工控入侵检测系统安全增强方案  

Security enhancement scheme for industrial control intrusion detection system

作　　者：李方晓 侯会文 石乐义[1,2] LI Fang-xiao;HOU Hui-wen;SHI Le-yi(College of Computer Science and Technology,China University of Petroleum(East China),Qingdao 266580,China;National Innovation Institute of High-end Smart Appliances,Qingdao 266101,China)

机构地区：[1]中国石油大学(华东)计算机科学与技术学院,山东青岛266580 [2]国家高端智能化家用电器创新中心,山东青岛266101

出　　处：《计算机工程与设计》2025年第1期124-130,共7页Computer Engineering and Design

基　　金：国家自然科学基金项目(62111530052);山东省自然科学基金项目(ZR2019MF034)。

摘　　要：针对基于联邦学习工控入侵检测模型训练时存在中心化、易受攻击的问题,提出一种去中心安全增强方案。在联邦学习训练中,通过模型参数确定参数聚合临时服务器并引入跳变机制,可以有效抵御拒绝服务攻击;利用系统流量数据中时间戳等信息,减缓重放攻击的影响;提出一种基于同态加密的流量加密方案。实验结果表明,所提方案可以抵抗每秒10000数据包的拒绝服务攻击,提高了联邦学习的安全性。Aiming at the problems of centralization and vulnerability to attack in the training of industrial control intrusion detection model based on federated learning,a decentralized security enhancement scheme was proposed.During model training process,the parameter aggregation temporary server was determined by model parameters,and end hopping was added,effectively resisting DoS attacks.Information such as timestamps in traffic data was utilized to mitigate the impact of replay attacks.A traffic encryption scheme based on homomorphic encryption was proposed.Experimental results show that the proposed scheme can resist DoS attacks with 10000 packets/s and improve the security of federated learning.

关 键 词：工业控制网络 入侵检测 端信息跳变 分布式拒绝服务攻击 重放攻击 同态加密 主动防御 联邦学习 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]