基于CGWO优化高斯过程的工控入侵检测  

Industrial control intrusion detection based on CGWO optimized Gaussian process

作　　者：张利隆 马垚 陈永乐 ZHANG Li-long;MA Yao;CHEN Yong-le(College of Information and Computer Science,Taiyuan University of Technology,Taiyuan 030024,China)

机构地区：[1]太原理工大学信息与计算机学院,山西太原030024

出　　处：《计算机工程与设计》2021年第12期3351-3358,共8页Computer Engineering and Design

基　　金：山西省重点研发计划基金项目(201903D121121)。

摘　　要：工业控制系统的数据具有非线性、冗余特征多的特点,传统的入侵检测方法并不适用。为提高检测的准确率、降低漏报率,将应用范围最广的工控协议Modbus/TCP作为研究对象,提出CGWO-GP的检测模型。利用拉普拉斯特征映射(LE)在处理非线性数据上的优势处理工控数据;为避免检测模型参数陷入局部最优,提出基于柯西变异算子的灰狼优化算法(CGWO)对高斯过程(GP)参数进行优化。采用密西西比州立大学提出的工控标准数据集进行实验,与多种算法进行多组对比,实验结果表明,所提检测模型表现更优,准确率均值为98.96%,漏报率均值为0.44%,误报率均值为0.13%。The data of industrial control system are nonlinear and redundant,so the traditional intrusion detection method is not suitable.To improve the accuracy of detection and reduce the rate of false negatives,the most widely used industrial control protocol Modbus/TCP was used as the research object,and the detection model of CGWO-GP was proposed.The advantages of Laplacian Eigenmaps(LE)in processing nonlinear data were used to process industrial control data.To avoid the detection model parameters falling into the local optimum,the gray wolf optimization algorithm based on the Cauchy mutation operator(CGWO)was proposed to optimize the Gaussian process(GP)parameters.Experiments were carried out using the industrial control standard data set proposed by Mississippi State University,and multiple groups of comparisons were carried out with various algorithms.The results show that the proposed detection model performs better,with an average accuracy rate of 98.96%and an average false negative rate of 0.44%.The average false positive rate is 0.13%.

关 键 词：入侵检测 工业控制系统 MODBUS/TCP协议 拉普拉斯特征映射 高斯过程 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]