基于超参数自动寻优的工控网络入侵检测  

Industrial Control Network Intrusion Detection Based on Hyperparameter Automatic Optimization

作　　者：刘会鹏 周治平[1,2] LIU Huipeng;ZHOU Zhiping(School of Internet of Things Engineering,Jiangnan University,Wuxi 214122,China;Engineering Research Center of Internet of Things Technology Applications Ministry of Education,Jiangnan University,Wuxi 214122,China)

机构地区：[1]江南大学物联网工程学院,江苏无锡214122 [2]江南大学物联网技术应用教育部工程研究中心,江苏无锡214122

出　　处：《信息与控制》2021年第4期427-434,共8页Information and Control

摘　　要：针对工业控制系统网络攻击日益增加,现有的基于深度学习入侵检测模型的最优超参数组难以确定,从而造成检测精度不高的问题,提出一种结合超参数优化算法和堆叠长短时记忆(SLSTM)网络的工控系统入侵检测模型,实现了基于深度学习工控入侵检测模型超参数的自动寻优,有效地提高了检测精度.首先,采用基于边界的合成少数类过采样技术解决原始数据中样本不平衡的问题.然后,采用贝叶斯优化算法搜索堆叠长短时记忆网络的最优超参数组.最后,在工控网络标准数据集上将所提算法与其他相关算法进行对比实验.实验结果表明所提算法在工控入侵检测中的适用性最高.With the increasing incidence of cyberattacks on industrial control systems,existing intrusion detection models based on deep learning experience difficulty in determining the optimal hyperparameter set;consequently,detection accuracy is low.To solve this problem,we propose an intrusion detection model that combines hyperparameter optimization algorithms and stacked long short-term memory(SLSTM)for industrial control systems.This model can automatically optimize the hyperparameters of the deep learning industrial control intrusion detection model.Thus,it effectively improves detection accuracy.First,we use the borderline synthetic minority oversampling technique to deal with the problem of sample imbalance in the original data.Second,we apply the Bayesian optimization algorithm to search for the optimal hyperparameter group of SLSTM.Lastly,we compare the proposed model with other related algorithms by using an industrial control network standard data set.Results show that our algorithm has the highest applicability in industrial control intrusion detection.

关 键 词：工业控制系统 入侵检测 超参数优化 堆叠长短时记忆 

分 类 号：TP273[自动化与计算机技术—检测技术与自动化装置]