnormal. It is calculated as follows:

[0070] Recall refers to the proportion of successfully identified abnormal samples among all true abnormal samples. It is calculated as follows:

[0071] F1-score is a metric that comprehensively considers both precision and recall. It is the harmonic mean of these two metrics. F1-score can help a model find a balance between precision and recall, thus providing a more comprehensive assessment of model performance. It is calculated as follows:

[0072] The values ​​of these four indicators range from 0 to 1. The closer the value is to 1, the better the performance of the model. TP, FP, TN, and FN represent true positives, false positives, true negatives, and false negatives, respectively.

[0073] In addition, this application uses the Power, SWaT, Batadal, WADI and IoT Network Intrusion datasets for testing. Through AutoDP and AutoFE processing, important features that are beneficial to AutoML model training are selected. Among them, this patent sets the feature importance threshold and feature correlation coefficient threshold to 0.9 respectively. The final feature selection results are shown in Table 3.

[0074] Table 3 Feature engineering results

[0075] Subsequently, five tree-based ML models (Random Forest, XgBoost, Gradient Boosting, Decision Tree, and LightGBM) were automatically tuned using CMA-ES. Table 4 details the tuned hyperparameters, the search space for the hyperparameters, and the best values ​​of these hyperparameters obtained for the five datasets.

[0076] Table 4 Basic model HPO configuration.

[0077]

[0078] like Figure 3-7 As shown in Table 5, a comprehensive evaluation of various machine learning models and their optimized counterparts was conducted on multiple datasets, including Power, SWaT, Batadal, WADI, and IoT Network Intrusion. The results show that on the Power dataset, the optimized LightGBM, XGBoost, Gradient Boosting, and DecisionTree models significantly outperformed the unoptimized models in terms of accuracy, precision, recall, and F1-score. Although some models experienced a slight increase in detection time, accuracy improved significantly. On the SWaT dataset, the overall performance of the models was good before and after optimization. Some optimized models showed slight improvements in precision and recall, while detection time remained stable or slightly decreased. On the Batadal dataset, optimized models such as LightGBM and XGBoost significantly outperformed the unoptimized models in key performance metrics. Although some optimized models experienced a slight increase in detection time, the improvement in accuracy was more significant. On the WADI dataset, most optimized models showed improvements in accuracy and precision, and detection time was also reduced to varying degrees. On the IoT Network Intrusion dataset, the optimized models performed exceptionally well across all metrics. The optimized Decision Tree model, in particular, significantly reduced detection time while maintaining high accuracy. Overall, model optimization demonstrated effectiveness in improving performance across diverse datasets, providing a more reliable model choice for ensemble learning models.

[0079] Table 5 Model detection time results

[0080] Finally, we selected the top three optimized models (LightGBM_Optimized, Random Forest_Optimized, and Gradient Boosting_Optimized) by F1-score ranking and integrated them using the StairStacking ensemble method to form the final Auto-IDS framework (Ours). The results are shown in Tables 6-10.

[0081] Table 6. Comparison of detection model performance on the Power dataset

[0082] Table 7. Comparison of detection model performance on the SWaT dataset

[0083] Table 8 Comparison of detection model performance on Batadal dataset

[0084] Table 9. Comparison of detection model performance on the WADI dataset

[0085] Table 10. Comparison of detection model performance on IoT Network Intrusion dataset

[0086] This application evaluated intrusion detection on the Power, SWaT, Batadal, WADI, and IoT Network Intrusion datasets. Although its accuracy and F1 score were only slightly higher than those of the five tree-based basic models and the optimized models, the main reasons were: (1) the dataset was small and the model training process was simple; (2) the dataset pattern was relatively simple, and the model training process did not consider the correlation between data features.

