摘要
Industrial Control Systems(ICSs)are the lifeline of a country.Therefore,the anomaly detection of ICS traffic is an important endeavor.This paper proposes a model based on a deep residual Convolution Neural Network(CNN)to prevent gradient explosion or gradient disappearance and guarantee accuracy.The developed methodology addresses two limitations:most traditional machine learning methods can only detect known network attacks and deep learning algorithms require a long time to train.The utilization of transfer learning under the modification of the existing residual CNN structure guarantees the detection of unknown attacks.One-dimensional ICS flow data are converted into two-dimensional grayscale images to take full advantage of the features of CNN.Results show that the proposed method achieves a high score and solves the time problem associated with deep learning model training.The model can give reliable predictions for unknown or differently distributed abnormal data through short-term training.Thus,the proposed model ensures the safety of ICSs and verifies the feasibility of transfer learning for ICS anomaly detection.
基金
supported in part by 2018 industrial Internet innovation and development project“Construction of Industrial Internet Security Standard System and Test and Verification Environment”
in part by the National Industrial Internet Security Public Service Platform
in part by the Fundamental Research Funds for the Central Universities(Nos.FRF-BD-19-012A and FRFTP-19-005A3)
in part by the National Natural Science Foundation of China(Nos.81961138010,U1736117,and U1836106)
in part by the Technological Innovation Foundation of Shunde Graduate School,University of Science and Technology Beijing(No.BK19BF006)。