Intrusion detection method based on space-time correlation of industrial control data
By combining 1DCNN and BiLSTM, the spatiotemporal correlation features of industrial control data are extracted, which solves the problem that existing detection methods are difficult to identify intrusion behavior, achieves efficient anomaly detection, and ensures the security of industrial control systems.
Patent Information
- Application Number
- CN202411829457.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-12
- Publication Date
- 2026-02-06
AI Technical Summary
Existing detection methods struggle to extract effective data features from industrial control system data, making it difficult to effectively identify intrusion behavior in industrial control systems and resulting in low accuracy in intrusion detection.
1DCNN is used to extract spatial features from industrial control data, and its output is used as input to BiLSTM to capture the temporal and long-term dependencies of industrial control data. The output of BiLSTM is then classified by a classification module.
It improves the accuracy of anomaly detection in industrial control system data, enabling rapid identification of abnormal behavior and data, and protecting the data security of industrial control systems.
Smart Images
Figure CN121485950A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the field of industrial control systems and data security, and specifically relates to an intrusion detection method based on the spatiotemporal correlation of industrial control data. BACKGROUND
[0002] With the continuous evolution of network attacks, attacks on industrial control systems have become more covert and complex. Traditional intrusion detection methods are difficult to extract effective data features from industrial control data. This chapter further explores the intrusion detection method of industrial control systems from the spatiotemporal correlation of industrial control system data. Industrial control systems are composed of multiple devices, sensors, and control nodes, which are spatially related. Attackers may manipulate a device or sensor to affect the normal operation of other related devices. In addition, industrial control system data usually has time series characteristics, and there is correlation and dependence between adjacent time points. Intrusion behavior may be implemented by changing the pattern and trend of time series data. Therefore, by extracting the spatial features and time series features between industrial control data, the intrusion detection model can be better trained to effectively identify the differences between normal operation and potential intrusion behavior.
[0003] Industrial control system data contains state information and transmission connection information. State information covers various aspects of industrial control logic, including input, distribution state, and control state, which reflects the real-time state and operation of the industrial control system. Transmission connection information includes device address, context, time, and packet length. Traditional intrusion detection methods are difficult to extract deeper features from these information, while deep learning methods can automatically learn feature representations of data through multiple layers of neural networks, and can learn higher-level and more abstract feature representations from raw data to fully exploit the potential information in data. 1DCNN (1D Convolutional Neural Network) is mainly used to process one-dimensional sequence data, which uses convolutional layers to extract features of sequence data, and performs convolution operations through sliding windows to obtain features within the window and pass them to the next layer. It is more suitable for processing local relationships in sequence data than traditional fully connected neural networks, and better extracts spatiotemporal features in industrial control data. BiLSTM (Bi-directional Long Short-Term Memory) processes sequence data in the forward and reverse directions in time order, which can consider past and future context information, and better extract time series features in industrial control data. SUMMARY
[0004] The present application aims at the defects and actual needs in the prior art, and provides an intrusion detection method based on space-time correlation of industrial control data, which can mine deeper features of the industrial control data to realize training of an anomaly detection model, effectively realize discovery of abnormal behaviors or detection of abnormal data, protect data security of the industrial control system, and provide strong technical support for safety protection in actual industrial control production environments.
[0005] The present application aims at the defects and actual needs in the prior art, and provides an intrusion detection method based on space-time correlation of industrial control data, which can mine deeper features of the industrial control data to realize training of an anomaly detection model, effectively realize discovery of abnormal behaviors or detection of abnormal data, protect data security of the industrial control system, and provide strong technical support for safety protection in actual industrial control production environments.
[0006] To achieve the above object, the technical scheme of the present application is as follows: an intrusion detection method based on space-time correlation of industrial control data, comprising:
[0007] extracting spatial features of the industrial control data in the training set based on 1DCNN;
[0008] taking the output of the 1DCNN as the input of the BiLSTM, capturing time sequence dependency and long-term dependency relationship in the industrial control data based on the BiLSTM, and further extracting time sequence features of the industrial control data;
[0009] classifying the output of the BiLSTM through a classification module.
