基于胶囊网络的工业互联网入侵检测方法  

Intrusion Detection Method Based on Capsule Network for Industrial Internet

作　　者：胡向东[1] 李之涵 HU Xiang-dong;LI Zhi-han(School of Automation/School of Industrial Internet,Chongqing University of Posts and Telecommunications,Chongqing 400065,China)

机构地区：[1]重庆邮电大学自动化学院/工业互联网学院,重庆400065

出　　处：《电子学报》2022年第6期1457-1465,共9页Acta Electronica Sinica

基　　金：教育部-中国移动科研基金(No.MCM20150202)。

摘　　要：工业互联网在快速发展的同时,面临着严峻的信息安全风险.针对传统入侵检测方法准确性低、难以适应工业互联网海量不平衡数据的问题,提出一种基于胶囊网络的工业互联网入侵检测方法.首先,基于残差块构建特征提取模块,引入全局平均池化层得到高质量的数据特征;其次,使用动态路由算法,通过迭代的方式对入侵数据特征进行聚类,在胶囊网络模块完成数据分类.基于Modbus/TCP协议的气体管道传感器网络数据集的测试结果表明,该方法可以在隐性提取特征的同时改善检测准确率.与所列算法对比,本文方法提高了检测指标,对不平衡数据有更强的鲁棒性,更接近工业互联网入侵检测技术需求.Industrial internet is rapidly growing up while encountering severe information security risks at the same time.Aiming at the problem that traditional intrusion detection methods are low in accuracy and difficult to adapt to the massive unbalanced data of industrial Internet,an industrial Internet intrusion detection method based on capsule network is proposed.Firstly,a module involved feature extraction module is constructed based on the residual block,and a global average pooling layer is introduced to get high-quality data features.Secondly,the dynamic routing algorithm is introduced.The intrusion data features are clustered through iteration,and classification are completed in the module based on capsule network.The test results out of the data set from sensor network with Modbus/TCP protocol used in gas pipeline show that the method can improve the accuracy rate while extracting features implicitly.Compared to the listed algorithms,the proposed method in this paper performs better in test indexes with stronger robustness to unbalanced data and is closer to meet the needs of intrusion detection from industrial Internet.

关 键 词：工业互联网 入侵检测 胶囊网络 残差网络 

分 类 号：TN918.91[电子电信—通信与信息系统]