一种面向工控联网设备的层次聚类方法  

Hierarchical clustering method for industrial control networking equipment

作　　者：曲海阔 张哲宇 刘扬[1,3] 孙军 王子博 王佰玲[1,3] QU Haikuo;ZHANG Zheyu;LIU Yang;SUN Jun;WANG Zibo;WANG Bailing(School of Computer Science and Technology,Harbin Institute of Technology(Weihai),Weihai 264209,China;China Industrial Control Systems Cyber Emergency Response Team,Beijing 100040,China;Research Institute of CyberSpace Security,Harbin Institute of Technology,Harbin 150001,China)

机构地区：[1]哈尔滨工业大学(威海)计算机科学与技术学院,山东威海264209 [2]国家工业信息安全发展研究中心,北京100040 [3]哈尔滨工业大学网络空间安全研究院,黑龙江哈尔滨150001

出　　处：《现代电子技术》2022年第23期76-82,共7页Modern Electronics Technique

基　　金：国防基础科研计划(JCKY2019608B001)。

摘　　要：联网设备核查是工业控制系统安全巡检工作的首要任务,而其中设备层次识别对后续获取详细信息至关重要。针对工控系统内各层级联网设备因通信量不均衡而导致识别准确率低的问题,提出一种基于高斯混合模型的层次聚类方法。所提方法融入重采样的分批处理思想,通过对聚类中心进行重新采样,解决经典K⁃means算法对初始值过度依赖而引起的聚类结果偏离问题;进一步考虑算法的计算资源和运行时效等性能因素,引入训练数据分批处理操作,在保证算法精度的同时,缩短收敛时间,降低内存占用,达到优化算法效率的目的。最终,在一套工控模拟环境的安全水处理数据集上,通过与三个经典的聚类算法进行比较,验证所提方法对工控联网设备层次识别的有效性、准确性和稳定性。Networked equipment verification is the primary task of the safety inspection for industrial control systems,and the recognition of equipment hierarchy is essential for subsequent acquisition of detailed information.In view of the low recognition accuracy of networking equipment of each hierarchy in the industrial control system due to unbalanced communication volume,a hierarchical clustering method based on Gaussian mixture model(GMM)is proposed.The idea of resampling mini⁃batch processing is incorporated into the propose method.By resampling the clustering center,the clustering result deviation caused by excessive dependence of classical K⁃means algorithm on initial value is eliminated.And then,by taking account of the computing resource and runtime efficiency of the algorithm,mini⁃batch processing of training data is introduced to shorten the convergence time of the algorithm and reduce its memory occupation,which can achieve the purpose of optimizing the algorithm efficiency while ensuring the accuracy of the algorithm.By contrasting with the three classical clustering algorithms,the effectiveness,accuracy and stability of the proposed method for the hierarchy recognition of industrial control networking equipment has been verified on a set of data set of secure water treatment(SWaT)in an industrial control simulation environment.

关 键 词：联网设备 层次识别 统计特征 不均衡数据 高斯混合模型 聚类算法 重采样分批处理 

分 类 号：TN919-34[电子电信—通信与信息系统]