[0087] On the Power dataset, the four ensemble models (Traditional Stacking, Confidence-based Stacking, Hybrid Stacking, and Stair Stacking) showed minimal differences in accuracy, precision, recall, and F1-score, but significant differences in detection time. The Stair Stacking model had the shortest detection time, at only 33.439 seconds, while the Traditional Stacking model took the longest, at 272.447 seconds. This indicates that on this dataset, different ensemble methods have similar effects on improving model predictive ability, but Stair Stacking has a clear advantage in detection efficiency. On the SWaT dataset, both Traditional Stacking and Stair Stacking models demonstrated good performance, reaching 99% accuracy. However, the Confidence-based Stacking and Hybrid Stacking models performed slightly worse, achieving an accuracy of 98.778%. In terms of detection time, the Stair Stacking model significantly outperformed, at 0.419 seconds, demonstrating not only excellent classification performance but also high detection efficiency. On the Batadal dataset, the Stair Stacking model stood out, achieving an accuracy of 76.19%, a precision of 66.176%, a recall of 63.75%, and an F1-score of 64.646%, all of which were higher than the other three ensemble models. Furthermore, its detection time was only 13.888 seconds, significantly lower than the other ensemble models, demonstrating that the Stair Stacking model had advantages in both performance and detection efficiency on the Batadal dataset. On the WADI dataset, the Stair Stacking model achieved an accuracy of 97.977%, a precision of 96.308%, a recall of 86.802%, an F1-score of 90.926%, and a detection time of 1.082 seconds, demonstrating excellent performance and leading the way. On the IoT Network Intrusion dataset, the Confidence-based Stacking model achieved an accuracy of 84.585%, slightly higher than other models. The stair stacking model achieved the best performance in terms of precision (85.313%), recall (84.998%), and F1-score (84.651%). Its test time was only 0.301 seconds, the shortest among all ensemble models. This demonstrates that the StairStacking model excels in both overall performance and computational efficiency on this dataset.

[0088] Different models exhibit different performance on various datasets, likely due to the characteristics of the datasets. Simple datasets have relatively simple data patterns, enabling many basic models to achieve high accuracy and F1-scores. In these cases, performance differences between models are more reflected in computational efficiency, such as the test time advantage demonstrated by the Stair Stacking model on multiple datasets. For complex datasets, different integration methods have different effects on the fusion of basic models, leading to significant differences in classification performance. For example, the Stair Stacking model leads in accuracy and other metrics on the Batadal dataset. Experimental results demonstrate that Auto-IDS demonstrates good overall performance and detection efficiency on a variety of datasets, providing an effective model integration approach for subsequent research.

[0089] The above describes in detail the preferred embodiments of the present invention. It should be understood that numerous modifications and variations based on the concepts of the present invention are possible by those skilled in the art without inventive effort. Therefore, any technical solution that can be derived by those skilled in the art through logical analysis, reasoning, or limited experimentation based on the concepts of the present invention and the prior art should be within the scope of protection defined by the claims.

Claims

1. An autonomous intrusion detection method for industrial control systems based on AutoML, characterized in that: include: S10: Automatic data preprocessing, including preprocessing of network traffic datasets; S20: Automatic feature engineering, including reducing data complexity by calculating the importance of features for classification tasks and calculating the strength of the linear relationship between two feature variables; S30: Automated basic model learning and hyperparameter optimization, including the use of five tree-based ML models and automatic hyperparameter optimization using the CMA-ES algorithm; S40: Automated model selection, including selecting three ML models after hyperparameter optimization; S50: Automated model integration, including stacking and gradually optimizing the three ML models after hyperparameter optimization using the proposed Stair Stacking model to form an integrated IDS model for industrial control systems for automatic intrusion detection.

2. The method for autonomous intrusion detection of industrial control systems based on AutoML according to claim 1, characterized in that: The S10 includes: Automatic data conversion, automatic data interpolation, automatic standardization and automatic data balancing of network traffic data; The automatic data conversion includes converting non-numerical features into numerical features using an automatic encoding method; The automatic data interpolation includes checking whether there are missing values ​​in the data and filling the missing values ​​with 0; The automatic standardization includes using Shapiro-Wilk to test whether the data obeys the normal distribution. If so, Z-score standardization is selected, otherwise min-max standardization is selected; The automatic data balancing includes calculating the number of samples of two categories, evaluating whether the data set is unbalanced, and balancing the data set using the SMOTE oversampling method.

3. The method for autonomous intrusion detection of industrial control systems based on AutoML according to claim 1, characterized in that: The importance of the calculated features for the classification task in S20 includes: For network traffic datasets, including samples, each sample has features and a target variable, the dataset Represented as a feature matrix and a label vector ,in Indicates the The first sample eigenvalues, Indicates the The label variable value of each sample; The feature importance is calculated using an algorithm based on gradient boosting decision tree, assuming that A decision tree, for the decision tree, The importance score of a feature is expressed as , No. Importance score of a feature It is obtained by summing the importance scores of all decision trees, and the formula is as follows: Score the features according to their importance Sort in descending order to obtain a sorted feature sequence, normalize the feature importance scores so that the sum of the importance scores of all features is 1. Features, their normalized importance scores The formula is as follows: Set a significance threshold , select those whose cumulative importance score is less than or equal to , and remove features with cumulative importance scores greater than characteristics.

