Industrial control system intrusion detection method based on category enhancement graph learning

Abstract

The invention relates to the technical field of network intrusion detection, in particular to an industrial control system intrusion detection method based on category enhancement graph learning, which comprises the following steps: carrying out communication relationship modeling on flow data among a plurality of industrial control devices to obtain a line graph model, and carrying out graph enhancement on the line graph model to obtain a category enhancement graph; and training the graph convolutional network model based on the category enhanced graph, optimizing the graph convolutional network model by adopting supervised contrast learning and cross entropy loss in the training process, and outputting the optimized graph convolutional network model. In order to solve the problem that interaction data analysis needs a large amount of annotation data, and consequently the effect in an industrial small sample scene is poor, a line graph model is established for data traffic between industrial control devices and is further enhanced, so that the feature difference of different attack categories and the compactness of similar attacks are enhanced; and the intra-class feature similarity and the inter-class difference are constrained by supervising and comparing the loss function, so that the detection robustness and the generalization ability of the model under the low sample condition are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of network intrusion detection technology, and specifically to an intrusion detection method for industrial control systems based on category-enhanced graph learning. Background Technology

[0002] Industrial Control Systems (ICS) are core systems supporting the automated operation of industrial production, widely used in critical infrastructure sectors such as power, energy, manufacturing, and water. Their core functions include real-time data acquisition, equipment monitoring, and remote control, relying on proprietary protocols (such as Modbus and OPC UA) and closed network environments. However, with the development of the Industrial Internet, ICS are increasingly interconnected with enterprise IT networks and even exposed to the internet, facing increasingly severe cybersecurity threats. Due to the high real-time requirements of ICS and the incompatibility with traditional IT security measures, problems such as delayed vulnerability patching and attack detection have long existed. These threats not only cause economic losses but may also endanger public safety, urgently requiring targeted protection solutions.

[0003] In recent years, deep learning has been widely used in intrusion detection technology in industrial IoT scenarios. Researchers have used convolutional neural networks and recurrent neural networks to extract spatial and temporal features from IoT network data in tabular sequence form, thereby improving the performance of network intrusion detection. However, these methods struggle to capture the network flow interaction states between edge devices in ubiquitous industrial environments, and also find it difficult to characterize the structured features of network flow data.

[0004] Recent studies have delved into graph-based network intrusion detection techniques, aiming to enhance the expressive power of structured spatiotemporal network flow features. Tariq et al. proposed a graph structure called the Security Object Graph to correlate various types of security events and utilized an autoencoder to detect anomalies within the graph. Furthermore, Liao et al. proposed an internal intrusion detection method by using graph embedding to encode the semantic description of organizational structure. However, these studies did not consider the actual network topology; graph data was merely used as a tool to integrate heterogeneous information. Meanwhile, some studies have begun to explore the spatial information of real-world networks to varying degrees. Nguyen et al. proposed a graph-based deep learning model that detects botnets by analyzing network traffic behavior. However, this model only learns the topological information of the target network and does not address the features of nodes or edges. Mothukuri et al. applied Graph Neural Networks (GNNs) to identify spoofing attacks in smart grids. This application of GNNs in smart grids inspires the potential deployment of threat awareness systems in the Internet or Industrial Internet of Things (IIoT). Similarly, Lo et al. constructed a customized GNN model, E-GraphSAGE, for performing security threat awareness detection. In E-GraphSAGE, edge information is collected by mapping the original source IP addresses to randomly assigned IP addresses, thereby extracting edge features for classification. Although E-GraphSAGE utilizes both network topology information and statistical properties of network traffic, the strategy of assigning raw traffic to random IP addresses inevitably alters the actual spatial distribution of the network, making it difficult to capture the network's evolution.

[0005] Most of the above works fall under the category of supervised learning methods, which require a large amount of high-quality labeled data to support high-accuracy model training. However, in the industrial IoT environment, collecting large-scale network flow interaction data requires a significant amount of time and manpower, which significantly raises the barrier to entry for building network intrusion detection systems. Summary of the Invention

[0006] To address the aforementioned problems in existing technologies, we now provide an intrusion detection method for industrial control systems based on category-enhanced graph learning.

[0007] The specific technical solution is as follows:

[0008] An intrusion detection method for industrial control systems based on category-enhanced graph learning includes:

[0009] Step S1: Model the communication relationship between the traffic data of multiple industrial control devices to obtain a line graph model, and perform graph augmentation on the line graph model to obtain a category-enhanced graph;

[0010] Step S2: Train the graph convolutional network model based on the category enhancement graph, and optimize the graph convolutional network model by using supervised contrastive learning and cross-entropy loss during the training process before outputting the result;

[0011] The graph convolutional network model is used to classify the traffic data received by the industrial control equipment to determine whether there is attack traffic.

[0012] On the other hand, step S1 includes:

[0013] Step S11: Collect the data packets input and output from each of the industrial control devices in the industrial control system and label the field information;

[0014] The field information includes the IP address and port number for sending and receiving data packets, general fields, and protocol information;

[0015] Step S12: Preprocess the data packet to obtain the traffic data;

[0016] Step S13: Generate the original communication graph based on the traffic data, and generate the line graph model based on the communication edges of the original communication graph;

[0017] Step S14: Perform adaptive graph augmentation on the line graph model to obtain the category augmentation graph.

