改进PSO-SVM工业防火墙白名单自学习方法研究  

Research on white-list self-learning method of industrial firewall with improved PSO-SVM

作　　者：潘峰 薛萍[2] 任翔宇 潘林伟 Pan Feng;Xue Ping;Ren Xiangyu;Pan Linwei(Maotai Institute,Zunyi 564507,China;School of ElectronicInformation Engineering,Taiyuan University ofScience and Technology,Taiyuan 030024, China;School of ElectronicInformation andElectrical Engineering,Shanghai Jiaotong University,Shanghai200240,China)

机构地区：[1]茅台学院,贵州遵义564507 [2]太原科技大学电子信息工程学院,山西太原030024 [3]上海交通大学电子信息与电气工程学院,上海200240

出　　处：《信息技术与网络安全》2019年第6期11-16,共6页Information Technology and Network Security

基　　金：横向科研项目;蓝盾PLC防火墙项目(201604)

摘　　要：工业防火墙作为工控系统的关键设备,提高工业防火墙白名单规则自学习的准确率已成为研究的重点。利用支持向量机(Support Vector Machines,SVM)算法计算准确率时,会发现其内核参数以及特征选择均会影响分类准确性。针对上述问题,提出了一种基于改进的粒子群优化算法和SVM相结合的白名单自学习算法。首先以五折交叉验证的准确率作为适应度函数,并使用SVM算法对训练样本训练,然后利用改进的粒子群优化算法找寻SVM中的c,g参数,最后进行仿真验证。实验结果表明,相比于粒子群优化算法(PSO)、网格搜索法(Grid-Search),正常数据类的准确率最大程度提高了20%,识别异常数据的准确率最大程度提高了22%。Industrial firewalls,as the key equipment of industrial control systems,have become the focus of research to improve the accuracy of self-learning of industrial firewall white- list rules.When the SVM classification algorithm is used to calculate the accuracy,it will find that its kernel parameter and feature selection will affect the classification accuracy.Aiming at the problems,it proposes a self-learning algorithm based on the improved particle swarm optimization algorithm and SVM.Firstly,the accuracy of the three-fold cross-validation is used as the fitness function,and SVM is used as the training sample for training.Then the improved particle swarm optimization algorithm is used to find the parameters in the SVM,and finally the simulation is verified.The experimental results show that compared with particle swarm optimization (PSO) and grid search (Grid-Search),the accuracy of the normal data class is increased by 20% to the maximum,and the accuracy of identifying abnormal data is increased by 22%.

关 键 词：工控网络安全 白名单自学习 改进粒子群算法 支持向量机 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]