深度学习在工控网络入侵检测中的应用

Deep Learning for Intrusion Detection in Industrial Control Networks

随着工业化和信息化的深度融合,工业控制系统与外部互联网的关系越来越紧密,网络攻击事件层出不穷。利用入侵检测方法及时发现可能或潜在的网络入侵行为对于工业控制系统的安全稳定运行具有重要意义。然而,传统的入侵检测方法在识别未知的入侵行为和针对工控系统的入侵行为方面存在一定的局限性。近年来,深度学习算法在许多场景下均取得了较好的应用效果,工控系统网络安全领域也涌现出许多基于深度学习的入侵检测方法。因此,本文首先整理了针对工控网络的典型入侵行为,然后报告了深度学习在工控网络DoS攻击检测、虚假数据注入检测和恶意软件检测中的应用现状,最后分析了该领域目前研究工作中存在的问题,以促进深度学习技术在工业网络入侵检测中的进一步研究和应用。

With the deep integration of industrialization and informatization,the relationship between industrial control systems and the external Internet is getting closer and closer,and cyber attacks occur one after another.Using intrusion detection methods to promptly detect possible or potential network intrusions is of great significance to the safe and stable operation of industrial control systems.However,traditional intrusion detection methods have certain limitations in identifying unknown intrusions and intrusions targeting the unique attributes of industrial control systems.In recent years,deep learning algorithms have achieved good application results in different scenarios,and many intrusion detection works based on deep learning have emerged in the field of industrial control system network security.Therefore,this article first sorts out the typical intrusion behaviors against industrial control networks,then reports the application status of deep learning in industrial control network DoS attack detection,false data injection detection and malware detection,and finally analyzes the current research work in this field.issues to promote further application research of deep learning technology in industrial network intrusion detection.