基于增量单类支持向量机的工业控制系统入侵检测

Intrusion Detection Based on Incremental One-class Support Vector Machine for Industrial Control System

工业控制系统入侵检测是工业网络中的一个难点问题,存在着系统建立速度慢、模型更新代价高和扩展性差等不足,因此提出一种基于增量单类支持向量机(one-class support vector machine,OCSVM)的工业控制系统入侵检测方法.根据正常Modbus/TCP数据信息,利用OCSVM算法学习正常行为的通信模式.随着新样本的持续增加,为了提高学习速度,进一步利用临近分类间隔和KKT条件对当前训练样本集进行约减,约减后的训练样本再次进行快速增量OCSVM训练.经过实验结果分析,证明了该方法在保持较高分类精度的同时提高了入侵检测系统的增量学习速度.

Intrusion detection in industrial control systems is a challenging problem in industrial networks and is usually characterized by low speed,high cost,and poor scalability. We use the one-class support vector machine (OCSVM) algorithm in a communication model of learning normal behavior from normal Modbus/TCP date sets. As the new sample continues to increase,the current training sample set is reduced from the nearclass interval and Karush-Kuhn-Tucker (KKT) conditions to improve the learning speed,and the reduced training sample set is used in the OCSVM incremental training. Our experimental data analysis shows that this method has higher classification accuracy and improves the learning speed of the intrusion detection system.