[0018] On the other hand, step S12 includes:

[0019] Step S121: Extract the classification features from the data packet and add a label indicating whether it corresponds to attack traffic;

[0020] Step S122: Convert the classification features and the annotations into target codes;

[0021] Step S123: Normalize the target code to obtain the traffic data.

[0022] On the other hand, the original communication graph includes multiple original communication graph nodes and the communication edges connecting the original communication graph nodes;

[0023] Each line graph node in the line graph model is generated by constructing a multi-dimensional feature vector based on the corresponding communication link in the communication edge.

[0024] On the other hand, step S13 includes calculating the discard probability of the line graph model and discarding edges according to the discard probability, then adding attribute perturbation, and protecting important features in the process of adding attribute perturbation.

[0025] The method for generating the discard probability includes:

[0026]

[0027] In the formula, Let be the discard probability of edge (u,v). The importance of edges is measured using the node centrality index. Let (u,v) be the metric for measuring the importance of edge (u,v). Let be the centrality index of node u connected by edge (u,v). Let be the centrality index of node v connected by edge (u,v). The importance metric for the edge (u,v) after covariance regularization p e p is a scale hyperparameter. τ For the truncation probability, for The maximum value, for The average value;

[0028] Methods for measuring and obtaining the aforementioned important features include:

[0029]

[0030] In the formula, W i f As an indicator of the importance of attribute dimensions, The value of the i-th dimension of the attribute vector. This is the importance index of the attribute dimension after logarithmic regularization. p is a metric for measuring the importance of node attributes. e p is a scale hyperparameter. τ For the truncation probability, for The maximum value, for The average value.

[0031] On the other hand, the graph convolutional network model consists of an encoder, a projector head, and a classifier arranged sequentially.

[0032] The encoder forms a node representation of the target node by aggregating features from the neighboring nodes of the target node, and then constructs an entity feature vector.

[0033] The projection head maps the entity feature vector to the latent space based on a two-layer multilayer perceptron to obtain a mapped projection.

[0034] The classifier includes multiple fully connected layers, and the classifier obtains the predicted probabilities corresponding to different categories of entities based on the mapping projection.

[0035] On the other hand, in step S2, the supervised contrastive learning includes:

[0036] Samples of the same category in multiple views are treated as positive samples, and samples of different categories are treated as negative samples, and a contrastive learning objective is constructed:

[0037]

[0038] In the formula, L supcon This results in a loss of overall learning objectives. Let N be the number of nodes in a single line graph model, N be the learning objective relative to the i-th node, P(i) be the set of positive samples of the same type, p be the positive sample in the set of positive samples of the same type, and z be the learning objective relative to the i-th node. i For anchor point features, z a For any other node a in the line graph model, z p Let τ be the feature of the positive sample node p, and let τ be the sampling temperature of the e-exponential function.

[0039] On the other hand, the process of generating the cross-entropy loss includes:

[0040]

[0041] In the formula, L ce The cross-entropy loss is used, where n is the total number of training samples, c is the total number of classes, and y is the cross-entropy loss. ij Let i be the true label of the i-th training sample relative to the j-th class. Let be the predicted label of the i-th training sample relative to the j-th class.

[0042] On the other hand, in step S2, a total loss function is obtained by weighting the loss from the supervised contrastive learning and the cross-entropy loss, and the graph convolutional network model is trained using the total loss function.

[0043] The above technical solution has the following advantages or beneficial effects:

[0044] To address the issue that existing network flow interaction data analysis technologies require large amounts of labeled data, resulting in poor performance in industrial scenarios with small sample sizes, this solution establishes and enhances a line graph model of data traffic between industrial control devices. This strengthens the feature differences between different attack categories (such as ransomware attacks and Modbus protocol abuse) and the compactness of similar attacks. Furthermore, by using a supervised comparative loss function to constrain intra-class feature similarity and inter-class differences, the solution fully mines the label category information and potential attack patterns (such as abnormal OPC UA communication and illegal function code injection) in industrial control traffic, significantly improving the model's detection robustness and generalization ability under low-sample conditions. Attached Figure Description

[0045] Embodiments of the invention will be described more fully with reference to the accompanying drawings. However, the drawings are for illustration and explanation only and do not constitute a limitation on the scope of the invention.

[0046] Figure 1 This is an overall schematic diagram of an embodiment of the present invention;

[0047] Figure 2 This is a schematic diagram of step S1 in an embodiment of the present invention;

[0048] Figure 3 This is a schematic diagram of step S12 in an embodiment of the present invention;

[0049] Figure 4 This is a schematic diagram of a convolutional network model in an embodiment of the present invention;

[0050] Figure 5 This is a schematic diagram illustrating the identification accuracy of different types of network intrusions on the NF-BoT-IoT-v2 dataset according to an embodiment of the present invention.

