面向工业控制网络的入侵检测方法研究

Research on intrusion detection methods for industrial control network

针对目前工控网络环境存在的数据种类分布不均衡,维度较高等问题,采用生成式对抗网络(ACGAN)数据增强方法对数据集进行数据增强,并采用卷积神经网络(CNN)与极限学习机(ELM)混合模型对数据集进行特征提取和分类。通过NSL-KDD数据集进行仿真实验,该混合模型的准确率达到99.26%,漏报率低于0.625%,均优于传统的机器学习算法。同时采用密西西比州立大学天然气管道数据集进行实验仿真,准确率达到99.18%,漏报率低于0.621%。该模型在复杂的工控环境下同样适用,拓宽了工业入侵检测的研究思路。

Aiming at the problems of uneven distribution of data types and high dimensions in the current industrial control network environment,this paper uses the data augmentation method of auxiliary classifier generative adversarial network(ACGAN)to enhance the data set,and adopts a convolutional neural network(CNN)and extreme learning machine(ELM)hybrid model for feature extraction and classification of the data set.Through the simulation experiments on the NSL-KDD data set,the accuracy rate of the hybrid model reaches 99.26%,and the false negative rate is lower than 0.625%,which are better than traditional machine learning algorithms.At the same time,the natural gas pipeline data set of Mississippi State University is used for experimental simulation verification,with an accuracy rate of 99.18%and a false negative rate lower than 0.621%.This model is also applicable in complex industrial control environment,and broadens the research idea of industrial intrusion detection.