4. The method for autonomous intrusion detection of industrial control systems based on AutoML according to claim 1, characterized in that: The calculation of the linear relationship strength between the two characteristic variables in S20 includes: The Pearson correlation coefficient is used to measure the linear correlation between two feature variables. and , calculate the Pearson correlation coefficient , the formula is as follows: Where, for and The covariance of and They are and The standard deviation of and They are and The mean of is the mathematical expectation; For the feature matrix The two eigenvectors in and , calculate the Pearson correlation coefficient , the formula is as follows: Where, and Respectively The sample in and The value of the feature, and Respectively and The sample mean of the features, is the sample size; By calculating the Pearson correlation coefficient between all feature pairs, we can get the correlation coefficient matrix ,in ,and , only considering the upper triangular part of the matrix, excluding the diagonal elements, by constructing an upper triangular matrix To extract the upper triangular part of the correlation coefficient matrix, set a correlation coefficient threshold , for an upper triangular matrix Each element in ,if , then it is considered that and There is a high linear correlation between the features, indicating that the two are redundant, and one feature is selected to be removed.

5. The method for autonomous intrusion detection of industrial control systems based on AutoML according to claim 1, characterized in that: The tree-based ML model in S30 includes: Five tree-based basic ML models were selected, including Random Forest, Xgboost, Gradient Boosting, Decision Tree, and LightGBM.

6. The method for autonomous intrusion detection of industrial control systems based on AutoML according to claim 1, characterized in that: Preferably, the automatic hyperparameter optimization based on the CMA-ES algorithm in S30 includes: The optimization problem definition includes setting the hyperparameter vector to , is the number of hyperparameters, and the calculation can make the objective function The optimal hyperparameter vector to minimize , the formula is as follows: Parameter initialization, including through multivariate Gaussian distribution to sample the hyperparameter vector, is the mean vector, which is used to initialize the center of the search space or randomly select a reasonable initial point. is the step size, which is used to control the distribution range of sampling points in the search space. The initial value is set according to experience or the size of the search space. is the covariance matrix, initially set to the unit matrix , indicating that the hyperparameters are independent of each other; Sampling, including at each generation In the current multivariate Gaussian distribution mid-sampling hyperparameter vector , where the generation method of each sample is as follows: Where, is from the zero vector as the mean, is sampled from the multivariate Gaussian distribution of the covariance matrix; Evaluation, for each sampled hyperparameter vector , use the corresponding tree-type ML model and calculate the loss function value on the validation set ; Select, sort the sampled hyperparameter vectors according to the loss function value, and select The optimal vector, , recorded as ; Parameter updates, including mean vector updates, step size updates, and covariance matrix updates; Iteration, the iterative process continues until the termination condition is met and the maximum number of iterations is reached , or step length Less than a certain threshold , or the change in the loss function value is less than a certain threshold.

7. The method for autonomous intrusion detection of industrial control systems based on AutoML according to claim 6, characterized in that: The mean vector update, step size update and covariance matrix update include: The mean vector is updated to include the new mean vector is the weighted average of the optimal samples, and the formula is as follows: Where, is the weight, satisfying , and the weight decreases with the performance of the sample, and the better the performance, the greater the weight of the sample; The step size update includes updating the step size according to the evolution path, which is reduced when approaching the optimal solution and increased when approaching the optimal solution. The formula is as follows: Where, is the learning rate for step size update, is the step damping parameter, is the cumulative evolutionary path; The covariance matrix is ​​updated, including updating the accumulated evolutionary path , and then update the accumulated evolutionary path , the formula is as follows: Where, To update the accumulated evolutionary path, and The learning rate for covariance matrix updates.

8. The method for autonomous intrusion detection of industrial control systems based on AutoML according to claim 1, characterized in that: The S40 includes: All tree-based ML models are automatically tuned for hyperparameters using CMA-ES, and the top three best-performing models are selected based on the F1-score indicator as base models.

9. The method for autonomous intrusion detection of industrial control systems based on AutoML according to claim 1, characterized in that: The S50 includes: Build The ladder structure of the layers, each layer contains multiple base models, and integrates the output of the previous layer through adaptive weights. Layer Base Model , , the input of this layer is the previous layer Output , the first layer input is the original data , calculate each base model in the The output of the layer is as follows: The inter-layer connection function integrates the output of all base models of this layer into the input of the next layer. The formula is as follows: Adaptive weight allocation mechanism is used to dynamically adjust layer weights according to different data characteristics. Output of the layer , whose contribution to the final prediction is determined by the weight function The decision formula is as follows: Where, It is a learnable scoring function implemented by a neural network; Combining the outputs of all layers, we get the final detection result: 。

Images