基于VAE和DLIESN的工控系统入侵检测方法  

Intrusion detection method of industrial control system based on VAE and DLIESN

作　　者：曹春明 何戡 宗学军[1,2] 连莲 CAO Chun-ming;HE Kan;ZONG Xue-jun;LIAN Lian(College of Information Engineering,Shenyang University of Chemical Technology,Shenyang 110142,China;Liaoning Provincial Key Laboratory of Information Security for Petrochemical Industry,Shenyang University of Chemical Technology,Shenyang 110142,China)

机构地区：[1]沈阳化工大学信息工程学院,辽宁沈阳110142 [2]沈阳化工大学辽宁省石油化工行业信息安全重点实验室,辽宁沈阳110142

出　　处：《计算机工程与设计》2023年第11期3283-3289,共7页Computer Engineering and Design

基　　金：辽宁省“兴辽英才计划”基金项目(XLYC2002085);辽宁省教育厅2020年度科学研究经费基金项目(LJ2020020)。

摘　　要：针对现有工控系统入侵检测方法训练复杂,且对攻击样本检测率低的问题,提出一种基于变分自编码器(VAE)和深度漏积回声状态网络(DLIESN)的入侵检测方法。使用VAE对数据集中的罕见攻击类样本进行扩充,平衡样本分布;构建DLIESN分类器,其层次化的储备池结构设计使模型获得更好的动态特性,提升分类精度。通过生成数据评价实验验证了VAE生成样本的有效性,确定适合DLIESN的网络结构,分析不同漏积参数对DLIESN模型性能的影响。对比实验结果表明,DLIESN取得了最短训练耗时,其检测性较优。Aiming at the problem of complex training of existing industrial control system intrusion detection methods and the problem that the model has low detection rate of attack samples,an intrusion detection method based on variational encoder(VAE)and deep leaky integrator echo state networks(DLIESN)was proposed.VAE was used to expand the rare attack samples in the data set and balance the sample distribution.The DLIESN classifier was constructed,and its hierarchical reservoirs structure design enabled the model to obtain better dynamic characteristics and improved the classification accuracy.The validity of VAE generated samples was verified by generating data evaluation experiments,the network structure suitable for DLIESN was determined,and the influence of different leaky integrator parameters on the performance of the DLIESN model was analyzed.Comparative experimental results show that DLIESN costs the shortest training time,and its detection performance is acceptable.

关 键 词：回声状态网络 变分自编码器 入侵检测 深度学习 数据增强 工业控制系统 样本均衡化策略 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]