Research On Intrusion Detection For Industrial Control System Based On Incremental Learning

With the development of the information technology of industrial control system,it makes industrial control network more and more connected with the public network of outside world.As a result,the number of global industrial control network attacks has gradually increased.In order to realize the safety protection of the industrial control system,this paper put forward a kind of industrial control system intrusion detection method based on improved increment learning to solve the light of the extension of the intrusion detection for industrial control system currently,slow speed of model establishment,update price higher and so on.Based on the traditional intrusion detection system of industrial control network,the paper designs a data processing method of octopus structure.The method can allocate the training process data into the center of analysis and the process of test data into every front-end acquisition devices,which will make the front-end acquisition devices,which enables front-end acquisition device with independent detection capabilities and reduces the numbers of data transmission and improves the real-time performance of the detection.In process of incremental learning,with the increase of the new sample data,the analysis center equipment can produce great overhead and when the sample data quantity reaches certain limit it may not be able to complete training in time.So,the paper puts forward an improved incremental learning algorithm to improve the learning efficiency.First of all,based on the deep analysis of the Modbus/TCP protocol of the industrial control network,it extracted the 6 characteristics to constitute a sample set.In the initial learning process,it used the OCSVM algorithm and PSO algorithm to realize the initial learning model.In the process of incremental learning,new sample data use the initial learning model to find the data of violating KKT conditions,and to build an area of near class interval.Sample data of the near class interval and the original support vector are set to be become the training sample set and save the initial parameters in the model.Finally,once again OCSVM training incremental learning model is set up.This learning process can greatly reduce the incremental learning training sample number.Finally,the method was tested in the intrusion detection platform of electric control system.Test results verify the improved incremental learning algorithm can guarantee the accuracy.At the same times it also greatly reduces time of the building intrusion detection model of industrial control system and increases the speed of incremental learning.The intrusion detection of industrial control system based on incremental learning includes two innovations.First,the octopus distributed data processing methods.It can reduce the number of data transmission,improve the real time detection.Second,by building near classification interval reduces the original sample selectively and adds new sample sets.It can greatly reduce the incremental learning training sample data.