基于GraphSAGE-MGAT的工控系统入侵检测方法  

Intrusion Detection Method of Industrial Control System Based on GraphSAGE-MGAT

作　　者：胡育鸣 王华忠[1] HU Yuming;WANG Huazhong(Key Laboratory of Smart Manufacturing in Energy Chemical Process,Ministry of Education,East China University of Science and Technology,Shanghai 200237,China)

机构地区：[1]华东理工大学能源化工过程智能制造教育部重点实验室,上海200237

出　　处：《华东理工大学学报(自然科学版)》2025年第2期270-276,共7页Journal of East China University of Science and Technology

基　　金：国家自然科学基金(61973119)。

摘　　要：提出一种融合了图随机采样与聚合(GraphSAGE)和改进的图注意力网络(GAT)的工控入侵检测图神经网络算法,以处理工控入侵检测中存在的数据特征种类多和数量大等复杂特性。首先将入侵检测流量数据构建为图结构形式,利用GraphSAGE采样和聚合邻居节点信息得到节点的embedding向量,降低图结构空间复杂度,提高对大量数据处理的效率。运用改进的多头图注意力机制,丰富捕获的特征信息,计算节点之间的相关性和重要性,为各个节点分配相应权重,提高分类精准度。将该方法在工控数据集上验证,实验结果表明,该方法具有更好的时间效率以及更高的检测精度。By integrating Graph Sample and Aggregate(GraphSAGE)and improved Graph Attention Network(GAT),a neural-network-based industrial control intrusion detection is proposed to deal with the complex characteristics of data features in industrial control intrusion detection.Firstly,the intrusion detection traffic data is constructed as a graph structure,and GraphSAGE is used to sample and aggregate neighbor node information to obtain the embedding vectors of nodes,reducing the spatial complexity of the graph structure and improving the efficiency of processing large amounts of data.The improved multi-head attention mechanism is used to enrich the captured feature information,calculate the correlation and importance between nodes,assign corresponding weights to each node,and improve the classification accuracy.This method is verified on an industrial control data set,and the experimental results show that it has better time efficiency and higher detection accuracy.

关 键 词：工控系统 入侵检测 图随机采样与聚合 图注意力网络 图结构 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]