基于组合森林的工业控制系统入侵检测

Intrusion Detection of Industrial Control System Based on Composite Forest

随着工业控制系统与互联网的关联逐渐紧密,增加了工控系统被外部入侵的可能性,其网络安全也变得日渐重要。针对上述问题,提出了一种基于组合孤立森林的IPCA-CIF入侵检测方法。该方法在PCA的基础上引入信息价值实现特征提取;其次,结合孤立森林和扩展孤立森林提出了一种组合森林的入侵检测方法,对降维后的数据进行入侵检测;最后构建入侵检测模型进行结果验证。实验表明,IPCA-CIF模型在SWa T数据集上,其检测率为0.986,F1-score可达0.893,具有良好的检测性能。

With the increasingly close connection between industrial control systems and the Internet,the possibility of external intrusion into industrial control systems has increased,and their network security has become increasingly important.In response to the above issues,this paper proposes an IPCA-CIF intrusion detection method based on combined isolated forests.This method introduces information value to achieve feature extraction based on PCA.Secondly,a combined forest intrusion detection method combining isolated forests and extended isolated forests is proposed to perform intrusion detection on dimensionality reduced data.Finally,construct an intrusion detection model for result validation.The experiment shows that the IPCA-CIF model has a detection rate of 0.986 and an F1 score of 0.893 on the SWaT dataset,demonstrating good detection performance.