工业信息物理系统深度收缩自编码半监督入侵检测方法

Semi-supervised Intrusion Detection Method in Industrial Cyber-Physical System with Deep Contractive Autoencoder

  • 摘要: 为有效解决工业信息物理系统(ICPS)入侵检测面临的特征选择困难、攻击标签短缺等问题,研究基于深度收缩自编码器的半监督学习入侵检测方法。采用双样本KS(Kolmogorov-Smirnov)检验法根据数据概率分布选择稳定特征;采用基于重建误差的半监督结构搭建入侵检测模型,通过深度收缩自编码器学习系统正常运行模式,加入收缩惩罚项以增强对输入噪声和扰动的鲁棒性并提高特征表征性,采用F1阈值算法选定异常阈值。使用PyCharm仿真以验证方法有效性,结果表明:双样本KS检验法可有效提取稳定特征,与对比方法相比,本文研究的入侵检测方法具有较低的标签依赖性和较高的检测性能,在F1分数、精确率、召回率方面效果更优。

     

    Abstract: To effectively address the intrusion detection limitations of industrial cyber-physical systems, particularly their feature selection issues and lack of labeled attack data, we propose a semisupervised intrusion detection method based on a deep contractive autoencoder. Based on the two-sample Kolmogorov-Smirnov (KS) test, we select the stable features by analyzing the probability distribution of the data. This semisupervised approach builds the desired intrusion detection model by leveraging reconstruction errors. Furthermore, the normal operational mode of the system is learned through the deep contractive autoencoder, which is integrated with a contractive penalty term to enhance feature representation. Additionally, the F1 threshold algorithm is employed to determine the optimal anomaly threshold. Finally, we validate the proposed method through simulations conducted in PyCharm, and the results indicate that the two-sample KS test effectively extracts the stable features of the data. Compared with conventional methods, the proposed method demonstrates reduced reliance on labeled data and improved detection performance, particularly in terms of the F1 score, precision, and recall.

     

/

返回文章
返回