基于CNN-LSTM-Attention的工业控制系统网络入侵检测方法研究  

Research on network intrusion detection method for industrial control system based on CNN-LSTM-Attention

作　　者：李笛 杨东[1] 王文庆[1] 邓楠轶 刘鹏飞[1] 崔逸群[1] 刘超飞[1] 朱博迪 LI Di;YANG Dong;WANG Wenqing;DENG Nanyi;LIU Pengfei;CUI Yiqun;LIU Chaofei;ZHU Bodi(Xi’an Thermal Power Research Institute Co.,Ltd.,Xi’an 710054,China)

机构地区：[1]西安热工研究院有限公司,陕西西安710054

出　　处：《热力发电》2024年第5期115-121,共7页Thermal Power Generation

基　　金：中国华能集团有限公司总部科技项目(HNKJ21-H48)。

摘　　要：随着各类网络攻击事件的增加,能源电力基础设施中工业控制系统安全问题也逐渐成为人们关注的焦点。结合电力系统的特点,提出一种融合卷积神经网络(convolutional neural network,CNN)、长短时记忆(long short-term memory,LSTM)神经网络和注意力(Attention)机制的CNN-LSTM-Attention网络入侵检测算法模型,通过在实验室仿真环境中构造和采集600 MW燃煤机组制粉系统在3种典型工况下受到网络攻击的运行状态数据集,对所提出的检测算法模型进行训练和评估。结果表明:相较于CNN、LSTM模型,所提出的入侵检测算法模型性能最优;模型准确率、精确率、召回率等评级指标均为最好,综合评价优于其他的入侵检测方法。该入侵检测算法模型具有较强的创新性和实用性。With the increase of various types of cyber-attacks,the security of industrial control systems in energy and power infrastructures has gradually become a focus of attention.Combined with the characteristics of power system,the CNN-LSTM-Attention network intrusion detection algorithm model integrating convolutional neural network(CNN),long and short-term memory(LSTM)neural network and Attention mechanism is proposed.By constructing and collecting the operating state data sets of the pulverizing system of a 600 MW coal-fired unit under three typical operating conditions under cyber-attacks in a laboratory simulation environment,the proposed detection algorithm model is trained and evaluated.The results show that,the proposed intrusion detection algorithm model has the best performance compared with the CNN and LSTM models.The model has the best rating indexes such as accuracy,precision,recall,etc.,and the comprehensive evaluation is better than other intrusion detection methods.The intrusion detection algorithm model is highly innovative and practical.

关 键 词：工业控制系统 网络入侵检测 CNN LSTM神经网络 注意力机制 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP273[自动化与计算机技术—计算机科学与技术] TM73[电气工程—电力系统及自动化]