Research On Intrusion Detection Of Industrial Control System Based On Feature Enhancement And Ensemble Learning

As the core of key infrastructure,industrial control system(ICS)is related to production and livelihood of the country.With the advancement of industrial informatization,the number of industrial control system vulnerabilities and industrial network viruses are increase sharply.Industrial control system is faced with serious information security problems.It is urgent to take effective protective measure.Industrial intrusion detection is one of the effective methods.But the problems of low data quality and low model efficiency seriously affect the protection ability of intrusion detection system.In view of this situation,the characteristics of the industrial control system are analyzed in this paper.And the intrusion detection technology of industrial control system is studied from two aspects: data quality and model performance.An intrusion detection method for industrial control system based on feature enhancement and ensemble learning is proposed in this paper.Firstly,the related machine learning theories are introduced in this paper.The commonly used machine learning algorithms are analyzed.And the ensemble learning is chosen to build the detection model.According to the characteristics of industrial control intrusion detection and the requirements of ensemble learning,support vector machine(SVM),extreme learning machine(ELM)and logical regression(LR)algorithms are selected as the mainly used algorithms and ensemble objects.And these three algorithms are introduced.Then the industrial intrusion detection standard dataset used in this paper is introduced.And the dataset is preprocessed.ICS intrusion detection data are improved in this paper.In order to solve the problem of low data quality in industrial intrusion detection system,the original data features were enhanced by using log-marginal density ratio transformation(LMDRT).And one versus rest(OVR)was used to extend the transformation method into multiple classification cases.The single algorithm intrusion detection models were built based on SVM,ELM and LR algorithms respectively.And the enhanced data were used for experiment.The result showed that LMDRT could effectively improve the detection accuracy and other performance indexes.And OVR-DT enhanced data had better performance in the detection of MFCI and Do S attacks.The SVM detection model in the single intrusion detection model is optimized in this paper.In order to solve the problem that particle swarm optimization is easy to fall into local optimum in the process of SVM parameter optimization,a particle swarm optimization algorithm combining adaptive weight and particle reconstruction(AWPRPSO)is proposed in this paper.Firstly,the good-point set method was used to ensure the initial population diversity.Then the population aggregation degree is used to guide the adaptive weight change to balance the global and local search ability of the population.Finally,particle reconstruction strategy is used to solve the problem that the original algorithm is easy to fall into local optimal.The intrusion detection model of SVM based on enhanced data and AWPRPSO optimization is constructed.Experimental results show that AWPR-PSO algorithm improves the performance of SVM intrusion detection model compared with other optimization algorithms.Finally,the single intrusion detection models are aggregated to construct an intrusion detection model based on ensemble learning.Because ensemble learning has been proved to have better generalization ability and detection accuracy than single machine learning method,a new ensemble learning industrial intrusion detection method is proposed in this paper to further improve the detection model performance.And SVM,ELM and LR classifiers are aggregated by support vector machines.An intrusion detection model based on this method is constructed.The experimental results show that the proposed intrusion detection model can improve the detection accuracy and efficiency of multiple attacks.