[0010] In an embodiment of the present application, the method specifically comprises the following steps:
[0011] Step S1: pre-processing the industrial control data through data standardization and One-hot encoding;
[0012] Step S2: extracting spatial features of the industrial control data based on 1DCNN;
[0013] Step S3: taking the output of the 1DCNN as the input of the BiLSTM, capturing time sequence dependency and long-term dependency relationship in the industrial control data based on the BiLSTM, and further extracting time sequence features of the industrial control data;
[0014] Step S4, classifying the output of the BiLSTM through a full connection layer.
[0015] In an embodiment of the present application, step S1 specifically comprises the following steps:
[0016] Step S11, constructing a data set of the industrial control data as a data set Set;
[0017] Step S12, performing standardization processing on the industrial control data in the data set Set, that is, performing the following calculation on each feature attribute of the industrial control data in the data set Set:
[0018]
[0019] In the formula, x is the original data, x' is the standardized data, and μ and σ represent the mean and standard deviation of the original data, respectively;
[0020] Step S13, performing One-hot encoding on the industrial control data, converting the feature attributes into binary feature representation, and dividing the data set into a training set and a test set.
[0021] In an embodiment of the present application, step S2 specifically comprises the following steps:
[0022] Step S21, performing spatial feature extraction based on 1DCNN;
[0023] Step S22, adopting a Relu nonlinear activation function, and the function expression is as follows:
[0024] f(x) = max(0, x)
[0025] Wherein, x is an input value, and f(x) is an output value; when the value of x is less than 0, f(x) is equal to 0, and when the value of x is greater than 0, f(x) is equal to the input value x.
[0026] In an embodiment of the present application, in step S21, the extraction formula is as follows:
[0027]
[0028] Wherein, represents the input of the jth position in the lth layer feature after convolution, M j is the input data, represents the ith input feature in the l-1th layer, is a convolution kernel between the l-1th layer and the lth layer, which connects the ith input feature and the jth position through is a bias term.
[0029] In an embodiment of the present application, step S3 specifically comprises the following steps:
[0030] Step S31, calculating two layers of hidden layer features respectively through forward LSTM and reverse LSTM;
[0031] Step S32, combining the outputs of forward and reverse LSTM through linear fusion to obtain more comprehensive time sequence feature representation.
[0032] In an embodiment of the present application, step S31 specifically comprises the following steps:
[0033] Step S31A1, in forward LSTM calculation, the industrial control data is input to the forward part of BiLSTM in time sequence for processing; wherein the forward LSTM calculation formula is as follows:
[0034]
[0035] Wherein, at t moment, i t is the output of the input gate, is the candidate cell state, f t is the output of the forget gate, C t is the cell state of the current time step, C t-1 is the cell state of the previous time step, O t is the output of the output gate, is the hidden state of forward LSTM; sigma is a Sigmoid activation function, whose output range is between (0, 1); w is a weight matrix, used for connecting the input X t of the current time step; U is a weight matrix, used for connecting the hidden state h t-1 of the previous time step; b is a bias term;
[0036] Step S31A2, in reverse LSTM calculation, the industrial control data is processed in time sequence opposite to that of forward LSTM calculation; wherein the reverse LSTM calculation formula is as follows:
[0037]
[0038] In the calculation formula of reverse LSTM, U is a weight matrix, used for connecting the hidden state h t+1 of the next time step.
[0039] In an embodiment of the present application, in step S32, the linear fusion formula of BiLSTM in two directions is as follows:
[0040]
[0041] Wherein, represents the final hidden layer feature at t moment, and respectively represent the hidden states of the forward and backward LSTM at time t, W h and b h respectively represent the weight matrix and bias value.
[0042] The application further provides an intrusion detection system based on the spatiotemporal correlation of industrial control data, comprising a memory, a processor, and computer program instructions stored in the memory and capable of being executed by the processor, and when the processor executes the computer program instructions, the method steps described above can be realized.
[0043] The application further provides a computer readable storage medium, which stores computer program instructions capable of being executed by a processor, and when the processor executes the computer program instructions, the method steps described above can be realized.
