基于优化核极限学习机的工控入侵检测方法

doi:10.3969/j.issn.1671-1122.2021.02.001

摘要/Abstract

摘要：

针对现有的工业控制系统入侵检测算法检测时间长,无法满足系统实时性的问题,文章提出一种基于优化核极限学习机（KELM）的工控入侵检测模型,通过改进麻雀搜索算法对KELM的正则化系数C和核参数g进行联合优化。在种群初始化阶段引进佳点集理论增加初始种群的多样性以增强全局搜索能力,提出非线性递减安全值策略并在算法迭代过程引入混沌算法避免陷入局部极小值,以扩展搜索区域。实验结果表明,文章提出的算法具有高检测率、低误报率的优势,能够满足工业控制系统高实时性的要求。

关键词: 麻雀搜索算法, 核极限学习机, 工业控制系统, 入侵检测

Abstract:

In view of the long detection time of the existing industrial control system intrusion detection algorithm, which can’t meet the real-time performance of the system, an industrial control intrusion detection model based on optimized kernel extreme learning machine is proposed. The regularization coefficient C and kernel parameter g of KELM are jointly optimized by an improved sparrow search algorithm. In the population intialization stage, the good point set theory is introduced to increase the diversity of the initial population to enhance the global search ability, and a nonlinear decreasing safety value strategy is proposed. In the algorithm iteration process, a chaotic algorithm is introduced to avoid falling into the local minimum to expand the search area. Experimental results show that this algorithm has the advantages of high detection rate and low false positive rate, and meets the high real-time requirement of industrial control system.

Key words: sparrow search algorithm, kernel extreme learning machine, industrial control system, intrusion detection

中图分类号:

TP309

杜晔, 王子萌, 黎妹红. 基于优化核极限学习机的工控入侵检测方法[J]. 信息网络安全, 2021, 21(2): 1-9.

DU Ye, WANG Zimeng, LI Meihong. Industrial Control Intrusion Detection Method Based on Optimized Kernel Extreme Learning Machine[J]. Netinfo Security, 2021, 21(2): 1-9.

