一种使用深度联合学习的ICS自适应异常检测方法

Distributed Outlier Detection Method in ICS Based on Improved Self-Adaptive Deep Federating Learning

为了提高工业控制系统异常检测方法的准确性、及时性以及可部署性,提出了一种使用深度联合学习的ICS自适应异常检测方法。具体来说,首先提出了一种轻量级局部学习模型,以提高学习速度,合理利用硬件资源,保证了部署在分布式边缘设备中的可行性。其次提出了一种只基于正常数据的无监督学习模型,并结合核分位数估计对检测机制进行自适应动态调整。最后将上述方法整合到联合学习框架下,使其能有效地在边缘段攻击源附近进行分布式异常检测,以最大化减少系统对异常攻击的响应时间。

In order to improve the accuracy,timeliness and deployability of outlier detection method for industrial control systems,an adaptive anomaly detection method using deep joint learning in distributed control system is proposed.Specifically,a lightweight local learning model is proposed in the first place to improve the learning speed,make reasonable use of hardware resources,and ensure the feasibility of deployment in distributed edge devices.Secondly,an unsupervised learning model based only on normal data is pro-posed,and the detection mechanism is dynamically adjusted with kernel quantile estimation.Finally,the above methods are integrated into the joint learning framework,so that it can effectively carry out distributed outlier detection near the attack source in the edge segment,so as to minimize the response time of the system to the abnormal attack.