工业物联网异常检测技术综述  

Overview of anomaly detection techniques for industrial Internet of things

作　　者：孙海丽 龙翔[1,2] 韩兰胜[1,3] 黄炎[4] 李清波 SUN Haili;LONG Xiang;HAN Lansheng;HUANG Yan;LI Qingbo(School of Cyber Science and Engineering,Huazhong University of Science and Technology,Wuhan 430074,China;Hubei Vocational College of Bio-Technology,Wuhan 430070,China;Cyberspace Security Center,Peng Cheng Laboratory,Shenzhen 518000,China;School of Computer Science and Technology,Huazhong University of Science and Technology,Wuhan 430074,China)

机构地区：[1]华中科技大学网络空间安全学院,湖北武汉430074 [2]湖北生物科技职业学院,湖北武汉430070 [3]鹏程实验室网络空间安全研究中心,广东深圳518000 [4]华中科技大学计算机科学与技术学院,湖北武汉430074

出　　处：《通信学报》2022年第3期196-210,共15页Journal on Communications

基　　金：国家自然科学基金资助项目(No.61272033,No.62072200,No.6217071437,No.62127808)。

摘　　要：针对不同的异常检测方法的差异及应用于工业物联网(IIoT)安全防护的适用性问题,从技术原理出发,调研分析2000—2021年发表的关于网络异常检测的论文,总结了工业物联网面临的安全威胁,归纳了9种网络异常检测方法及其特点,通过纵向对比梳理了不同方法的优缺点和适用工业物联网场景。另外,对常用数据集做了统计分析和对比,并从4个方向对未来发展趋势进行展望。分析结果可以指导按应用场景选择适配方法,发现待解决关键问题并为后续研究指明方向。In view of the differences of existing anomaly detection methods and the applicability when applied to security protection of the industrial Internet of things(IIoT),based on technical principles,the network anomaly detection papers published from 2000 to 2021 were investigated and the security threats faced by IIoT were summarized.Then,network anomaly detection methods were classified into 9 classes and the characteristics of each class was studied.Through lon-gitudinal comparison,the merits and shortcomings of different methods and their applicability to IIoT scenarios were sorted out.In addition,statistical analysis and comparison of common data sets were made,and the development trend in the future was forecasted from 4 directions.The analysis results can guide the selection of adaptive methods according to application scenarios,identify key problems to be solved,and point out the direction for subsequent research.

关 键 词：工业物联网 异常检测 网络入侵 网络攻击 

分 类 号：TN92[电子电信—通信与信息系统]