基于改进极限学习机的数据采集与监控系统攻击检测模型  

Attack Detection Model of SCADA System Based on Data Preprocessing and Improved ELM

作　　者：张晓琴 汪云飞 胡春强[3] ZHANG Xiaoqin;WANG Yunfei;HU Chunqiang(Chongqing Communication Design Institute Co.Ltd.,Chongqing 400041,China;Aerospace Unary(Nanjing)Data Technology Co.Ltd.,Nanjing 210032,China;School of Big Data&Software Engineering,Chongqing University,Chongqing 400030,China)

机构地区：[1]重庆市信息通信咨询设计院有限公司,重庆400041 [2]航天壹进制(南京)数据科技有限公司,南京210032 [3]重庆大学大数据与软件学院,重庆400030

出　　处：《南京航空航天大学学报》2021年第5期708-717,共10页Journal of Nanjing University of Aeronautics & Astronautics

基　　金：国家自然科学基金(61702062)资助项目。

摘　　要：提出一种基于改进极限学习机(Online sequence extreme learning machine,OSELM)的新能源电站数据采集与监控(Supervisory control and data acquisition,SCADA)系统攻击检测模型。首先使用ADASYN算法对数据样本中的异常数据和正常数据进行数量平衡,以满足真实电站SCADA系统环境中异常数据量少的特点。接着使用降噪自编码网络对平衡后的数据进行约简,消除无关或冗余特征以降低检测模型的训练时间。最后在AWID数据集上进行了大量对比实验,结果表明,所提的数据约简方法可有效地降低数据维度,降低了检测时间;与其他基于浅层学习算法的检测分类器相比,本文所提方法在检测准确度和误报率方面也体现出了更优性能。An attack detection model for supervisory control and data acquisition(SCADA)system of new energy plant based on improved online sequence extreme learning machine(OSELM)is proposed.First of all,ADASYN algorithm is used to balance the number of abnormal data and normal data in the data samples,so as to meet the characteristics of less abnormal data in the real SCADA system environment.Then,the balanced data is reduced by using the de-noising autoencoding network(DAE),and the irrelevant and redundant features are eliminated to reduce the training time of the detection model.Finally,a large number of comparative experiments are carried out on the AWID data set.The results show that the proposed data reduction method can effectively reduce the data dimension and detection time.Compared with other detection classifiers based on shallow learning algorithm,the proposed method also shows better performance in detection accuracy and false alarm rate.

关 键 词：新能源电站 SCADA系统 攻击检测 极限学习机 数据约简 

分 类 号：TP274[自动化与计算机技术—检测技术与自动化装置]