[0051] Figure 6 This is a schematic diagram illustrating the accuracy of different types of network intrusions on the NF-ToN-IoT-v2 dataset according to an embodiment of the present invention;

[0052] Figure 7 This represents the accuracy of identifying different types of network intrusions on the NF-CSE-IDS2018-v2 dataset in this embodiment of the invention. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0055] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, but this is not intended to limit the scope of the invention.

[0056] This invention includes:

[0057] An intrusion detection method for industrial control systems based on category-enhanced graph learning, such as Figure 1 As shown, it includes:

[0058] Step S1: Model the communication relationship between the traffic data of multiple industrial control devices to obtain a line graph model, and perform graph augmentation on the line graph model to obtain a category-enhanced graph;

[0059] Step S2: Train the graph convolutional network model based on the category augmentation graph, and optimize the graph convolutional network model by using supervised contrastive learning and cross-entropy loss during the training process before outputting the result;

[0060] Graph convolutional network models are used to classify traffic data received by industrial control equipment to determine whether there is attack traffic.

[0061] Specifically, addressing the issue that existing technologies for network flow interaction data analysis require a large amount of labeled data, resulting in poor performance in industrial scenarios with small sample sizes, this solution establishes and enhances a line graph model of data traffic between industrial control devices. This strengthens the feature differences of different attack categories (such as ransomware attacks and Modbus protocol abuse) and the compactness of similar attacks. Furthermore, by using a supervised comparative loss function to constrain intra-class feature similarity and inter-class differences, the solution fully mines the label category information and potential attack patterns (such as abnormal OPC UA communication and illegal function code injection) in industrial control traffic, significantly improving the model's detection robustness and generalization ability under low sample conditions.

[0062] Specifically, the aforementioned industrial control system intrusion detection method is configured as a software implementation in corresponding computer systems, such as servers in industrial systems, during practical applications. An industrial control system (ICS) refers to a unified communication and control system in the industrial Internet of Things (IIoT) field, where multiple industrial control devices are interconnected via a network. This includes multiple industrial control computers (ICCs), routers, gateway devices, firewalls, and other network-connected devices. These devices interact according to pre-defined communication protocols, such as TCP / IP and Modbus, to meet various communication needs in industrial production scenarios. In practical applications, various network intrusion behaviors may occur in this system, such as unauthorized access from external ports, or intrusion into ICC devices followed by intrusion into other devices along the ICC network. These intrusion behaviors are typically transmitted in the form of data packets within the network. Existing technologies usually detect the data packets using specific algorithms to determine the presence of intrusion behavior.

[0063] However, due to the significant differences in network topology in different industrial scenarios, models trained using general datasets may have poor detection performance and may not be able to capture the network evolution process for dynamically changing data packets.

[0064] In response to this scenario, this solution first collects traffic data between industrial control devices to draw a communication graph corresponding to the network topology. Traditional communication graphs record the communication connections between devices in the form of communication edges, which is difficult to directly adapt to the mainstream graph neural network (GNN) architecture that aggregates features centered on nodes, resulting in key interaction information not being effectively integrated into the representation learning process.

[0065] To address this issue, this embodiment aggregates the communication edges in the communication graph to form a specific line graph model. Each node in the line graph model represents the connection and data interaction between each industrial control device and other devices.

[0066] The line graph structure has the following advantages over the original communication graph (referred to as the "original graph"): First, each degree in the original graph is d. i The key equipment (such as the central controller) corresponds to d in the line diagram. i (d i -1) / 2 edges enable high-frequency communication links to gain greater weight in feature aggregation, more accurately reflecting the dependence strength between devices; secondly, the redundant spectrum characteristics of the line graph structure can reduce the number of high eigenvalues ​​in the Laplacian matrix, alleviating the gradient explosion problem caused by topological heterogeneity in traditional GNNs in industrial communication graphs, thereby improving the numerical stability of model training; by transforming the edge features of the original communication graph into node features, it can be directly adapted to existing node-based GNN encoders (such as GCN, GAT, etc.), avoiding the complex graph structure reconstruction process.

[0067] Subsequently, the edges in the communication graph are discarded and enhanced based on the graph enhancement process, generating perturbed dual-view graph data as a category enhancement graph, thereby improving the generalization ability of the model.

[0068] The graph convolutional network model is then trained based on the category augmentation graph. During the training process, a combination of supervised contrastive learning and cross-entropy loss is used to optimize the model, so as to finally obtain a graph convolutional network model suitable for the current network topology.

[0069] During the application process, by collecting the input and output data packets of each industrial control device at the current node and reorganizing them to obtain a new line graph model, which is then input into the graph convolutional network model, it is possible to predict whether there is intrusion behavior in the current network and whether there are intrusion entities in each industrial control device.

[0070] In one embodiment, such as Figure 2 As shown, step S1 includes:

[0071] Step S11: Collect the data packets input and output from each industrial control device in the industrial control system and label the field information;

[0072] The field information includes the IP address and port number for sending and receiving data packets, general fields, and protocol information;

[0073] Step S12: Preprocess the data packets to obtain traffic data;

[0074] Step S13: Generate the original communication graph based on the traffic data, and generate a line graph model based on the communication edges of the original communication graph;

[0075] Step S14: Perform adaptive graph augmentation on the line graph model to obtain a category augmentation graph.

