面向工艺数据分析的流程工业入侵检测及攻击定位  

Process industry intrusion detection and attack localization based on process data analysis

作　　者：钱俊磊 贾涛 曾凯 屈滨 杜学强 QIAN Junlei;JIA Tao;ZENG Kai;QU Bin;DU Xueqiang(College of Electrical Engineering,North China University of Science and Technology,Tangshan 063210,China;Tangshan Iron and Steel Enterprise Process Control and Optimization Technology Innovation Center(Tangshan ANODE Automation Co.,Ltd.),Tangshan 063000,China)

机构地区：[1]华北理工大学电气工程学院,河北唐山063210 [2]唐山市钢铁企业流程控制与优化技术创新中心(唐山阿诺达自动化有限公司),河北唐山063000

出　　处：《现代电子技术》2024年第16期117-124,共8页Modern Electronics Technique

基　　金：唐山市科技计划项目(22130204G,22130220G)。

摘　　要：为解决攻击者利用流程工业生产中深度耦合的工序参数进行生产过程攻击的问题,提出一种基于SSA-LSTM的深度学习算法,对工艺数据进行异常检测。通过麻雀优化算法优化LSTM神经网络的迭代次数、学习率和隐藏层节点数三个超参数,实现对工艺数据的准确预测。将预测数据与真实数据进行对比,超出阈值的点定义为异常点,再运用Petri网理论对生产工艺参数间的耦合关系进行建模,确定异常点与入侵点之间的因果关系,为预测结果提供理论支撑。将SWAT水处理系统数据集用于验证算法效率,证明了所提出的模型在检测精度和攻击定位准确性方面优于其他算法模型。实验结果表明,所提出的算法模型可有效检测出通过暴力篡改传感器数据对工业生产造成重大影响的入侵行为。In order to solve the problem that attackers can attack the production process by using deeply coupled process parameters in process industrial production,a deep learning algorithm based on SSA-LSTM(sparrow search algorithm-long short term memory)is proposed for the anomaly detection of process data.The SSA is used to optimize three hyperparameters of LSTM neural network:iteration number,learning rate and number of hidden layer nodes,so as to realize the accurate prediction of process data.The predicted data is compared with the real data,and these points exceeding the threshold are defined as anomalous points.Petri net theory is used to model the coupling relationship between the production process parameters to determine the causal relationship between the anomalcus points and the intrusion points,so as to provide theoretically support for the prediction results.The SWAT water treatment system dataset is used to verify the efficiency of the algorithm,and it proves that the proposed model is superior to other algorithm models in terms of detection accuracy and attack localization accuracy.The experimental results show that the proposed algorithm model can effectively detect the intrusion behaviors that has significant impacts on industrial production by violent tampering with sensor data.

关 键 词：工艺数据 工业入侵检测 攻击定位 麻雀优化算法(SSA) LSTM神经网络 工业控制系统 工业网络安全 

分 类 号：TN911.23-34[电子电信—通信与信息系统] TP273[电子电信—信息与通信工程]