Research On Extraction Method Of Industrial Control Network Security Situation Elements Based On Random Forest

Once the industrial control system is attacked by network,it will not only bring financial losses,but also threaten the national physical security.Based on the complexity of industrial control system and the availability of requirements,situation awareness technology is applied to this field as an important means of security protection.The extraction of situation elements is the most important part in situation awareness,and the accuracy of the extraction directly affects the overall network awareness.At present,the research on situation element extraction focuses on improving the performance of classification algorithm,and the uneven distribution of data categories is also the key factor leading to the low accuracy of situation element extraction.Therefore,this paper studies the extraction of network situation elements in industrial control system from two aspects of balancing sample distribution and improving algorithm classification performance:(1)Aiming at the problem of low precision of situation elements extraction caused by unbalanced distribution of industrial control network data samples,lof-smote algorithm is studied to realize the balance of data samples.Firstly,lof algorithm is used to select outliers with large spatial distance from a few sample points,so as to prevent outliers in a few sample points from affecting the spatial position of new sample points synthesized by smote algorithm,which can overcome the limitations of smote algorithm in the process of synthesizing new sample points,Finally,the sample data of each attack category is relatively balanced;RBM algorithm is used to reduce the dimension of balanced high-dimensional data features to improve the data structure;Finally,in NSL?KDD The experimental results show that the extraction accuracy of situation elements is effectively improved after data balance.(2)In order to solve the problem of low classification ability caused by only considering the influence of classification accuracy of base classifier when extracting situation elements in random forest algorithm,a method of situation elements extraction in industrial control network based on selective integration of random forest is proposed.Firstly,multiple base classifiers are generated from random forest,and high-precision base classifiers are obtained by using kappa coefficient as the standard.Then,the inconsistent measurement method is used to retain the base classifiers with strong differences,and the weighted voting method is used to obtain the results of industrial control network situation elements extraction.Finally,a comparative experiment is conducted on industrial intrusion detection data sets,and the results show that the method is effective The algorithm has the highest accuracy in extracting industrial control situation elements.