[0076] Specifically, in order to achieve better data acquisition results, in this embodiment, during the data construction process, the data packets input and output by each industrial control device in the industrial control system are collected and labeled with field information, including 43 features that can be used to characterize the data packets, such as the IP address and port number of the data packets sent and received, general fields and protocol information. Subsequently, the data packets are preprocessed to obtain traffic data.

[0077] It is particularly important to note that for each traffic data point, the IP address and port number attributes need to be combined into a single attribute via concatenation. Since some types of attacks are associated with specific port numbers, using only the IP address is insufficient to distinguish these attacks; therefore, the combined attribute can more accurately capture behavioral patterns associated with different attacks.

[0078] Based on the processed traffic data, the corresponding original communication graph can be drawn. In this graph, devices are nodes, and their communication behaviors (including protocol type, port number, message frequency, function code, etc.) are attribute features of the edges, forming the basic topology that describes the system's operating state.

[0079] Based on this, a line graph model is generated according to the communication edges of the original communication graph. This includes mapping each communication edge in the original communication graph to a node in the line graph, whose attribute is the multi-dimensional feature vector of the corresponding communication link. If two communication edges share the same industrial control equipment IP address, a connection edge is established between the two corresponding nodes in the line graph, thereby explicitly depicting the indirect communication dependency between devices.

[0080] Finally, adaptive graph augmentation is performed on the line graph model to obtain a category-enhanced graph, thereby preserving the potential topology and key node attributes of the input line graph.

[0081] In one embodiment, such as Figure 3 As shown, step S12 includes:

[0082] Step S121: Extract the fields of the data packet to obtain classification features and add a label indicating whether it corresponds to attack traffic;

[0083] Step S122: Convert the classification features and labels into target codes;

[0084] Step S123: Normalize the target code to obtain traffic data.

[0085] Specifically, to achieve better data cleaning, this embodiment first extracts classification features from data packets and adds labels indicating whether they correspond to attack traffic. This includes merging the IP address and port number attributes into a single attribute for each traffic data point by concatenation. Since some types of attacks are associated with specific port numbers, using only the IP address is insufficient to distinguish these attacks; therefore, the merged attribute can more accurately capture behavioral patterns associated with different attacks.

[0086] Next, the categorical features are target-encoded and converted into numerical form. Simultaneously, labels representing benign / malicious traffic and attack types are also converted into numerical values ​​so that the model can better understand and process this categorical information. Finally, a standard scaler is used to normalize the features to obtain standardized feature values. This helps eliminate the influence of differences in units between different features, improving the effectiveness and stability of model training.

[0087] In one embodiment, the original communication graph includes multiple original communication graph nodes and communication edges connecting the original communication graph nodes;

[0088] Each line graph node in the line graph model is generated by constructing a multi-dimensional feature vector based on the corresponding communication link in the communication edge.

[0089] Specifically, considering that convolutional network models can achieve good aggregation of node features but poor feature recognition of edges, this embodiment selects a processing method that first constructs the original communication graph and then converts it into a line graph model.

[0090] In this context, devices are treated as nodes in the graph, and their communication behaviors (including protocol type, port number, message frequency, function code, etc.) serve as attribute features of edges, forming the basic topology that describes the system's operating state.

[0091] Based on this, a line graph model is generated according to the communication edges of the original communication graph. This includes mapping each communication edge in the original communication graph to a node in the line graph, whose attribute is the multi-dimensional feature vector of the corresponding communication link. If two communication edges share the same industrial control equipment IP address, a connection edge is established between the two corresponding nodes in the line graph, thereby explicitly depicting the indirect communication dependency between devices.

[0092] The line graph structure has the following advantages over the original communication graph: First, each degree in the original graph is d. iThe key equipment (such as the central controller) corresponds to d in the line diagram. i (d i -1) / 2 edges enable high-frequency communication links to gain greater weight in feature aggregation, more accurately reflecting the dependence strength between devices; secondly, the redundant spectrum characteristics of the line graph structure can reduce the number of high eigenvalues ​​in the Laplacian matrix, alleviating the gradient explosion problem caused by topological heterogeneity in traditional GNNs in industrial communication graphs, thereby improving the numerical stability of model training; by transforming the edge features of the original communication graph into node features, it can be directly adapted to existing node-based GNN encoders (such as GCN, GAT, etc.), avoiding the complex graph structure reconstruction process.

[0093] In one embodiment, step S13 includes calculating the discard probability for the line graph model and discarding edges according to the discard probability, as well as adding attribute perturbations and protecting important features during the process of adding attribute perturbations.

