Intrusion Detection Method Of Industrial Internet Based On Neural Network

If the security vulnerabilities in the industrial Internet system are exploited by attackers,it is very likely to cause the paralysis of the industrial system and consequently cause huge losses.For intrusions that may occur in the industry,we should take precautions against them.Therefore,the security of the Industrial Internet has become a necessary guarantee for its development.Industrial Internet intrusion detection technology is one of the more commonly used defense methods.However,the research on industrial Internet intrusion detection technology is still in its infancy.Applying traditional intrusion detection technology to the Internet environment,although abnormal data is detected to a certain extent,there are also problems of low accuracy,long training time and overfitting of traditional intrusion detection models.Aiming at the above problems,this paper adds the idea of multi-scale feature extraction and factorization to the residual network,proposes an intrusion detection model based on M-DRN,adds BN algorithm to accelerate network convergence,and uses the Dropout method to prevent model overfitting.Secondly,because most of the data monitored by IDS is industrial data,this article analyzes the structure of the general Modbus protocol of the industrial system,and modifies the data of the traditional network data set NSL-KDD to Modbus TCP structure,and uses the Modbus TCP protocol data set as the industrial Internet Benchmark data set for the study.Finally,aiming at the problem of weak timing characteristics of M-DRN extracted data,GRU is used to extract the time characteristics of traffic,and combined with the dense multi-core residual structure,a DMR-GRU intrusion detection model is proposed.The NSL-KDD data set and the industrial Internet data set were used to train and test the two models,and the effects of the two intrusion detection models were compared and analyzed.The results show that the multi-scale feature extraction of M-DRN can enhance the performance of the model.Compared with CNN,Resnet and RNN-IDS,it has different degrees of improvement in preventing over-fitting ability,classification accuracy and convergence speed.Compared with the M-DRN network model,the detection accuracy of the DMR-GRU model for abnormal traffic has been improved to meet the detection requirements for industrial Internet attacks.