Design And Implementation Of Abnormal Traffic Detection Mechanism In Industrial Control Network Based On Deep Learning

With the development of industrial informatization,the industrial control system(ICS)and industrial control network have gradually been optimized and upgraded,from the original Distributed Control System(DCS)characterized by centralized management and decentralized control to the Fieldbus Control System(FCS)based on fully digital communication.Under the trend of the Ministry of Industry and Information Technology to vigorously develop the industrial Internet innovation plan,the industrial control systems and networks of most industrial enterprises in my country are developing in the form of Industrial Ethernet,which means that the relatively isolated and independent industrial control system will break the closure of the operating environment,and the network structure will be formed through the Ethernet connection form,and the existing attack threats against traditional computers and Ethernet will have the opportunity to penetrate into the operating environment of the industrial control network.As a result,the security protection work for industrial control networks has become a necessary measure to ensure the normal communication of industrial Ethernet and the normal operation of industrial production.This paper is based on deep learning methods and combined with industrial intrusion detection technology to study the anomaly detection problems of industrial control networks.The main research contents are as follows:In view of the network security risks and application security risks of industrial control networks,combined with the flow granularity and protocol level characteristics of data packets,a method for classifying abnormal traffic in industrial control networks based on convolutional neural network representation learning is proposed.By analyzing industrial control network data packets,the essence flows to content and protocol level features,and adopts feature self-learning method to design an industrial control network abnormal traffic detection model based on characterization learning.The model uses the preprocessed raw traffic data as sample data for feature learning directly,avoiding the problem of manually designing feature labels.The experimental results show that the average accuracy of anomaly detection of the trained and tuned model is 98.76%,which can reach the actual application standard of industrial control network abnormal traffic detection task.Aiming at two points of execution logic in industrial control network: status information and transmission connection information,this paper proposes a deep learning anomaly detection mechanism based on spatiotemporal characteristics,which combines the advantages of convolutional neural network(CNN)and long-term memory network(LSTM),by integrating the state features corresponding to spatial features and the transmission connection features corresponding to temporal features from the traffic data of industrial control network,for training and testing the deep learning models.The experimental results show that the detection rate of this mechanism reaches 98.9%,the detection accuracy rate reaches 99.8%,and the false alarm rate is only 0.082%.Compared with other anomaly detection algorithms,it has stronger detection ability and lower false alarm rate,which can meet the practical needs of many aspects in the industrial control network environment.