[0094] The methods for generating the discard probability include:

[0095]

[0096] In the formula, Let be the probability of discarding edge (u,v). The importance of edges is measured using the node centrality index. Let (u,v) be the metric for measuring the importance of edge (u,v). Let be the centrality index of node u connected by edge (u,v). Let be the centrality index of node v connected by edge (u,v). A measure of the importance of edges (u,v) after covariance regularization p e p is a scale hyperparameter. τ For the truncation probability, for The maximum value, for The average value;

[0097] Methods for measuring important features include:

[0098]

[0099] In the formula, W i f As an indicator of the importance of attribute dimensions, The value of the i-th dimension of the attribute vector. This is the importance index of attribute dimensions after log-regularization. p is a metric for measuring the importance of node attributes. e p is a scale hyperparameter.τ For the truncation probability, for The maximum value, for The average value.

[0100] Specifically, in order to preserve the potential topology and key node attributes of the input line graph, this embodiment adopts an adaptive graph augmentation strategy to generate perturbed dual-view graph data, including data augmentation in the topology dimension and data augmentation in the attribute dimension.

[0101] Unlike traditional enhancement methods that randomly discard edges / nodes, this strategy preserves important structural information through the following mechanisms: It calculates the discard probability based on node communication frequency, protocol sensitivity, and edge topological centrality (such as betweenness centrality), assigning lower perturbation probabilities to high-frequency communication links and critical protocol edges; during attribute perturbation, it prioritizes protecting fields strongly related to attack behavior, such as function codes and OPC tags, to avoid compromising the discriminative power of attack characteristics due to excessive perturbation.

[0102] For data augmentation in the topology dimension, let's call it... Let u and v be the probabilities of discarding edges. Construct the enhanced edge set according to the following probabilities:

[0103]

[0104] The importance of an edge is measured using the node centrality index, denoted as p. e p is a scale hyperparameter. τ For the truncation probability, for The maximum value, for The average value of edge centrality is defined as the average of the centralities of two related nodes, and the edge drop probability is defined as the edge centrality after regularization logarithm operation.

[0105]

[0106] For data augmentation at the attribute dimension, a mask vector is applied. The node features are scrambled, and each dimension of the mask vector is independently sampled from the Bernoulli distribution:

[0107]

[0108] Similar to topology augmentation, attribute augmentation also employs an adaptive masking strategy that reflects the influence of attribute dimensions. It assumes that feature dimensions that frequently appear in influential network flows are considered influential feature dimensions. This assumption is reasonable because each dimension of a node's feature corresponds to each field in the network flow; fields that frequently appear in important network flows are naturally considered important features.

[0109] Remember W i f p is an indicator of the importance of attribute dimensions. e p is a scale hyperparameter. τ For the truncation probability, for The maximum value, for The average value;

[0110] The probability of the i-th dimension attribute being masked is constructed as follows:

[0111]

[0112] Based on the above process, dual-view graph data are generated as category augmentation graphs, which are then combined with pre-added annotations to form a dataset for subsequent training.

[0113] In one embodiment, such as Figure 4 As shown, the convolutional network model consists of an encoder A1, a projector A2, and a classifier A3 arranged sequentially.

[0114] Encoder A1 forms the node representation of the target node by aggregating the features of the neighboring nodes of the target node, and then constructs the entity feature vector;

[0115] Projector A2 uses a two-layer multilayer perceptron to map entity feature vectors to the latent space to obtain a mapped projection.

[0116] The classifier A3 consists of multiple fully connected layers. The classifier obtains the predicted probabilities corresponding to different categories of entities based on mapping projection.

[0117] Specifically, in this embodiment, the model consists of encoder A1, projection head A2, and classifier A3:

[0118] Encoder A1 learns node representations by aggregating features from neighboring nodes. The encoder is shared by the subsequent classifiers and projectors in both branches.

[0119] The aggregation of neighbor nodes at each level can be represented as follows:

[0120]

[0121] This represents the characteristics of the k-th layer neighbor nodes of node v. This represents the k-th layer features of node v, where k denotes the k-th layer of the graph neural network, N(v) is the set of neighboring nodes of node v, and W... k Let be the weights of the k-th layer of the graph neural network.

[0122] The role of the projection head A2 is to map the entity feature vector to a fixed-dimensional latent space, thereby improving the representation quality generated by the encoder.

[0123] The projection head A2 is implemented using a two-layer multilayer perceptron (MLP). The embeddings following projection head A2 are further normalized to a unit sphere, and feature similarity can be measured using dot products in the projection space. The projection head does not participate in forward propagation during the inference phase.

[0124] The classifier A3 is implemented using a multi-layer fully connected neural network. The input feature representation is used to obtain the predicted probability of different categories of entities, thereby determining whether the data packets sent by the industrial control equipment are related to network intrusion.

[0125] In one embodiment, step S2, supervised contrastive learning includes:

[0126] Samples of the same category in multiple views are treated as positive samples, and samples of different categories are treated as negative samples, and a contrastive learning objective is constructed:

[0127]

[0128] In the formula, L supcon This results in a loss of overall learning objectives. Let N be the number of nodes in a single line graph model, N be the learning objective relative to the i-th node, P(i) be the set of positive samples of the same class, p be the positive samples in the set of positive samples of the same class, and z be the learning objective relative to the i-th node. i For anchor point features, z a For any other node a in the line graph model, z p Let τ be the feature of the positive sample node p, and let τ be the sampling temperature of the e-exponential function.

