一种改进TPOT的工控入侵检测方法  

Improved TPOT Industrial Control Intrusion Detection Method

作　　者：杨瑞君 何立君 程燕[2] YANG Rui-jun;HE Li-jun;CHENG Yan(Department of Computer Science and Information Engineering,Shanghai Institute of Technology,Shanghai 201418,China;School of Criminal Law,East China University of Political Science and Law,Shanghai 201620,China)

机构地区：[1]上海应用技术大学计算机科学与信息工程学院,上海201418 [2]华东政法大学刑事法学院,上海201620

出　　处：《小型微型计算机系统》2022年第4期767-772,共6页Journal of Chinese Computer Systems

基　　金：教育部人文社会科学研究项目(17YJCZH031)资助。

摘　　要：自动构建工控系统入侵检测机器学习模型的过程中,针对基于树的管道优化工具(Tree-based Pipeline Optimization Tool)TPOT需要消耗大量时间和计算成本的问题,提出了一种分布式D-TPOT改进方法.该方法通过引入分块算法和动态任务调度能够使TPOT并行化构建工控入侵检测模型,以减少构建模型的时间.通过改变保留管道数和管道迭代次数的模型构建过程,在测试集中增加了15种训练集中未出现的攻击方式进行模型评估.实验表明,与TPOT相比,分布式D-TPOT在不降低构建入侵检测模型指标质量的情况下,D-TPOT构建的最佳模型在多项评估指标中,准确率为:92.89%、精确率为:94.66%、F3-Score为:92.45%,同时能够节省50%的模型构建时间.In the process of automatic construction of machine learning model for intrusion detection in industrial control systems,a distributed D-TPOT method was proposed to solve the problem that TPOT,a tree-based Pipeline Optimization Tool,needs a lot of time and computational cost.By introducing block algorithm and dynamic task scheduling,this method can parallelize TPOT to construct the industrial intrusion detection model,so as to reduce the time of model construction.By changing the model building process of the number of reserved pipelines and the number of pipeline iterations,15 attack methods that did not appear in the training set were added in the test set to evaluate the model.Experiments show that,compared with TPOT,the optimal model constructed by D-TPOT is 92.89%,94.66%,and F3-score in multiple evaluation indexes without reducing the quality of the indexes of intrusion detection model constructed by distributed D-TPOT.92.45%,and can save 50%of the model building time.

关 键 词：工控系统 入侵检测 TPOT 分块算法 动态任务调度 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]