[0044] Compared with the prior art, the application has the following beneficial effects: the application faces industrial control system data, constructs an intrusion detection method based on the spatiotemporal correlation of industrial control data, uses a machine learning algorithm for intrusion detection, and finally constructs an industrial control system intrusion detection model by extracting spatiotemporal features, which can effectively realize the discovery of abnormal behavior or the detection of abnormal data, help industrial control system safety management personnel quickly identify abnormal data and behavior, locate the equipment that appears abnormal, better guarantee the safe operation of industrial control equipment, prevent subsequent attacks by attackers, reduce losses, realize rapid detection of industrial control abnormal data, protect the data security of industrial control systems, and provide strong technical support for safety protection in actual industrial control production environments. BRIEF DESCRIPTION OF DRAWINGS
[0045] Figure 1 The method of the embodiment of the application is described with reference to the accompanying drawings. DETAILED DESCRIPTION
[0046] The technical solutions of the application will be described in detail below with reference to the accompanying drawings.
[0047] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the present application. Unless otherwise indicated, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application pertains.
[0048] It should be noted that the terms used herein are only intended to describe specific embodiments, and are not intended to limit the exemplary embodiments according to the present application. As used herein, the singular form is intended to include the plural form unless the context clearly indicates otherwise, and it should be understood that when the terms "comprise" and / or "include" are used in the specification, there is a feature, step, operation, device, component, and / or combination thereof.
[0049] The application provides an intrusion detection method based on space-time correlation of industrial control data, comprising:
[0050] extracting space features of the industrial control data in the training set based on 1DCNN;
[0051] taking the output of the 1DCNN as the input of the BiLSTM, capturing time sequence dependency and long-term dependency in the industrial control data based on the BiLSTM, and further extracting time sequence features of the industrial control data;
[0052] classifying the output of the BiLSTM through a classification module.
[0053] The following is a specific implementation process of the application.
[0054] As shown in Figure 1 The embodiment provides an intrusion detection method based on space-time correlation of industrial control data, and specifically comprises the following steps:
[0055] Step S1, pre-processing data of an industrial control system through data standardization and One-hot encoding;
[0056] Step S2, extracting space features of the industrial control data based on a 1DCNN algorithm;
[0057] Step S3, taking the output of the 1DCNN as the input of the BiLSTM, capturing time sequence dependency and long-term dependency in the industrial control data based on the BiLSTM, and further extracting time sequence features of the industrial control data;
[0058] Step S4, classifying the output of the BiLSTM through a full connection layer;
[0059] In the embodiment, in step S1, the industrial control system data is pre-processed, specifically comprising the following steps:
[0060] Step S11, recording the industrial control data as a data set Set;
[0061] Step S12, standardizing the industrial control data set, which can reduce the difference between data by standardizing the data, and calculating each feature attribute in the data set Set as follows:
[0062] In the formula, x is the original data, x' is the standardized data, and mu and sigma represent the mean and standard deviation of the original data, respectively.
[0063] Step S13, One-hot encoding the industrial control data, converting the attributes into binary feature representation, and dividing the data set into a training set and a test set;
[0064] In this embodiment, step S2, which involves extracting spatial features from industrial control data based on the 1DCNN algorithm, specifically includes the following steps:
[0065] Step S21: Extract spatial features based on 1DCNN. The extraction formula is as follows:
[0066]
[0067] in, M represents the input at the j-th position in the l-th layer features after convolution. j For input data, This represents the i-th input feature in the (l-1)-th layer. For the convolution kernel between the (l-1)th layer and the lth layer, through To connect the i-th input feature and the j-th position, This is a bias term.
[0068] Step S22: The ReLU nonlinear activation function is used to effectively mitigate the gradient vanishing problem. Its function expression is as follows:
[0069] f(x) = max(0,x)
[0070] Where x is the input value and f(x) is the output value. When the value of x is less than 0, f(x) equals 0; when the value of x is greater than 0, f(x) equals the input value x.