[0129] The generation process of cross-entropy loss includes:

[0130]

[0131] In the formula, L ce The cross-entropy loss is used, where n is the total number of training samples, c is the total number of classes, and y is the cross-entropy loss. ij Let i be the true label of the i-th training sample relative to the j-th class. Let be the predicted label of the i-th training sample relative to the j-th class.

[0132] Specifically, existing contrastive learning methods face core challenges in industrial control systems, including scarce attack samples, imbalanced class distribution, and blurred attack feature boundaries. For example, normal industrial control communication (such as Modbus commands) and attack behaviors (such as illegal function code injection) have similar features at the protocol layer, while traditional self-supervised learning struggles to effectively utilize limited label information to construct strong discriminative representations.

[0133] To address this, this invention proposes a category-enhanced graph learning optimization framework. Based on line graph enhancement of industrial control communication graphs, it extracts multimodal features such as protocol type and function code sequence through a graph attention network, and designs a supervised contrastive loss function: intra-class compactness constraints enhance the feature consistency of similar attacks (such as ransomware), inter-class separation constraints enhance the differences between different attack categories (such as zero-day attacks and known malicious behaviors), and combines dynamic hard example mining strategies to optimize the representational differences of easily confused attack patterns (such as Modbus covert instructions and normal control instructions), significantly improving detection performance and generalization ability under small sample conditions.

[0134] Regarding the supervised contrastive learning part, assume the original image contains N points, and there are 2N sample points in the two augmented views. Let the anchor point feature be z. i In multiple views, samples of the same category are considered positive samples, and samples of different categories are considered negative samples. P(i) is the set of positive samples of the same category. The following contrastive learning objective is constructed as LOSS:

[0135]

[0136] The other branch acts as a classifier, calculating the cross-entropy loss of network threat entities. Let n and c be the number of training samples and the number of classes, respectively, and y... ij Let i be the true label of the i-th training sample relative to the j-th class. Let the predicted label of the i-th training sample be relative to the j-th class. The cross-entropy classification loss is defined as follows:

[0137]

[0138] Finally, in step S2, the total loss function is obtained by weighting the loss from supervised contrastive learning and the cross-entropy loss, and the graph convolutional network model is trained using the total loss function.

[0139] Meanwhile, weight sharing is used during training to transfer the parameters between the two parts.

[0140] This invention employs three widely used benchmark datasets: NF-BoT-IoT-v2, NF-ToN-IoT-v2, and NF-CSE-CIC-IDS2018-v2. All of these datasets are network flow datasets. Each data sample represents a series of network traffic packets between two edge devices. A total of 43 features are presented, showcasing common fields and information about certain protocols.

[0141] All traffic-based features are extracted from the packet header, not the payload. NF-BoT-IoT-v2 is an IoT dataset based on network traffic, derived from network conditions in 2018. This dataset contains 37,763,497 traffic records, of which 37,628,460 (99.64%) are malicious traffic and 135,037 (0.36%) are benign traffic. NF-ToN-IoT-v2 is an IoT dataset based on network traffic implemented in 2019. This dataset contains 16,940,496 data streams, of which 10,841,027 (63.99%) are malicious traffic and 6,099,469 (36.01%) are benign traffic. NF-CSE-CIC-IDS2018-v2 is a dataset collected in 2018. The dataset contains 18,893,708 network traffic records, of which 2,258,141 (11.95%) are malicious traffic and 16,635,567 (88.05%) are benign traffic.

[0142] Before converting network traffic into a network graph, a series of preprocessing steps were performed to ensure high data quality and consistency. First, for each traffic data point, the IP address and port number attributes were merged into a single attribute via concatenation. Since certain types of attacks are associated with specific port numbers, using only the IP address is insufficient to distinguish these attacks; therefore, the merged attribute can more accurately capture behavioral patterns associated with different attacks. Second, to ensure data consistency and integrity, missing values ​​and infinity values ​​were uniformly filled with zero, avoiding anomalies in subsequent analysis.

[0143] Next, the categorical features are target-encoded and converted into numerical form. Simultaneously, labels representing benign / malicious traffic and attack types are also converted into numerical values ​​so that the model can better understand and process this categorical information. Finally, a standard scaler is used to normalize the features to obtain standardized feature values. This helps eliminate the influence of differences in units between different features, improving the effectiveness and stability of model training.

[0144] The experiments compared several representative machine learning and graph neural network intrusion detection methods. Machine learning benchmark algorithms included AdaBoost, k-Nearest Neighbors (KNN), decision trees, and tree-based ensemble methods (such as XGBoost, Random Forest, and Extra Trees). Graph neural network benchmark algorithms included supervised algorithms E-GraphSAGE and E-ResGAT, and the unsupervised algorithm Anomaly-E. Evaluation metrics included accuracy, precision, recall, and F1 score across both binary and multi-class classification.

