Industrial Control Intrusion Detection Approach Based On Multi-classification GoogLeNet-LSTM Model

With the advent of the era of Industry 4.0,industrial production activities have shown a development trend of automation,networking and information.As an important part of the country's key infrastructure,the industrial control system is widely used in important fields such as industry,energy,transportation,and municipal administration.It plays an important role in maintaining normal industrial production activities,maintaining national property security,and protecting the stability of people's lives.The intrusion detection system is a network security device that monitors network transmission in real time.According to a designed intrusion detection approach,the system will alert or take proactive measures when suspicious transmissions are found.This system is an active security protection technology different from traditional network security equipment.The industrial control intrusion detection system is a key factor to ensure the stable operation of the industrial control system,which indirectly guarantees the normal progress of industrial production activities.However,the detection approach of traditional industrial control intrusion detection technology is designed simply.These technologies have poor detection accuracy,large false detection rate and miss rate in the detection process.At present,deep learning technology is developing rapidly and has been widely used in people's life,industrial production,military activities,etc.It can complete many tasks that are difficult to accomplish by traditional methods with the excellent computational level and learning ability of various neural networks.This paper designs a multi-classification GoogLeNet-LSTM model and studies an industrial control intrusion detection method based on deep learning technology aiming at the industrial control communication process using Modbus communication protocol.The method consists of three parts: feature extraction,time-series detection and multi-classification of intrusion.It has made great progress in terms of detection accuracy,false detection rate and miss rate.Firstly,the research background and practical significance of the subject are described and various existing intrusion detection approaches are introduced.Different detection approaches are compared and advantages and disadvantages of these approaches are analyzed.An intrusion detection approaches based on deep learning was introduced which laid the foundation for the proposed approach.Secondly,a multi-classification GoogLeNet-LSTM model is designed.This model uses LSTM network as the main body,uses GoogLeNet as a feature extraction tool,and adds an attention mechanism to assist in processing long sequence tasks.Thirdly,the industrial control intrusion detection approach based on the multiclassification GoogLeNet-LSTM model is studied.This approach first analyzes the working principle of the Modbus protocol and divides network packets into two types of network packets that carry information based on key fields.A template comparison method is used for detection for network packets that do not carry information.The designed model is used for detection for network packets that carry information.Then,the detection results are multi-classified to determine the specific intrusion type.Specific intrusion types are determined based on key fields for network packets that do not carry information.A softmax classifier is trained at the end of the network model to determine the specific intrusion type for network packets that carry information.Finally,the proposed approach was modeled and the dataset of the natural gas pipeline control system based on Modbus protocol communication was used for model verification.The final industrial control intrusion detection indicators were: 97.56% detection accuracy,2.42% false detection rate,and 2.51% miss rate.The approach is compared with other methods which verified that the method has better industrial control intrusion detection capability.