[0071] In this embodiment, step S3 uses the output of 1DCNN as the input of BiLSTM to further extract the temporal features of the industrial control data, specifically including the following steps:
[0072] Step S31: Calculate the features of the two hidden layers using forward LSTM and backward LSTM respectively;
[0073] Step S32: Combine the outputs of the forward and backward LSTMs through linear fusion to obtain a more comprehensive temporal feature representation;
[0074] In this embodiment, step S31, which calculates the features of the two hidden layers using forward LSTM and backward LSTM respectively, specifically includes the following steps:
[0075] Step S31A1: In the forward LSTM calculation, industrial control data is input into the forward part of the BiLSTM for processing in chronological order. The forward LSTM calculation formula is as follows:
[0076]
[0077] Where, at time t, i tis the output of the forget gate, is the candidate cell state, f t is the output of the forget gate, C t is the cell state of the current time step, C t-1 is the cell state of the previous time step, O t is the output of the output gate, is the hidden state of the forward LSTM; sigma is a sigmoid activation function, the output range of which is between (0, 1); w is a weight matrix used for connecting the input X t of the current time step; U is a weight matrix used for connecting the hidden state h t-1 of the previous time step; b is a bias term;
[0078] In step S31A2, data is processed in reverse time order in the reverse LSTM calculation. The reverse LSTM calculation formula is as follows:
[0079]
[0080] In the reverse LSTM calculation formula, U is a weight matrix used for connecting the hidden state h t+1 of the next time step.
[0081] In this embodiment, in step S32, the linear fusion formula of the BiLSTM in two directions is as follows:
[0082]
[0083] wherein, represents the final hidden layer feature at t time, and respectively represent the hidden states of the forward and reverse LSTM at t time, W h and b h respectively represent a weight matrix and a bias value.
[0084] The embodiment faces industrial control system data, uses a machine learning algorithm to perform intrusion detection, and finally constructs an industrial control system intrusion detection model, which can effectively realize the discovery of abnormal behaviors or the detection of abnormal data, can help an industrial control system safety management personnel to quickly identify abnormal data and behaviors, locate to the device where the anomaly occurs, thereby better guaranteeing the safe operation of the industrial control device, preventing subsequent attacks by attackers, reducing losses, and realizing rapid detection of abnormal industrial control data.
[0085] The application further provides an intrusion detection system based on the spatiotemporal correlation of industrial control data, which comprises a memory, a processor, and computer program instructions stored in the memory and capable of being executed by the processor, and when the processor executes the computer program instructions, the method steps described above can be realized.
[0086] The application further provides a computer readable storage medium, which has stored computer program instructions capable of being run by a processor, and the computer program instructions, when run by the processor, can implement the method steps as described above.
[0087] Those skilled in the art should understand that embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk memory, CD-ROM, optical memory, etc.) containing computer-usable program code.
[0088] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that implements the functions specified in the flowcharts and / or block diagrams.
[0089] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer readable memory produce a manufacture product including instruction apparatus, which implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that implements the functions specified in the flowcharts and / or block diagrams.
[0090] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus, so that a series of operation steps are performed on the computer or other programmable data processing apparatus to produce a computer-implemented process, so that the instructions executed on the computer or other programmable data processing apparatus provide a process for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that implements the functions specified in the flowcharts and / or block diagrams.
[0091] The above merely describes preferred embodiments of the present application, but is not intended to limit the present application to other forms, and any person skilled in the art can make changes or modifications to the above disclosed technical contents into equivalent embodiments with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiments without departing from the technical solution content of the present application, and according to the technical essence of the present application, still belongs to the protection scope of the technical solution of the present application.
Claims
1. An intrusion detection method based on the spatio-temporal correlation of industrial control data, characterized in that, include: Spatial features of training-focused industrial control data are extracted using 1DCNN. The output of 1DCNN is used as the input of BiLSTM. Based on BiLSTM, the temporal and long-term dependencies in industrial control data are captured, and the temporal features of industrial control data are further extracted. The output of BiLSTM is classified using a classification module.