[0145] To evaluate the ability of our method to distinguish between malicious and benign traffic, we conducted binary classification experiments with 30% of the samples labeled. The experimental results were compared with other representative graph neural network (GNN) based methods, and metrics including accuracy, precision, recall, and F1 score were reported. Our solution performed excellently on these three datasets. On the NF-CSE-CIC-IDS2018-v2 dataset, our method achieved the best F1 score and accuracy. Specifically, on the NF-ToN-IoT-v2 dataset, our method achieved 96.9% accuracy and 96.62% F1 score; while on the NF-BoT-IoT dataset, our method achieved 99.89% accuracy and 91.12% F1 score, demonstrating superior performance on both datasets. Furthermore, the proposed method demonstrates commendable results compared to graph-based methods, showcasing the potential advantage of label-aware graph contrastive loss in learning compact intra-class representations. Finally, the tree-based ensemble learning method achieves competitive results on all datasets, indicating that ensemble learning significantly improves performance compared to a single classifier.

[0146] To evaluate its ability to accurately distinguish between various attacks, our method conducted multi-class classification experiments with 30% labeled samples, the same setting as the binary classification experiments. On the NF-CSE-CIC-IDS2018-v2 dataset, our method achieved a state-of-the-art accuracy of 99.52% and a state-of-the-art F1 score of 81.38%. Furthermore, our method's F1 score significantly outperformed other methods, surpassing XGBoost and exceeding the second-place result by 6.61 percentage points. These results demonstrate that our method not only effectively detects real threats but also minimizes the risk of false positives. On the NF-BoT-IoT-v2 dataset, our method outperformed other methods across all four evaluation metrics. On the NF-ToN-IoT-v2 dataset, our method also performed exceptionally well, achieving an accuracy of 94.32% and an F1 score of 73.31%, showcasing state-of-the-art detection performance. On the NF-ToN-IoT-v2 dataset, tree-based ensemble learning methods demonstrate consistently superior performance in both binary and multi-class classification tasks, contrasting with their performance on the NF-CSE-CIC-IDS2018-v2 dataset. This suggests that these methods are sufficient to capture complex relationship patterns in industrial network data. Compared to binary classification tasks, our method shows a smaller performance gap with the best random forest algorithm in multi-class classification tasks, highlighting the advantage of using line graphs to model the relationships between network threat entities. Experimental results demonstrate that our method not only maintains high performance in multi-class classification tasks but also exhibits superiority in complex pattern recognition. These results further validate the effectiveness and reliability of our method in processing complex industrial network data.

[0147] This invention compares the performance of our method with E-graphSAGE on the NF-BoT-IoT-v2, NF-ToN-IoT-v2, and NF-CSE-CIC-IDS2018-v2 datasets using F1 scores, with the proportion of labeled samples set to 30%. Figure 5 Results are presented on the NF-BoT-IoT-v2 dataset, which includes four attack scenarios: reconnaissance, DDoS, DoS, and theft. As shown in the table, our method outperforms E-graphSAGE in all four attack scenarios. Particularly for theft attacks, E-graphSAGE fails to effectively identify them due to sample scarcity, while our method achieves an F1 score of 57.14%. Theft attacks aim to obtain sensitive data through camouflage techniques (such as social engineering), and these results demonstrate that our method can detect rare and covert attacks. Figure 6The results of the NF-ToN-IoT-v2 dataset are presented, which contains nine attack scenarios: backdoor, DoS, DDoS, injection, man-in-the-middle (MITM) attack, password attack, ransomware, scanning, and cross-site scripting (XSS). As shown in the table, E-graphSAGE achieves F1 scores of 48.36%, 59.37%, and 73.56% for injection, DDoS, and XSS attacks, respectively. On the one hand, the relatively small sample size for these attack scenarios makes it difficult for the model to capture their behavioral patterns; on the other hand, these attacks are more easily misclassified as normal network traffic entities. For example, injection attacks involve manipulating or injecting malicious code to change the execution path, cross-site scripting (XSS) is also a type of injection operation performed in web applications, and DDoS is a distributed DoS attack launched by multiple hosts, where attackers can reduce the attack rate to evade detection. In contrast, this method introduces a class-enhanced graph contrastive loss objective and improves the graph convolution process through line graph construction. After these operations, the F1 score for DDoS attacks improved from 59.37% to 87.96%, the F1 score for injection attacks improved from 48.36% to 76.36%, and the F1 score for XSS attacks improved from 73.56% to 92.57%. Notably, E-graphSAGE outperformed our method on two extremely rare attack scenarios: man-in-the-middle (MITM) attacks and ransomware attacks. The NF-CSE-CIC-IDS2018-v2 dataset covers six attack scenarios, including brute-force attacks, botnets, denial-of-service (DoS), distributed denial-of-service (DDoS), infiltration, and web attacks. Figure 7 As shown, E-graphSAGE achieves F1 scores of only 34.04% and 14.59% for DoS and penetration attacks, respectively. Besides the aforementioned difficulty in detecting DoS, penetration attacks are another complex type of attack. Penetration attacks may involve insiders with legitimate system access and employ stealth techniques to avoid detection. By introducing label-enhanced contrastive loss targets, our method significantly improves the detection capability for DoS attacks, increasing the F1 score from 34.04% to 99.14%. Furthermore, our method also brings substantial improvements for penetration attacks, with the F1 score increasing dramatically from 14.59% to 82.76%. These significant performance improvements demonstrate the remarkable effectiveness of category-enhanced graph learning in identifying different types of threat entities.

