面向工业入侵检测的数据增强与特征提取的研究

DATA AUGMENTATION AND FEATURE EXTRACTION FOR INDUSTRIAL INTRUSION DETECTION

随着工业控制网络(Industrial Control Network,ICN)高速发展,ICN安全已经是全球性重要问题之一,工业入侵检测作为一种ICN安全防护技术成为研究热点。在工业入侵检测中,由于ICN数据存在攻击样本不平衡、特征维度高的问题,提出一种辅助生成对抗网络(Auxiliary Classifier Generative Adversarial Networks,ACGAN)与正则化堆栈稀疏自编码器(Batch Normalization Stacked Sparse Auto-Encoder,BN-SSAE)相结合的深度学习方法,运用ACGAN数据增强和BN-SSAE深层次特征提取解决上述问题,再使用多层感知机(MultiLayer Perceptron,MLP)进行分类,得到入侵检测结果。以ACGAN、BN-SSAE和MLP为基础建立工业入侵检测模型,使用密西西比州立大学数据集进行实验,结果表明该模型符合工业入侵检测的要求。利用加拿大网络安全研究所的CICIDS2017数据集进行验证,证明该模型在工业入侵检测中具有可行性和有效性。

With the rapid development of industrial control network(ICN),ICN security has become one of the most important global issues,and industrial intrusion detection has become a research hotspot as an ICN security protection technology.In industrial intrusion detection,due to the problem of unbalanced attack samples and high feature dimensions in ICN data,a deep learning method combining the auxiliary classifier generative adversarial networks(ACGAN)and batch normalization stacked sparse auto-encoder(BN-SSAE)is proposed.ACGAN data augmentation and BN-SSAE deep-level feature extraction were used to solve the above problems,and then a multi-layer perceptron(MLP)was used for classification to obtain the intrusion detection result.An industrial intrusion detection model was established based on ACGAN,BN-SSAE and MLP,and experiments were conducted on the Mississippi State University dataset.The results show that the model meets the requirements of industrial intrusion detection.The model is verified by the CICIDS2017 data set of the Canadian Institute for Cybersecurity,which proves that the model is feasible and effective in industrial intrusion detection.