基于特征增强和优化SVM的工控入侵检测

Intrusion detection for industrial control system based on feature enhanced and optimized SVM method

针对工控入侵检测系统数据质量低、模型优化差等问题,提出一种基于特征增强和优化支持向量机(LMDRT-AWPRPSO-SVM)的工控入侵检测方法,从数据和模型两方面进行改进。数据方面,针对工控系统缺乏高质量数据,通过对数边际密度比变换(LMDRT)生成新的数据特征,提高数据的质量;模型方面,为解决SVM参数优化过程中易陷入局部极小等问题,采用种群聚集度指导权重自适应变化和粒子重构策略改进粒子群算法(AWPRPSO),增强优化算法搜索能力。使用工控标准数据集进行实验,其结果表明,该方法提高了数据的质量,优化了SVM模型性能,构建的检测模型在检测精度与训练时间方面均有改善。

To solve the problems of low data quality and poor model optimization of the industrial control intrusion detection system,an intrusion detection algorithm for industrial control system based on feature enhanced data and optimized SVM(LMDRT-AWPR-PSO-SVM)was proposed.The method was improved from two aspects including data and model.In terms of data,in view of the lack of high-quality data in ICS network,new data characteristics were generated by logarithmic marginal density ratio transformation to enhance the quality of ICS network data.In terms of model,to solve the problem of local minima in para-meter optimization of SVM models,particle swarm optimization was improved using population aggregation degree to guide weight adaptive change and particle reconstruction strategy(AWPRPSO)to enhance the searching ability of the optimization algorithm.The experiment was carried out with industrial control standard data set.The results show that the quality of data is improved,and the performance of SVM model is optimized using this method.The detection model constructed using this me-thod is improved in both detection accuracy and training time.