[0148] The above are merely preferred embodiments of the present invention and are not intended to limit the implementation methods and protection scope of the present invention. Those skilled in the art should recognize that any equivalent substitutions and obvious changes made based on the description and illustrations of the present invention should be included within the protection scope of the present invention.

Claims

1. An intrusion detection method for industrial control systems based on category-enhanced graph learning, characterized in that, include: Step S1: Model the communication relationship between the traffic data of multiple industrial control devices to obtain a line graph model, and perform graph augmentation on the line graph model to obtain a category-enhanced graph; Step S2: Train the graph convolutional network model based on the category enhancement graph, and optimize the graph convolutional network model by using supervised contrastive learning and cross-entropy loss during the training process before outputting the result; The graph convolutional network model is used to classify the traffic data received by the industrial control equipment to determine whether there is attack traffic.

2. The industrial control system intrusion detection method according to claim 1, characterized in that, Step S1 includes: Step S11: Collect the data packets input and output from each of the industrial control devices in the industrial control system and label the field information; The field information includes the IP address and port number for sending and receiving data packets, general fields, and protocol information; Step S12: Preprocess the data packet to obtain the traffic data; Step S13: Generate the original communication graph based on the traffic data, and generate the line graph model based on the communication edges of the original communication graph; Step S14: Perform adaptive graph augmentation on the line graph model to obtain the category augmentation graph.

3. The industrial control system intrusion detection method according to claim 2, characterized in that, Step S12 includes: Step S121: Extract the classification features from the data packet and add a label indicating whether it corresponds to attack traffic; Step S122: Convert the classification features and the annotations into target codes; Step S123: Normalize the target code to obtain the traffic data.

4. The industrial control system intrusion detection method according to claim 2, characterized in that, The original communication graph includes multiple original communication graph nodes and the communication edges connecting the original communication graph nodes; Each line graph node in the line graph model is generated by constructing a multi-dimensional feature vector based on the corresponding communication link in the communication edge.

5. The industrial control system intrusion detection method according to claim 1, characterized in that, Step S13 includes calculating the discard probability of the line graph model and discarding edges according to the discard probability, as well as adding attribute perturbation and protecting important features in the process of adding attribute perturbation. The method for generating the discard probability includes: In the formula, Let be the discard probability of edge (u,v). The importance of edges is measured using the node centrality index. Let (u,v) be the metric for measuring the importance of edge (u,v). Let be the centrality index of node u connected by edge (u,v). Let be the centrality index of node v connected by edge (u,v). The importance metric for the edge (u,v) after covariance regularization p e p is a scale hyperparameter. τ For the truncation probability, for The maximum value, for The average value; Methods for measuring and obtaining the aforementioned important features include: In the formula, W i f As an indicator of the importance of attribute dimensions, The value of the i-th dimension of the attribute vector. This is the importance index of the attribute dimension after logarithmic regularization. p is a metric for measuring the importance of node attributes. e p is a scale hyperparameter. τ For the truncation probability, for The maximum value, for The average value.

6. The industrial control system intrusion detection method according to claim 1, characterized in that, The graph convolutional network model consists of an encoder, a projector head, and a classifier arranged sequentially. The encoder forms a node representation of the target node by aggregating features from the neighboring nodes of the target node, and then constructs an entity feature vector. The projection head maps the entity feature vector to the latent space based on a two-layer multilayer perceptron to obtain a mapped projection. The classifier includes multiple fully connected layers, and the classifier obtains the predicted probabilities corresponding to different categories of entities based on the mapping projection.

7. The industrial control system intrusion detection method according to claim 1, characterized in that, In step S2, the supervised contrastive learning includes: Samples of the same category in multiple views are treated as positive samples, and samples of different categories are treated as negative samples, and a contrastive learning objective is constructed: In the formula, L supcon This results in a loss of overall learning objectives. Let N be the number of nodes in a single line graph model, N be the learning objective relative to the i-th node, P(i) be the set of positive samples of the same type, p be the positive sample in the set of positive samples of the same type, and z be the learning objective relative to the i-th node. i For anchor point features, z a For any other node a in the line graph model, z p Let τ be the feature of the positive sample node p, and let τ be the sampling temperature of the e-exponential function.

8. The industrial control system intrusion detection method according to claim 1, characterized in that, The process of generating the cross-entropy loss includes: In the formula, L ce The cross-entropy loss is used, where n is the total number of training samples, c is the total number of classes, and y is the cross-entropy loss. ij Let i be the true label of the i-th training sample relative to the j-th class. Let be the predicted label of the i-th training sample relative to the j-th class.

9. The industrial control system intrusion detection method according to claim 1, characterized in that, In step S2, a total loss function is obtained by weighting the loss from supervised contrastive learning and the cross-entropy loss, and the graph convolutional network model is trained using the total loss function.

Images