图/表 16

图1

图2

图3

图4

表1

图5

图6

图7

图8

表2

图9

图10

表3

表4

图11

图12

参考文献 16

[1]	YANG An, SUN Limin, WANG Xiaoshan, et al. Intrusion Detection Techniques for Industrial Control Systems[J]. Journal of Computer Research and Development, 2016,53(9):2039-2054.
	杨安, 孙利民, 王小山, 等. 工业控制系统入侵检测技术综述[J]. 计算机研究与发展, 2016,53(9):2039-2054.
[2]	CHEN Hanyu, WANG Huazhong, YAN Bingyong. Application of CUDA and Cuckoo Algorithm-based SVM in Industrial Control System Intrusion Detection[J]. Journal of East China University of Science and Technology (Natural Science Edition), 2019,45(1):101-109.
	陈汉宇, 王华忠, 颜秉勇. 基于CUDA和布谷鸟算法的SVM在工控入侵检测中的应用[J]. 华东理工大学学报(自然科学版), 2019,45(1):101-109.
[3]	CHEN Wanzhi, XU Dongsheng, ZHANG Jing, et al. Intrusion Detection Method for Industrial Control System with Optimized Support Vector Machine and K-means++[J]. Journal of Computer Applications, 2019,39(4):1089-1094.
	陈万志, 徐东升, 张静, 等. 结合优化支持向量机与K-means++的工控系统入侵检测方法[J]. 计算机应用, 2019,39(4):1089-1094.
[4]	LI Yi, LI Yongzhong. Intrusion Detection Algorithm for Industrial Control Networks Based on Auto-encoder and Extreme Learning Machine[J]. Journal of Nanjing University of Science and Technology, 2019,43(4):408-413.
	李熠, 李永忠. 基于自编码器和极限学习机的工业控制网络入侵检测算法[J]. 南京理工大学学报, 2019,43(4):408-413.
[5]	ZHAO Guoxin, CHEN Zhilian, WEI Zhanhong, et al. Intrusion Detection of Industrial Control System Based on Optimized Extreme Learning Machine[J]. Computer Engineering and Design, 2020,41(3):608-613.
	赵国新, 陈志炼, 魏战红, 等. 基于优化极限学习机的工业控制系统入侵检测[J]. 计算机工程与设计, 2020,41(3):608-613.
[6]	CHEN Wanzhi, LI Dongzhe. Intrusion Detection Method in Industrial Control Network Combining White List Filtering and Neural Network[J]. Journal of Computer Applications, 2018,38(2):363-369.
	陈万志, 李东哲. 结合白名单过滤和神经网络的工业控制网络入侵检测方法[J]. 计算机应用, 2018,38(2):363-369.
[7]	SHI Leyi, ZHU Hongqiang, LIU Yihao, et al. Intrusion Detection of Industrial Control System Based on Correlation Information Entropy and CNN-BiLSTM[J]. Journal of Computer Research and Development, 2019,56(11):2330-2338.
	石乐义, 朱红强, 刘祎豪, 等. 基于相关信息熵和CNN-BiLSTM的工业控制系统入侵检测[J]. 计算机研究与发展, 2019,56(11):2330-2338.
[8]	XUE Jiankai, SHEN Bo. A Novel Swarm Intelligence Optimization Approach: Sparrow Search Algorithm[J]. Systems Science & Control Engineering, 2020,8(1):22-34.
[9]	LÜ Xin, MU Xiaodong, ZHANG Jun, et al. Chaos Sparrow Search Optimization Algorithm[EB/OL]. https://doi.org/10.13700/j.bh.1001-5965.2020.0298, 2020-08-31.
	吕鑫, 慕晓冬, 张钧, 等. 混沌麻雀搜索优化算法[EB/OL]. https://doi.org/10.13700/j.bh.1001-5965.2020.0298, 2020-08-31.
[10]	WANG Zhendong, LIU Yaodi, YANG Shuxin, et al. Network Intrusion Detection Based BSO and Improved RELM[EB/OL]. https://doi.org/10.16383/j.aas.c190851, 2020-04-14.
	王振东, 刘尧迪, 杨书新, 等. 基于天牛群优化与改进正则化极限学习机的网络入侵检测[EB/OL]. https://doi.org/10.16383/j.aas.c190851, 2020-04-14.
[11]	WANG Peichong. Dynamic Fireworks Explosion Search Algorithm Integrating Good-point Set[J]. Computer Applications and Software, 2015,32(8):248-251, 299.
	王培崇. 融合佳点集机制的动态搜索烟花爆炸搜索算法[J]. 计算机应用与软件, 2015,32(8):248-251,299.
[12]	ZHANG Yue, SUN Huixiang, WEI Zhenglei, et al. Chaotic Gray Wolf Optimization Algorithm with Adaptive Adjustment Strategy[J]. Computer Science, 2017,44(S2):119-122, 159.
	张悦, 孙惠香, 魏政磊, 等. 具有自适应调整策略的混沌灰狼优化算法[J]. 计算机科学, 2017,44(S2):119-122,159.
[13]	BAMAKAN S M H, WANG Huadong, TIAN Yingjie, et al. An Effective Intrusion Detection Framework Based on MCLP/SVM Optimized by Time-varying Chaos Particle Swarm Optimization[J]. Neurocomputing, 2016,199(7):90-102.
[14]	RASHID T A, ABBAS D K, TUREL Y K, et al. A Multi Hidden Recurrent Neural Network with a Modified Grey Wolf Optimizer[J]. Plos One, 2019,14(3). doi: 10.1371/journal.pone.0214587 URL pmid: 30925170
[15]	MORRIS T, GAO W. Industrial Control System Traffic Data Sets for Intrusion Detection Research[EB/OL]. https://xueshu.baidu.com/usercenter/paper/show?paperid=29c45c9e93b60cec841ad8c05f28b746&site=xueshu_se, 2020-08-16.
[16]	CHEN Hanyi. Research on Intrusion Detection Method of Industrial Control System[D]. Guilin: Guilin University of Electronic Technology, 2019.
	陈汉宜. 工业控制系统入侵检测方法研究[D]. 桂林:桂林电子科技大学, 2019.

函数名	表达式	维度	搜索区间
Ackley	$\begin{array}{l}F(x)=-20 \exp \left(-0.2 \sqrt{\frac{1}{n} \sum_{i=1}^{n} x_{i}^{2}}\right)- \\\exp \left(\frac{1}{n} \sum_{i=1}^{n} \cos \left(2 \pi x_{i}\right)\right)+20+\mathrm{e}\end{array}$	30	[-32,32]
Sphere	$F(x)=\sum_{i=1}^{n} x_{i}^{2}$	30	[-100,100]
Rosenbrock	$F(x)=\sum_{i=1}^{n-1}\left[100\left(x_{i+1}-x_{i}^{2}\right)^{2}+\left(x_{i}-1\right)^{2}\right]$	30	[-30,30]
Girewank	$F(x)=\frac{1}{4000} \sum_{i=1}^{n} x_{i}^{2}-\prod_{i=1}^{n} \cos \left(\frac{x_{i}}{\sqrt{i}}\right)+1$	30	[-600,600]

类型描述	标签值
正常数据（Normal）	0
单一类型的恶意响应注入（NMRI）	1
复杂类型的恶意响应注入（CMRI）	2
恶意状态命令注入（MSCI）	3
非法参数命令注入（MPCI）	4
恶意操作命令注入（MFCI）	5
拒绝服务（DoS）	6
非法状态扫描（RECO）	7

	训练时间/s	训练精度/%
ISSA-KELM	555.56	97.02
SSA-KELM	550.26	96.89
GWO-KELM	625.78	96.30
PSO-KELM	688.48	96.55

	检测率/%	漏报率/%	误报率/%
ISSA-KELM	96.85	6.28	1.34
SSA-KELM	96.35	7.23	1.58
GWO-KELM	96.10	7.28	1.97
PSO-KELM	95.50	8.19	2.67
KELM	95.40	8.87	2.13