基于XGBoost-DNN的工业控制系统入侵检测架构  

An intrusion detection architecture for ICS based on XGBoost-DNN

作　　者：张子迎 陈玉炜 王宇华 ZHANG Ziying;CHEN Yuwei;WANG Yuhua(College of Computer Science,Jiaying University,Meizhou 514015,China;College of Computer Science and Technology,Harbin Engineering University,Harbin 150001,China)

机构地区：[1]嘉应学院计算机学院,广东梅州514015 [2]哈尔滨工程大学计算机与科学技术学院,黑龙江哈尔滨150001

出　　处：《哈尔滨工程大学学报》2024年第11期2243-2249,共7页Journal of Harbin Engineering University

摘　　要：针对工业控制系统安全防护中存在的数据不平衡问题以及提高检测的实时性与安全性,本文依据工业控制系统的架构特点,提出XGBoost-DNN双层入侵检测架构。在下层,将设计的权重焦点损失函数引入XGBoost中进行二分类入侵检测,以增强算法在不平衡数据下的鲁棒性;在上层,使用XGBoost算法进行特征选择,然后用DNN对结果进行多分类入侵检测。将该架构应用在电网稳定性和电网攻击模拟数据集上,实验结果表明:双层检测架构具有更强的鲁棒性,并且DNN模型的训练时间缩短了18.3%。To address the data imbalance problem and improve real-time security detection in industrial control systems(ICSs),this paper proposes a two-layer intrusion detection architecture named XGBoost-DNN,based on the system architecture characteristics of ICS.In the lower layer,the designed weight focal loss function is introduced to XGBoost for binary intrusion detection.This approach enhances the algorithm′s robustness when dealing with unbalanced data.In the upper layer,the XGBoost algorithm is used for feature selection,followed by applying deep neural networks(DNNs)for multi-classification intrusion detection.The architecture is applied to grid stability and grid attack simulation data sets.Experimental results show that the two-layer detection architecture is more robust and reduces the training time of DNN models by 18.3%.

关 键 词：工业控制系统 入侵检测 XGBoost DNN 分层架构 权重焦点损失函数 实时性 不平衡数据 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]