基于DRSN-BiLSTM的电力信息网络入侵检测模型

Intrusion Detection Model of Power Information Network Based on DRSN-BiLSTM

网络流量的异常检测对于保护电力信息系统安全具有重要意义。目前深度学习等人工智能技术在入侵检测中表现出良好的性能,但由于电力流量数据中类别不平衡以及噪声含量高等问题,严重影响入侵检测模型的准确率。针对以上问题,文章提出了一种深度残差收缩网络(deep residual shrinkage networks,DRSN)-双向长短时记忆网络(bi-directional long short-term memory,BiLSTM)混合深度学习模型实现及时有效的多矢量攻击威胁识别与检测。首先采用条件生成对抗网络模型生成少数类数据,构造平衡数据集,然后使用DRSN-BiLSTM模型进行特征提取,DRSN中的残差项可以解决网络退化与过拟合问题,注意力机制降低了噪声对异常流量检测的影响,同时基于BiLSTM进行流量时序特征提取,最后用softmax分类器进行流量分类,实现网络入侵检测。该模型在电力信息系统数据集上进行了测试,结果显示,提出的混合深度学习模型在检测准确性、精确度、召回率和F1分数指标均优于比较算法。

Network traffic anomaly detection is of great significance to protect the security of power information system.At present,artificial intelligence technologies such as deep learning shows good performance in intrusion detection,but the accuracy of intrusion detection model is seriously affected due to the unbalanced category and high noise content in power traffic data.To solve the above problems,this paper proposes a DRSN-BiLSTM hybrid deep learning model to realize timely and effective multi-vector attack threat recognition and detection.Firstly,conditional generation adversarial network model is used to generate a few types of data and construct a balanced data set.Then,DRSN-BiLSTM model is used for feature extraction.Residual terms in deep residual shrinkage network(DRSN)can solve the problems of network degradation and overfitting.At the same time,BiLSTM is used to extract the features of the traffic timing sequence.Finally,softmax classifier is used to classify the traffic to realize network intrusion detection.The model was tested on the power measurement data set,and the results show that the proposed hybrid deep learning model outperforms the compared algorithm in detection accuracy,precision,recall and F1_score.