基于改进CNN的工业控制网络入侵检测研究

Research on intrusion detection of industrial control network based on improved CNN

现有工业控制网络入侵检测准确率不高,为此提出了一种改进CNN入侵检测方法。首先,针对传统CNN无法有效提取稀疏数据特征的问题,采用小尺寸卷积核串联的Inception模块替代传统CNN卷积层,针对网络平均池化或最大池化可能弱化或丢失关键信息的问题,采用自适应池化方式;然后,基于改进CNN构建工业控制网络入侵检测模型;最后,通过NSL-KDD数据集和天然气管道数据集对入侵检测模型的性能进行验证。结果表明,在NSL-KDD数据集上,相较于传统CNN算法和Inception-CNN,改进CNN算法的准确率可达98.50%,误报率为0.34%;在天然气管道数据集上,相较于C-SVM算法和K-means算法,改进CNN算法的准确率可达96.32%,误报率仅为1.25%。改进CNN可实现工业控制网络入侵的高精度检测。

Aiming at the low accuracy of intrusion detection in existing industrial control networks,an improved CNN intrusion detection method is proposed.Firstly,aiming at the problem that CNN network can not effectively extract sparse data features,the Inception module connected in series with small-size convolution kernel is used to replace the standard CNN convolution layer.Based on the improved CNN network,the intrusion detection model of industrial control network is constructed;Finally,the effectiveness of intrusion detection is verified by NSL-KDD data set and natural gas pipeline data set.The results show that on the NSL-KDD dataset,compared with the standard CNN algorithm and Inception-CNN,the improved CNN accuracy is 98.5%and the false positive rate is 0.34%;On the natural gas pipeline data set,compared with C-SVM algorithm and K-means algorithm,the accuracy of the improved CNN algorithm is 96.32%,and the false positive rate is only 1.25%,which can realize the high-precision detection of industrial control network intrusion.