2. The intrusion detection method based on the spatio-temporal correlation of industrial data according to claim 1, characterized in that, The method specifically includes the following steps: Step S1: Preprocess the industrial control data through data standardization and one-hot encoding; Step S2: Extract spatial features from industrial control data based on 1DCNN; Step S3: Use the output of 1DCNN as the input of BiLSTM. Based on BiLSTM, capture the temporal dependencies and long-term dependencies in the industrial control data, and further extract the temporal features of the industrial control data. Step S4: Classify the output of BiLSTM through a fully connected layer.
3. The intrusion detection method based on the spatio-temporal correlation of industrial data according to claim 1, characterized in that, Step S1 specifically includes the following steps: Step S11: Denote the dataset constructed from industrial control data as Dataset Set; Step S12: Standardize the industrial control data in the dataset Set, that is, perform the following calculations on each feature attribute of the industrial control data in the dataset Set: In the formula, x represents the original data, x′ represents the standardized data, and μ and σ represent the mean and standard deviation of the original data, respectively. Step S13: Perform one-hot encoding on the industrial control data, convert the feature attributes into binary feature representations, and divide the dataset into training and test sets.
4. The intrusion detection method based on the spatio-temporal correlation of industrial data according to claim 2, characterized in that, Step S2 specifically includes the following steps: Step S21: Extract spatial features based on 1DCNN; Step S22: Use the ReLU nonlinear activation function, the expression of which is as follows: f(x) = max(0,x) Where x is the input value and f(x) is the output value; when the value of x is less than 0, f(x) equals 0, and when the value of x is greater than 0, f(x) equals the input value x.
5. The intrusion detection method based on the spatio-temporal correlation of industrial data according to claim 4, characterized in that, In step S21, the extracted formula is as follows: wherein, represents the input of the jth position in the ith feature in the lth layer after convolution, M j is the input data, represents the ith input feature in the l-1th layer, is the convolution kernel between the l-1th layer and the lth layer, and is obtained by connects the ith input feature and the jth position, is a bias term.
6. The intrusion detection method based on the spatio-temporal correlation of industrial data according to claim 2, characterized in that, Step S3 specifically includes the following steps: Step S31: Calculate the features of the two hidden layers using forward LSTM and backward LSTM respectively; Step S32: Combine the outputs of the forward and backward LSTMs through linear fusion to obtain a more comprehensive temporal feature representation.
7. The intrusion detection method based on the spatio-temporal correlation of industrial data according to claim 6, characterized in that, Step S31 specifically includes the following steps: Step S31A1: In the forward LSTM calculation, industrial control data is input into the forward part of the BiLSTM for processing in chronological order; the forward LSTM calculation formula is as follows: where, at time t, i t is the output of the input gate, is the candidate cell state, f t is the output of the forget gate, C t is the cell state of the current time step, C t-1 is the cell state of the previous time step, O t is the output of the output gate, is the hidden state of the forward LSTM; σ is the Sigmoid activation function whose output ranges between (0, 1); w is the weight matrix for connecting the input X t of the current time step; U is the weight matrix for connecting the hidden state h t-1 of the previous time step; b is the bias term; Step S31A2: In the reverse LSTM calculation, the industrial control data is processed in the reverse time sequence of the forward LSTM calculation; the reverse LSTM calculation formula is as follows: In the calculation formula of the reverse LSTM, U is a weight matrix, used to connect the hidden state h of the next time step t+1 .
8. The intrusion detection method based on the spatio-temporal correlation of industrial data according to claim 6, characterized in that, In step S32, the bidirectional linear fusion formula of BiLSTM is as follows: where, denotes the final hidden layer feature at time t, and denote the hidden states of the forward and backward LSTMs at time t, respectively, W h and b h denote the weight matrix and bias value, respectively.
9. An intrusion detection system based on the spatio-temporal correlation of industrial data, characterized in that, It includes a memory, a processor, and computer program instructions stored in the memory and executable by the processor, which, when executed by the processor, enable the implementation of the steps of the method as described in any one of claims 1-8.
10. A computer readable storage medium having stored thereon computer program instructions capable of being executed by a processor, the computer program instructions, when executed by the processor, capable of implementing the method steps of any one of claims 1-8.