基于加权联邦学习和神经网络的工控系统入侵检测  

Intrusion detection in industrial control system based on weighted federated learning and neural network

作　　者：杨驰 俞贵琪 张建军 彭博 贾徽徽[1,3] YANG Chi;YU Guiqi;ZHANG Jianjun;PENG Bo;JIA Huihui(The Third Research Institute of Ministry of Public Security,Shanghai 200031,China;Shanghai Municipal Public Security Bureau Network Security Protection Corps,Shanghai 201799,China;Shanghai Engineering Research Center of Cyber and Information Security Evaluation(The Third Research Institute of Ministry of Public Security),Shanghai 200031,China)

机构地区：[1]公安部第三研究所,上海200031 [2]上海市公安局网络安全保卫总队,上海201799 [3]上海网络与信息安全测评工程技术研究中心(公安部第三研究所),上海200031

出　　处：《智能计算机与应用》2025年第3期79-86,共8页Intelligent Computer and Applications

基　　金：科技创新2030—“新一代人工智能”重大项目(2020AAA0109300)。

摘　　要：入侵攻击对正常的工业生产流程造成阻塞和破坏,机器学习可实现对入侵检测的分类识别进而加以干预,但工控系统中各数据持有者之间存在的隐私安全壁垒无法将数据整合利用。为了打破数据壁垒,并获得更好的入侵检测分类效果,提出面向工业控制系统的联邦学习和神经网络入侵检测方法,利用多层神经网络实现入侵检测分类,通过联邦学习将各工业数据持有者的数据安全保留在本地,只传输模型和参数信息从而打破数据壁垒。针对各数据持有者的样本量不平衡问题,在联邦学习初始阶段引入权重因子来减少不平衡数据的影响,且为了弥补多维数据下单一分类任务解释性不强问题,在二分类及三分类的电力系统数据集上验证本文方法的有效性,实验结果表明本文方法具有更好的入侵检测识别效果。Intrusion attacks cause blockage and disruption to normal industrial production processes,machine learning can realize the classification and recognition of intrusion detection and then intervene,but the privacy and security barriers between various data holders in the industrial control system can not integrate and utilize the data.In order to break the barrier and obtain a better classification effect of intrusion detection,a federated learning and neural network intrusion detection method for industrial control systems is proposed.It uses multi-layer neural networks to achieve intrusion detection classification.Through federated learning,the data of each holder is kept locally,only model and parameter information are transmitted to break the data barrier.Aiming at the unbalanced sample size of each data holder,a weight factor is introduced in the initial stage of federated learning to reduce the impact of unbalanced data.In order to compensate for the weak interpretation of a single classification task under multi-dimensional data,the effectiveness of this method is verified on binary and three classification power system data sets.The experimental results show that this method has better intrusion detection and recognition effect.

关 键 词：入侵检测 工业控制系统 机器学习 联邦学习 数据不平衡 

分 类 号：TP181[自动化与计算机技术—控制理论与控制工程]